Ransomware Feud Exposes 0APT and KryBit Operations

Summary

Halcyon researchers say a feud between 0APT and KryBit exposed operational data and showed that 0APT’s initial list of 190+ victims was fabricated. They recommend monitoring for data staging, validating backups, and deploying anti-ransomware defenses.

Key points

Halcyon says 0APT’s initial list of more than 190 victims was fabricated, with access logs showing no data was exfiltrated from those listed victims.
KryBit reportedly breached 0APT and leaked its access logs, PHP source code, and system files.
The exposure reportedly revealed two KryBit administrators, five affiliates, 20 potential victims, and ransom demands of $40,000 to $100,000.
0APT posted an SQL database attributed to Everest, but critical fields were encoded or hashed; the listing mentioned RansomHouse but included no RansomHouse data.
Halcyon says both operators may need to rebuild, rebrand, and create new infrastructure after the exposure.
Halcyon recommends monitoring for data staging and exfiltration, validating backup integrity, and deploying anti-ransomware defenses; it identifies KryBit and Everest as legitimate threats.

Article Details

Event Type: Ransomware-operator feud involving mutual breaches, data exfiltration, and public leaks of operational information.
Impact: KryBit exposed 0APT's access logs, PHP source code, and system files after breaching and exfiltrating its infrastructure. The leaked logs showed that 0APT's initial list of more than 190 victims was fabricated and that no data had been exfiltrated from those listed victims. Earlier disclosures also exposed KryBit's infrastructure and personnel, including two administrators, five affiliates, 20 potential victims, and ransom demands. Halcyon researchers said both operators may need to rebuild, rebrand, and create new infrastructure.

People

Erika TotaroIntelligence analyst with the Halcyon Ransomware Research Center who provided analysis of 0APT's tactics and the defensive value of information exposed during ransomware-operator feuds.

Threat Actors

0APTRansomware-as-a-service operator that Halcyon assessed used functioning encryptors. It claimed attacks against other ransomware operators; leaked access logs later showed its initial list of more than 190 victims was fabricated and that no data was exfiltrated from those listed victims.EverestEstablished ransomware operator named in 0APT's claimed attacks and in a leak listing that included an SQL database belonging to Everest. Halcyon said Everest should be treated as a legitimate threat; it had not publicly retaliated or acknowledged the incident at the time of reporting.KrybitRansomware-as-a-service operator that breached and exfiltrated 0APT's infrastructure, then leaked its operational data. The article says KryBit published legitimate victims and should be treated as an active threat.RansomHouseRansomware operator named in 0APT's claimed attacks and in a joint listing with Everest; Halcyon reported that no RansomHouse data was included in the leak.

Products

ESXiKryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi, and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps 80% of ransom payments and LinuxKryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi, and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps 80% of ransom payments and Microsoft WindowsKryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi, and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps 80% of ransom payments and