KRYBIT Ransomware Gang: 14 Victims Posted in Single-Day Surge — Cross-Sector Campaign Analysis & Detection Engineering

---
title: KRYBIT Affiliate - RMM Tool Execution and Remote Access Software Abuse
id: 8f3a1c2e-4b5d-4e6a-9c7d-1e2f3a4b5c6d
status: experimental
description: Detects execution of remote access tooling (ScreenConnect, AnyDesk, Splashtop, TeamViewer) commonly abused by KRYBIT affiliates for persistence and lateral movement following perimeter exploitation such as CVE-2026-50751 / CVE-2024-1708.
author: Security Arsenal Threat Intelligence
date: 2026/09/01
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\AnyDesk.exe'
      - '\Splashtop.exe'
      - '\SRManager.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\AteraAgent.exe'
      - '\dwagent.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_approved:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_img and selection_path and not filter_approved
falsepositives:
  - Legitimate RMM deployments installed to non-standard paths; baseline approved RMM paths per environment
level: high
tags:
  - attack.command_and_control
  - attack.t1219
---
title: KRYBIT Affiliate - Lateral Movement via PsExec or WMI Remote Process Creation
id: 7e2b0d1f-3a4c-4d5b-8b6c-0d1e2f3a4b5c
status: experimental
description: Detects PsExec service installation and WMI remote process spawning patterns observed in KRYBIT affiliate lateral movement prior to mass encryption deployment.
author: Security Arsenal Threat Intelligence
date: 2026/09/01
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\PsExec.exe'
      - '\PsExec64.exe'
    CommandLine|contains:
      - 'accepteula'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: 1 of selection_psexec or 1 of selection_wmi
falsepositives:
  - Administrative tooling; alert on parent-child anomalies and correlate with source host administrative logon events
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
---
title: KRYBIT Pre-Encryption Staging - Shadow Copy Deletion and Mass Archive Creation
id: 6d1a9c0b-2b3a-4a4b-7a5b-9c0d1e2f3a4b
status: experimental
description: Detects Volume Shadow Copy deletion and mass compression utility execution indicative of KRYBIT pre-encryption staging and recovery inhibition. High-confidence T-minus indicator.
author: Security Arsenal Threat Intelligence
date: 2026/09/01
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith:
        - '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled no'
        - 'ignoreallfailures'
  selection_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' -p'
      - ' a '
  condition: selection_vss or selection_archive
falsepositives:
  - Legitimate backup maintenance and software packaging; shadow copy deletion outside backup windows is almost never legitimate
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.collection
  - attack.t1560.001

// KRYBIT Campaign Hunt: Pre-Ransomware Lateral Movement & Data Staging
// Microsoft Sentinel — hunt for affiliate TTP chain: remote logon → admin share → RMM/staging → VSS tamper
// Recommended lookback: 14 days (matches observed dwell time)

let Lookback = 14d;
let SuspiciousRMM = dynamic(["ScreenConnect", "AnyDesk", "Splashtop", "AteraAgent", "dwagent", "TeamViewer"]);

// Stage 1: Remote logons of administrative accounts from anomalous sources
let AdminLogons = SecurityEvent
| where TimeGenerated > ago(Lookback)
| where EventID == 4624 and LogonType in (3, 10)
| where AccountType == "User"
| extend AccountLower = tolower(Account)
| summarize FirstLogon=min(TimeGenerated), SourceIPs=make_set(IpAddress), Targets=make_set(Computer) by AccountLower, bin(TimeGenerated, 1d);

// Stage 2: Process creation on servers — staging, archiving, shadow tamper
let StagingActivity = union
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any ("vssadmin", "bcdedit", "wmic", "rar", "7z", "winrar")
       or ProcessCommandLine has_any ("delete shadows", "recoveryenabled", "shadowstorage")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName),
    (DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
      and FileName has_any ("cmd", "powershell", "rundll32", "mshta", "PsExec")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName);

// Stage 3: RMM binaries appearing outside approved install paths
let RMMAnomaly = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName has_any (SuspiciousRMM)
| where FolderPath has_any ("\\Temp\\", "\\Public\\", "\\ProgramData\\")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessAccountName;

// Stage 4: Outbound volume anomaly (exfil proxy) — bytes out spike per device
let ExfilSignal = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteIPType == "Public"
| summarize TotalConnections=count(), UniqueDest=dcount(RemoteIP) by DeviceName, bin(TimeGenerated, 6h)
| where TotalConnections > 500 and UniqueDest < 10;

// Correlate: devices with staging activity AND (RMM anomaly OR exfil signal)
StagingActivity
| summarize StagingHits=count(), Commands=make_set(ProcessCommandLine, 10) by DeviceName
| join kind=inner (RMMAnomaly | summarize RMMBins=make_set(FileName) by DeviceName) on DeviceName
| join kind=leftouter (ExfilSignal | summarize PeakConns=max(TotalConnections) by DeviceName) on DeviceName
| project DeviceName, StagingHits, RMMBins, PeakConns, Commands
| order by StagingHits desc;

# KRYBIT Rapid Triage Script — Security Arsenal IR
# Run on suspected compromised hosts or domain-wide via remoting.
# Checks: recent scheduled tasks, shadow copy state, exposed RDP, suspicious services, recent staging artifacts.
# Usage: .\KRYBIT-RapidTriage.ps1 [-DaysBack 7]

param([int]$DaysBack = 7)
$Cutoff = (Get-Date).AddDays(-$DaysBack)
$Report = [ordered]@{}

Write-Host "=== KRYBIT Rapid Triage — $(hostname) — $(Get-Date -Format 'yyyy-MM-dd HH:mm') ===" -ForegroundColor Cyan

# 1. Scheduled tasks created in last N days (persistence check)
Write-Host "`n[1] Scheduled tasks created/modified since $Cutoff" -ForegroundColor Yellow
$Tasks = Get-ScheduledTask | Where-Object { $_.Date -gt $Cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={($_.Actions | Select-Object -First 1).Execute}}
$Tasks | Format-Table -AutoSize
$Report['NewTasks'] = $Tasks

# 2. Volume Shadow Copy status (T-minus indicator — deletion precedes encryption)
Write-Host "`n[2] Volume Shadow Copies" -ForegroundColor Yellow
$Shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($Shadows) {
    $Shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
} else {
    Write-Host "  !! NO SHADOW COPIES FOUND — investigate vssadmin/bcdedit execution immediately" -ForegroundColor Red
}
$Report['ShadowCopies'] = if ($Shadows) { $Shadows.Count } else { 0 }

# 3. RDP exposure check (common KRYBIT affiliate entry / brute-force target)
Write-Host "`n[3] RDP Configuration" -ForegroundColor Yellow
$RDPEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$RDPPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
$NLA = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
Write-Host "  RDP Disabled flag: $RDPEnabled (0 = RDP ENABLED) | Port: $RDPPort | NLA: $NLA"
if ($RDPEnabled -eq 0 -and $NLA -ne 1) { Write-Host "  !! RDP enabled WITHOUT NLA — brute-force exposure" -ForegroundColor Red }
$Report['RDP'] = @{ Enabled = ($RDPEnabled -eq 0); Port = $RDPPort; NLA = $NLA }

# 4. Suspicious services / RMM artifacts installed recently
Write-Host "`n[4] Services with binaries in Temp/Public/ProgramData (RMM & malware staging)" -ForegroundColor Yellow
$SuspServices = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'Temp|Public|ProgramData' -and $_.PathName -notmatch 'Windows\\Temp'
} | Select-Object Name, DisplayName, State, StartMode, PathName
$SuspServices | Format-Table -AutoSize
if ($SuspServices) { Write-Host "  !! Suspicious service paths detected — investigate" -ForegroundColor Red }
$Report['SuspiciousServices'] = $SuspServices

# 5. Recently created executables/archives in staging locations
Write-Host "`n[5] Executables & archives created in last $DaysBack days in staging dirs" -ForegroundColor Yellow
$Staged = foreach ($Dir in @("$env:TEMP", "C:\Users\Public", "C:\ProgramData")) {
    if (Test-Path $Dir) {
        Get-ChildItem $Dir -Recurse -Depth 2 -Include *.exe,*.dll,*.rar,*.zip,*.7z,*.ps1 -ErrorAction SilentlyContinue |
            Where-Object { $_.CreationTime -gt $Cutoff } |
            Select-Object FullName, CreationTime, Length
    }
}
$Staged | Sort-Object CreationTime -Descending | Format-Table -AutoSize
$Report['StagedFiles'] = $Staged

# 6. Failed logon burst check (RDP/VPN brute force signature)
Write-Host "`n[6] Failed logon (4625) volume — last $DaysBack days" -ForegroundColor Yellow
$Failed = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$Cutoff} -ErrorAction SilentlyContinue
if ($Failed) {
    $Failed | Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending |
        Select-Object -First 10 @{N='SourceIP';E={$_.Name}}, Count | Format-Table -AutoSize
    if ($Failed.Count -gt 100) { Write-Host "  !! $($Failed.Count) failed logons — brute force indicator" -ForegroundColor Red }
} else { Write-Host "  No 4625 events in window (or insufficient privileges/log size)" }

$Report | ConvertTo-Json -Depth 4 | Out-File ".\KRYBIT-Triage-$(hostname)-$(Get-Date -Format 'yyyyMMdd-HHmm').json"
Write-Host "`n=== Triage complete. JSON report written to working directory. ===" -ForegroundColor Cyan