KRYBIT Ransomware Gang: 3 New Victims Posted to Leak Site — Turkey/Germany Targeting, Healthcare Exposure & Detection Rules

---
title: KRYBIT - Edge VPN Auth Anomaly Followed by Internal RDP/WinRM
id: 4f8a2c11-9b3e-4d7a-a1c2-krybit000001
status: experimental
description: Detects successful VPN authentication from unusual source followed within short window by internal remote access (RDP/WinRM/SMB admin share) — consistent with KRYBIT edge-exploitation-to-lateral-movement chain observed 2026-09
date: 2026/09/21
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
    product: windows
    service: security
    EventID: 4624
    LogonType: 3
    WorkstationName: null
detection:
    selection_remote_auth:
        LogonType: 10
        AuthenticationPackageName: 'Negotiate'
    filter_vpn_pool:
        IpAddress|startswith:
            - '10.'
            - '172.16.'
            - '192.168.'
    condition: selection_remote_auth and not filter_vpn_pool
falsepositives:
    - Legitimate remote workers (tune with known VPN egress ranges)
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1021.001
---
title: KRYBIT - PsExec / WMI Remote Service Creation for Lateral Movement
id: 4f8a2c11-9b3e-4d7a-a1c2-krybit000002
status: experimental
description: Detects remote service creation events typical of PsExec-style lateral movement and Cobalt Strike psexec/spawnas usage observed in pre-encryption staging
date: 2026/09/21
author: Security Arsenal Threat Intelligence
logsource:
    product: windows
    service: system
    EventID: 7045
detection:
    selection:
        ServiceName|contains:
            - 'PSEXESVC'
            - 'PAExec'
            - 'RemCom'
            - 'csexecsvc'
    selection_random_name:
        ServiceName|re: '^[a-zA-Z0-9]{7,8}$'
        ImagePath|contains: 'ADMIN$'
    condition: selection or selection_random_name
falsepositives:
    - Legitimate admin tooling — baseline known admin service names
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002
---
title: KRYBIT - Pre-Encryption Staging - Shadow Copy Deletion and Backup Tampering
id: 4f8a2c11-9b3e-4d7a-a1c2-krybit000003
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and recovery disabling — near-certain T-minus indicator that ransomware detonation is imminent
date: 2026/09/21
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'resize shadowstorage'
    selection_bcd:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    selection_wbdb:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    condition: 1 of selection_*
falsepositives:
    - Rare; some backup software resizes shadow storage — whitelist by Image path of backup agents
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1562.001

// KRYBIT pre-ransomware staging hunt — Sentinel
// Looks for: edge auth -> admin tool execution -> mass remote execution -> shadow copy tampering
// Run across 14-day window; tune the rare-tool list to your environment
let lookback = 14d;
let RareAdminTools = dynamic(["psexec.exe","psexesvc.exe","paexec.exe","remcom.exe","wmic.exe","nltest.exe","adfind.exe","sharpview.exe","seatbelt.exe","rclone.exe","megacmd.exe","7z.exe"]); // 7z/rclone = staging+exfil
let TamperCmds = dynamic(["delete shadows","shadowcopy delete","recoveryenabled no","delete catalog","wbadmin delete"]);
let EdgeAuth =
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | where AppDisplayName has_any ("VPN","AnyConnect","GlobalProtect","Check Point","Firepower") or ResultType == 0
    | summarize FirstVPN= min(TimeGenerated) by UserPrincipalName, IPAddress
    | where IPAddress !startswith "10." and IPAddress !startswith "192.168.";
let ToolExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (RareAdminTools) or ProcessCommandLine has_any (TamperCmds)
    | extend Tamper = iff(ProcessCommandLine has_any (TamperCmds), 1, 0)
    | summarize ToolRuns = count(), TamperEvents = sum(Tamper),
                Tools = make_set(FileName),
                FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
      by DeviceName, InitiatingProcessAccountName;
ToolExec
| where TamperEvents > 0 or ToolRuns >= 3
| join kind=leftouter (EdgeAuth) on $left.InitiatingProcessAccountName == $right.UserPrincipalName
| project DeviceName, InitiatingProcessAccountName, Tools, ToolRuns, TamperEvents,
          FirstSeen, LastSeen, ExternalVPNIP = IPAddress
| order by TamperEvents desc, ToolRuns desc;

# Security Arsenal — KRYBIT Rapid Triage (run elevated on suspect hosts/DCs)
# Checks: exposed RDP, recent scheduled tasks, shadow copies, suspicious services
$days = 7; $since = (Get-Date).AddDays(-$days)
Write-Host "=== [1] RDP Exposure ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
"RDP Enabled: $(if($rdp.fDenyTSConnections -eq 0){'YES - EXPOSED'}else{'Disabled'}) | NLA: $($nla.UserAuthentication)"
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue | Where-Object Enabled -eq 'True' | Select-Object DisplayName,Profile,Action | Format-Table

Write-Host "=== [2] Scheduled Tasks (last $days days) ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -gt $since -and $_.Author -notmatch 'Microsoft' } |
    ForEach-Object { $a = ($_.Actions | Select-Object -First 1); [PSCustomObject]@{Name=$_.TaskName; Author=$_.Author; Created=$_.Date; Exec=$a.Execute; Args=$a.Arguments} } | Format-List

Write-Host "=== [3] Volume Shadow Copies ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "WARNING: NO shadow copies present — possible vssadmin deletion (T1490)!" } else { $shadows | Select-Object InstallDate,DeviceObject | Format-Table }

Write-Host "=== [4] Suspicious Services (PsExec-style, last $days days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=$since} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'PSEXESVC|ADMIN\$|PAExec|RemCom' -or $_.Message -match '%TEMP%|AppData' } |
    Select-Object TimeCreated,Message | Format-List

Write-Host "=== [5] Recent 4624 Type-10 (RDP) from external-range IPs ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$since} -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+10' } |
    Select-Object -First 20 TimeCreated,Message | Format-List