KRYBIT Ransomware Gang: 4 Victims Posted in 24 Hours — Cross-Continental Campaign Analysis & Detection Rules

---
title: Check Point VPN Gateway Exploitation - IKEv1 Auth Bypass Follow-On Activity
id: 8f3a2b1c-krybit-2026-0001
status: experimental
description: Detects suspicious authentication and process activity on/behind Check Point gateways consistent with CVE-2026-50751 exploitation followed by internal tooling deployment. Tune source log to your VPN/firewall audit feed.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: authentication
  product: checkpoint
detection:
  selection_ikev1:
    ike_version: 'IKEv1'
    auth_result: 'success'
  selection_anomaly:
    - src_ip|cidr:
        - '0.0.0.0/0'
    - auth_method:
        - 'certificate'
        - 'psk'
  filter_known_admins:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection_ikev1 and selection_anomaly and not filter_known_admins
falsepositives:
  - Legacy site-to-site tunnels still using IKEv1 (migrate and suppress)
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - cve.2026.50751
---
title: Ransomware Pre-Encryption Staging - Shadow Copy Deletion and Backup Tampering
id: 8f3a2b1c-krybit-2026-0002
status: tested
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot configuration changes executed in rapid succession — the canonical pre-detonation sequence for ransomware crews including KRYBIT's assessed playbook.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
      - '\bcdedit.exe'
      - '\wmic.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'delete systemstatebackup'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
      - 'shadowcopy delete'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance windows (suppress by service account + change ticket window)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: RMM Tool Abuse - ScreenConnect and Unauthorized Remote Access Execution
id: 8f3a2b1c-krybit-2026-0003
status: tested
description: Detects execution of remote access tooling (ScreenConnect, AnyDesk, TeamViewer, Atera, Splashtop) from non-standard paths or by non-approved publishers — a hallmark of ransomware affiliate persistence and lateral movement, correlated with CVE-2024-1708 exploitation.
author: Security Arsenal Threat Intelligence
date: 2026/08/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_names:
    Image|endswith:
      - '\screenconnect.clientservice.exe'
      - '\screenconnect.windowsclient.exe'
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\splashtop.exe'
      - '\atera_agent.exe'
  selection_suspicious_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  filter_approved_path:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_names and selection_suspicious_path and not filter_approved_path
falsepositives:
  - User-installed portable remote tools in BYOD environments (inventory and allowlist)
level: high
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.persistence
  - cve.2024.1708

// KRYBIT-style pre-detonation hunt: lateral movement + staging + exfil signals in a 72h window
// Deploy as a scheduled analytic rule (severity: High, frequency: 4h)
let Lookback = 72h;
let LateralTools = dynamic(["psexec.exe","wmic.exe","wmiprvse.exe","powershell.exe","cmd.exe","net.exe","nltest.exe","adfind.exe","rclone.exe","7z.exe","winrar.exe"]);
let SuspectHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (LateralTools)
    | where ProcessCommandLine has_any ("\\admin$", "\\c$", "psexec", "/node:", "archive", "copy ", "--transfers", "mega.nz", "mega.io")
       or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("invoke-wmimethod", "enter-pssession", "new-pssession", "iex", "frombase64string"))
    | summarize ToolHits = count(), Tools = make_set(FileName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, InitiatingProcessAccountName, bin(TimeGenerated, 1h);
let VcsTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled", "delete catalog")
    | summarize VCSEvents = count() by DeviceName;
let ExfilSignals =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any ("mega.nz", "mega.io", "temp.sh", "transfer.sh", "anonfiles", "gofile.io", "file.io")
       or (InitiatingProcessFileName =~ "rclone.exe")
    | summarize ExfilConns = count(), ExfilDests = make_set(RemoteUrl) by DeviceName;
SuspectHosts
| join kind=leftouter VcsTamper on DeviceName
| join kind=leftouter ExfilSignals on DeviceName
| extend RiskScore = ToolHits + (toint(VCSEvents) * 10) + (toint(ExfilConns) * 5)
| project DeviceName, InitiatingProcessAccountName, ToolHits, Tools, VCSEvents, ExfilConns, ExfilDests, FirstSeen, LastSeen, RiskScore
| order by RiskScore desc;

# KRYBIT Rapid Triage: run on suspected hosts or via your EDR remote shell
# Checks: (1) shadow copy presence/deletion, (2) scheduled tasks created in last 7 days,
#         (3) unexpected RMM tools, (4) RDP exposure state
$Report = @{}

Write-Host "[1] Volume Shadow Copies" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$Report.ShadowCopies = if ($shadows) { $shadows.Count } else { 0 }
if ($Report.ShadowCopies -eq 0) { Write-Host "  !! NO shadow copies present — possible vssadmin deletion" -ForegroundColor Red }
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 50 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Shadow Copy' } | Select-Object TimeCreated, Message

Write-Host "[2] Scheduled Tasks (last 7 days, non-Microsoft)" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Author -notmatch 'Microsoft' -and $_.TaskPath -notlike '\Microsoft*' } |
  ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author; LastRun=$info.LastRunTime; Action=($_.Actions | Select-Object -First 1).Execute }
  } | Sort-Object LastRun -Descending | Format-Table -AutoSize

Write-Host "[3] RMM Tool Processes" -ForegroundColor Cyan
$rmm = 'ScreenConnect','AnyDesk','TeamViewer','Splashtop','Atera','LogMeIn','dwagent'
Get-Process | Where-Object { $p = $_.ProcessName; $rmm | Where-Object { $p -match $_ } } |
  Select-Object ProcessName, Id, Path

Write-Host "[4] RDP Exposure" -ForegroundColor Cyan
$rdp = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$Report.RDPEnabled = ($rdp -eq 0)
Write-Host ("  RDP enabled: {0}" -f $Report.RDPEnabled)
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, OwningProcess

Write-Host "`nTriage complete. Escalate any red flags to IR immediately." -ForegroundColor Green