KRYBIT Ransomware Gang: 5 New Victims Posted — Healthcare and Education Targeting With Perimeter-Edge CVE Pressure | Security Arsenal

Analyst confidence: Moderate. Victimology, leak-site timing and CISA KEV linkage are based on ransomware.live and KEV telemetry supplied for this briefing. KRYBIT internals are not publicly well documented; treat actor-tradecraft statements as assessed until victim-level forensics confirm them.

Threat Actor Profile — KRYBIT

Aliases / naming: No widely validated aliases are confirmed in public reporting. Track infrastructure and negotiator handles rather than relying on name-only pivots.
Operating model: Assessed closed or semi-private ransomware operation with possible affiliate recruitment. The victim mix is opportunistic rather than exclusively big-game, but the cross-sector spread is consistent with access-broker-driven targeting.
Ransom economics: Demand size is likely scaled to victim revenue and cyber-insurance posture. Healthcare and education victims often see pressure anchored to patient safety, regulatory exposure and restoration urgency rather than data volume alone.
Likely initial access: Prioritize investigation of perimeter edge devices, remote access tooling and identity attacks: Check Point Security Gateway IKEv1 authentication weakness CVE-2026-50751, ConnectWise ScreenConnect path traversal / RCE CVE-2024-1708, Microsoft Exchange deserialization CVE-2023-21529, malicious or trojanized developer tooling such as Nx Console CVE-2026-48027, and Windows link-following privilege escalation CVE-2025-60710 for post-compromise elevation.
Extortion approach: Assessed double extortion: encrypt production systems, then threaten leak-site publication. The five postings clustered around 2026-09-01 to 2026-09-03 suggest batch disclosure after negotiation windows closed.
Dwell time: Not confirmed. For this victim profile, assume days-to-weeks for SMB education/agri-food and hours-to-days where edge CVE exploitation leads directly to privileged access.

Current Campaign Analysis

Sectors being targeted

The last 100-post window shows only five fresh KRYBIT postings, but the sector mix is operationally meaningful: Healthcare appears twice, while Professional Services, Education, and Agriculture/Food Production each appear once. Healthcare concentration raises risk to patient-care operations, clinical vendors, oncology networks and regional hospitals. Education and agri-food victims indicate KRYBIT is not excluding lower-margin organizations with weaker segmentation and seasonal uptime pressure.

Geographic concentration

Geography is dispersed: GT, IN, CH, MX, CA. There is no single-country cluster. Instead, the pattern points to access opportunity: exposed remote access, managed service tooling, or unpatched edge appliances across regions rather than a language- or region-specific social engineering wave.

Victim profile

ligacancerguate.org — Healthcare, Guatemala: nonprofit / care-delivery adjacent, high sensitivity to patient data and service continuity.
seashellhospital.com — Healthcare, India: mid-market hospital profile; likely mixed IT/OT, third-party biomedical and outsourced administration exposure.
uicc.org — Professional Services / association, Switzerland: high-value contact, member, donor and partner data; reputational leverage is strong.
tum.com.mx — Education, Mexico: student records, research, identity stores and seasonal enrollment pressure.
www.alphaplantes.com — Agriculture/Food Production, Canada: supply-chain, customer, formulation/IP and logistics data; operational disruption can create fast negotiation pressure.

Expected size range is small-to-mid enterprise through regional enterprise. Revenue is not confirmed from leak data; sector-based estimate is likely $5M–$250M USD, with outliers possible for associations and hospital networks.

Posting frequency / escalation pattern

Four of five victims were published on 2026-09-01, followed by one healthcare posting on 2026-09-03. That cadence is consistent with a batch leak cycle after parallel intrusions matured, or a single affiliate clearing a backlog. Escalation indicators to watch: repeat postings in healthcare, countdown timers shortened to under 72 hours, proof packs containing PHI/PII samples, and naming of downstream partners or insurers.

CVE linkage hypothesis

No public evidence yet ties each victim to a specific CVE. However, the KEV set maps cleanly onto likely KRYBIT access paths: Check Point CVE-2026-50751 for edge/VPN entry; ScreenConnect CVE-2024-1708 for MSP/remote-support abuse against professional services and education; Exchange CVE-2023-21529 for authenticated mailbox-to-server execution paths; Nx Console CVE-2026-48027 for developer workstations and build adjacency; Windows CVE-2025-60710 for privilege escalation after initial foothold. Treat these as hunt hypotheses, not confirmed root causes.

Detection Engineering

The following Sigma content focuses on edge exploitation follow-on activity, remote-access tool abuse, pre-encryption staging and destructive preparation. Tune known-admin paths, approved RMM tools and backup service accounts before broad deployment.

YAML

---
title: KRYBIT Hunt - Edge VPN or RMM Follow-On Process Execution
id: 7f4a2c10-9c7e-4d31-a2c1-krybit0001
status: experimental
description: Detects suspicious child processes and discovery commands after likely edge/VPN/RMM compromise patterns associated with KRYBIT access hypotheses.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/09/07
modified: 2026/09/07
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'screenconnect.client.exe'
      - 'screenconnect.service.exe'
      - 'vpnclient.exe'
      - 'cpda.exe'
      - 'fw1.exe'
  selection_rmm_names:
    Image|endswith:
      - 'screenconnect.client.exe'
      - 'screenconnect.windowsclient.exe'
      - 'connectwisecontrol.exe'
  selection_suspicious:
    Image|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'wmic.exe'
      - 'net.exe'
      - 'nltest.exe'
      - 'arp.exe'
      - 'quser.exe'
      - 'whoami.exe'
  condition: (selection_parent and selection_suspicious) or (selection_rmm_names and selection_suspicious)
falsepositives:
  - Legitimate ScreenConnect sessions by internal IT
  - Managed VPN client diagnostics
level: high
fields:
  - Image
  - ParentImage
  - CommandLine
  - ParentCommandLine
  - User
  - Computer
---
title: KRYBIT Hunt - Pre-Ransomware Staging Archive and Exfil Tools
id: 7f4a2c10-9c7e-4d31-a2c1-krybit0002
status: experimental
description: Detects archive creation, cloud exfil tooling and staging behavior commonly observed before ransomware detonation and leak-site publication.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/07
modified: 2026/09/07
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - 'rclone.exe'
      - '7z.exe'
      - '7za.exe'
      - 'winrar.exe'
      - 'tar.exe'
      - 'curl.exe'
      - 'wget.exe'
      - 'azcopy.exe'
  selection_args:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' archive '
      - ' a '
      - ' -r'
      - 'password'
      - 'mega'
      - 'dropbox'
      - 'drive.google'
      - 's3'
      - 'blob'
  filter_admin:
    User|contains:
      - 'backup'
      - 'veeam'
      - 'commvault'
      - 'svc_backup'
  condition: selection_tools and selection_args and not filter_admin
falsepositives:
  - Approved backup jobs
  - Developer packaging and release automation
level: high
fields:
  - Image
  - CommandLine
  - User
  - Computer
  - ParentImage
---
title: KRYBIT Hunt - Shadow Copy Deletion and Backup Inhibition
id: 7f4a2c10-9c7e-4d31-a2c1-krybit0003
status: experimental
description: Detects volume shadow copy deletion, boot configuration tampering and backup catalog interference preceding encryption.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/07
modified: 2026/09/07
logsource:
  category: process_creation
  product: windows
detection:
  selection_images:
    Image|endswith:
      - 'vssadmin.exe'
      - 'wmic.exe'
      - 'bcdedit.exe'
      - 'wbadmin.exe'
      - 'diskshadow.exe'
  selection_args:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
      - 'resize shadowstorage'
      - 'delete systemstatebackup'
  condition: selection_images and selection_args
falsepositives:
  - Storage administrators resizing VSS during maintenance
  - Backup product reconfiguration
level: critical
fields:
  - Image
  - CommandLine
  - User
  - Computer
  - ParentImage

Use this Sentinel hunt to surface lateral movement and staging that often precedes KRYBIT-style encryption: abnormal PsExec/WMI/WinRM fan-out, remote service creation, archive tooling and edge/RMM process ancestry in a single window.

KQL — Microsoft Sentinel / Defender

let lookback = 14d;
let suspectTools = dynamic(['psexec.exe','psexesvc.exe','wmic.exe','winrm.cmd','rclone.exe','7z.exe','7za.exe','tar.exe','screenconnect.client.exe','screenconnect.service.exe']);
let stagingTerms = dynamic(['delete shadows','shadowcopy delete','recoveryenabled no','ignoreallfailures',' delete catalog',' net use ',' admin$',' c$',' copy ',' sync ',' archive ',' -r']);
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FileName in~ (suspectTools) or ProcessCommandLine has_any (stagingTerms) or InitiatingProcessFileName in~ (suspectTools)
| extend IsRemoteExec = ProcessCommandLine has_any (dynamic(['\\','admin$','c$','/node:','-accepteula','-s ','-d '])) or FileName in~ (dynamic(['psexec.exe','psexesvc.exe','wmic.exe']))
| extend IsStaging = FileName in~ (dynamic(['rclone.exe','7z.exe','7za.exe','tar.exe'])) or ProcessCommandLine has_any (dynamic([' copy ',' sync ',' archive ','password','s3','blob','mega','dropbox']))
| extend IsDestructivePrep = ProcessCommandLine has_any (dynamic(['delete shadows','shadowcopy delete','recoveryenabled no','ignoreallfailures','delete catalog']))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 20), Hosts=make_set(DeviceName, 20), Users=make_set(AccountName, 20), RemoteExecHits=countif(IsRemoteExec), StagingHits=countif(IsStaging), DestructiveHits=countif(IsDestructivePrep), Total=count() by bin(TimeGenerated, 1h), DeviceName, InitiatingProcessFileName, FileName
| where RemoteExecHits > 0 and (StagingHits > 0 or DestructiveHits > 0)
| extend Severity = case(DestructiveHits > 0, 'critical', StagingHits > 0 and RemoteExecHits > 2, 'high', 'medium')
| project TimeGenerated, Severity, DeviceName, InitiatingProcessFileName, FileName, RemoteExecHits, StagingHits, DestructiveHits, Users, Commands, FirstSeen, LastSeen
| order by TimeGenerated desc;

Run this rapid Windows triage to identify exposed RDP, recent persistence, shadow-copy tampering and suspicious staging artifacts. Execute from an elevated prompt and export output for the case timeline.

PowerShell

$days = 7
$since = (Get-Date).AddDays(-$days)
$out = Join-Path $env:TEMP ('krybit_rapid_triage_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.txt')
'=== KRYBIT RAPID TRIAGE ===' | Out-File $out

'--- RDP exposure ---' | Out-File $out -Append
Get-ItemProperty 'HKLM:SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue | Format-List | Out-File $out -Append
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object {$_.LocalPort -in 3389,3390,3391} | Select-Object LocalAddress,LocalPort,OwningProcess | Format-Table -AutoSize | Out-File $out -Append

'--- Scheduled tasks created or modified recently ---' | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
  $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
  [PSCustomObject]@{TaskName=$_.TaskName; TaskPath=$_.TaskPath; State=$_.State; LastRunTime=$info.LastRunTime; NextRunTime=$info.NextRunTime}
} | Where-Object {$_.LastRunTime -gt $since -or $_.NextRunTime -gt (Get-Date)} | Sort-Object LastRunTime -Descending | Format-Table -AutoSize | Out-File $out -Append

'--- New local admins and recent logon failures ---' | Out-File $out -Append
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name,ObjectClass,PrincipalSource | Format-Table -AutoSize | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$since} -MaxEvents 200 -ErrorAction SilentlyContinue | Select-Object TimeCreated,Message | Format-List | Out-File $out -Append

'--- VSS and backup state ---' | Out-File $out -Append
vssadmin list shadows 2>&1 | Out-File $out -Append
vssadmin list shadowstorage 2>&1 | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=12290,12291,12294; StartTime=$since} -MaxEvents 100 -ErrorAction SilentlyContinue | Select-Object TimeCreated,Id,Message | Format-List | Out-File $out -Append

'--- Recent suspicious binaries in staging locations ---' | Out-File $out -Append
$paths = @($env:TEMP,$env:ProgramData,$env:PUBLIC,'C:\Users\Public','C:\Perflogs')
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt $since -and $_.Extension -in '.exe','.dll','.ps1','.bat','.7z','.zip','.rar'} | Select-Object FullName,Length,LastWriteTime | Format-Table -AutoSize | Out-File $out -Append
  }
}

'--- New services and run keys ---' | Out-File $out -Append
Get-CimInstance Win32_Service | Where-Object {$_.State -eq 'Running' -and $_.StartName -notin 'LocalSystem','NT AUTHORITY\NetworkService','NT AUTHORITY\LocalService'} | Select-Object Name,DisplayName,PathName,StartName,Started | Format-Table -AutoSize | Out-File $out -Append
Get-ItemProperty 'HKLM:SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue | Format-List | Out-File $out -Append
Write-Host ('Triage written to ' + $out)

Incident Response Priorities

T-minus detection checklist: before encryption fires

Edge/VPN anomalies after Check Point exploitation: new local admin, unexpected IKEv1 negotiation failures, configuration export, or management-plane logins from unusual ASN/geography.
ScreenConnect or other RMM sessions outside approved change windows, especially followed by whoami, net group, nltest, quser and SMB admin-share enumeration.
Rapid creation of archives in ProgramData, Public, TEMP, user profiles or DFS/file-server roots; watch for rclone, 7z, tar, azcopy, curl and cloud storage destinations.
Service creation and remote execution fan-out: PsExec service install, WMI process call create, WinRM enablement, new services with random names, and admin-share writes.
Backup interference: shadow copy deletion, VSS resize, backup catalog deletion, disabled recovery options, NAS snapshot removal and backup-agent service stops.
Identity compression: sudden privileged group additions, impossible travel followed by VPN success, and service accounts interactive-logon outside baseline.

Critical assets this gang historically prioritizes for exfiltration

Based on the observed victim mix, assume priority for: patient and donor records, hospital billing/insurance files, association membership and partner contracts, student records, HR/payroll, legal engagement data, food-production formulations, supplier/customer lists, logistics schedules, credentials stores and backups. For healthcare and education, treat PHI/PII sample theft as likely even before proof packs appear.

Containment actions ordered by urgency

Isolate affected VLANs and block egress to known exfil/cloud endpoints while preserving volatile evidence.
Disable or restrict ScreenConnect and other RMM until agent inventory, session logs and binaries are validated.
Suspect-check perimeter VPN/edge appliances; revoke sessions, rotate admin credentials, collect IKE/management logs and apply vendor mitigations for CVE-2026-50751.
Protect identity: reset privileged credentials, revoke refresh tokens, enforce phishing-resistant MFA, and freeze new admin-group changes.
Safeguard backups: snapshot immutable copies, offline one recovery set, verify restore, and block deletion permissions for backup admins.
Preserve leak-negotiation evidence: do not wipe staging directories; capture process trees, command lines, archive listings and network flows.
Prepare decision track for patient safety, regulatory notification, counsel, insurer and communications before the leak timer expires.

Hardening Recommendations

Immediate — 24 hours

Patch or mitigate CISA KEV items in exposure order: Check Point CVE-2026-50751, ScreenConnect CVE-2024-1708, Exchange CVE-2023-21529, Windows CVE-2025-60710, and remove/validate Nx Console versions affected by CVE-2026-48027.
If patching cannot complete, take the service offline or place it behind an allowlist; do not rely on obscurity for internet-facing VPN, RMM or Exchange hybrid components.
Enforce MFA for VPN, RMM, Exchange admin, backup consoles and cloud storage; block legacy auth and IKEv1 where vendor guidance permits.
Deploy the Sigma/KQL hunts above; alert on vssadmin delete shadows, bcdedit recoveryenabled no, PsExec/WMI fan-out and archive/exfil tool launches by non-backup users.
Audit scheduled tasks, run keys, services and local admins created in the last 7 days; compare against change tickets.
Disable inbound RDP from the internet, require gateway/VPN with device compliance, and alert on any listener on 3389 outside approved subnets.

Short-term — 2 weeks

Segment crown jewels: clinical systems, student information systems, file/backup infrastructure, ERP and production control networks must not share flat routes with user workstations.
Move backups to immutable/offline architecture with separate identity, deletion protection and tested restore runbooks.
Replace broad RMM with brokered, session-recorded, just-in-time admin access; require approval and ticket binding for remote sessions.
Roll out application control for user-writable directories and restrict archive/cloud exfil tools to approved build/backup identities.
Add egress controls for uncommon cloud storage, paste sites, MEGA/Dropbox/S3-style endpoints and unknown ASN destinations from servers.
Create leak-site response playbooks for healthcare/education/regulated data: evidence preservation, regulator thresholds, victim communications and negotiation boundaries.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

KRYBIT Ransomware Gang: 5 New Victims Posted — Healthcare and Education Targeting With Perimeter-Edge CVE Pressure