KRYBIT Ransomware Gang: 5 New Victims Posted in 24 Hours — French SMB Surge, Cross-Continent Reach & Detection Rules

Classification: TLP:CLEAR | Published: 2026-08-08 | Source: Live monitoring of KRYBIT .onion leak site via ransomware.live | Confidence: High (direct leak-site observation)

Executive Summary

Security Arsenal's dark web monitoring infrastructure observed a coordinated burst of five victim postings to the KRYBIT ransomware gang's leak site on 2026-08-07 — a single-day posting cadence that signals either a batch-detonation event or the culmination of a multi-week intrusion wave. Three of the five victims are French organizations, indicating a deliberate geographic focus on French small-to-midsize businesses (SMBs), with opportunistic victims in South Africa and Peru rounding out the batch.

All five postings appeared within the same 24-hour window, which is consistent with KRYBIT's observed behavior of negotiating in parallel and publishing non-payers en masse to maximize psychological pressure. Organizations in the technology, professional services, and industrial/engineering sectors — particularly those with French operations — should treat this as an active campaign indicator and immediately validate perimeter exposure against the CVE set detailed below.

1. Threat Actor Profile — KRYBIT

1.1 Group Overview

1.2 Known / Assessed Initial Access Methods

Based on the victim profile (SMBs with lean security teams, perimeter appliances, and remote access dependencies) and the actively exploited CVE cluster circulating in ransomware ecosystems during this period:

1. Edge/VPN appliance exploitation — The single most probable vector. CVE-2026-50751 (Check Point Security Gateway improper authentication in IKEv1 key exchange) was added to CISA KEV on 2026-06-08, roughly 60 days before this victim batch — a classic lead-time between KEV listing and mass exploitation by ransomware affiliates. SMBs running unpatched Check Point gateways are squarely in the blast radius.
2. Remote monitoring & management (RMM) abuse — CVE-2024-1708 (ConnectWise ScreenConnect path traversal / RCE) remains a ransomware workhorse. ScreenConnect instances are ubiquitous in the exact SMB/managed-service segment KRYBIT is hitting, and compromised RMM gives direct, authenticated-feeling access that bypasses most perimeter detections.
3. Email-borne access — Phishing with malicious attachments/links remains a staple; CVE-2023-21529 (Exchange deserialization) indicates continued targeting of on-prem Exchange for authenticated RCE and mailbox-enabled persistence.
4. Supply chain / developer tooling — CVE-2026-48027 (malicious Nx Console package) and CVE-2026-20131 (Cisco FMC deserialization) reflect the broader 2026 trend of ransomware groups inheriting access from supply-chain compromises and firewall management plane exploitation. The technology-sector victim (actini.com) makes developer-toolchain compromise a plausible vector for at least one intrusion in this batch.

2. Current Campaign Analysis

2.1 Victimology — Posted 2026-08-07

2.2 Sector Targeting

The sector mix — Other (2), Technology (1), Professional Services (1), Not Found (1) — is textbook opportunistic SMB targeting rather than a deliberate vertical campaign. KRYBIT is not hunting a specific industry; it is hunting a specific defensive posture: organizations with internet-facing remote access, limited EDR coverage, no 24/7 SOC, and cyber-insurance policies that make payment rational.

2.3 Geographic Concentration

France dominates at 60% of this batch (3/5), with South Africa and Peru at one victim each. French SMB concentration suggests either:

• A French-speaking affiliate or initial access broker (IAB) supplying access,
• A targeting list built from French-language phishing or French IP-space VPN scanning, or
• Exploitation of a vulnerability disproportionately present in French SMB infrastructure (e.g., regional MSPs running vulnerable ScreenConnect or Check Point instances).

The ZA and PE victims fit the opportunistic tail — organizations in regions with historically lower patching cadence and limited incident response capacity.

2.4 Victim Size / Revenue Profile

All five victims are assessed as SMB to lower-mid-market (roughly €1M–€50M annual revenue). None are enterprise-scale. This is consistent with a crew optimizing for fast, low-friction payouts rather than big-game hunting: shorter negotiations, less law-enforcement attention, higher statistical payment rates.

2.5 Posting Frequency & Escalation Pattern

Five victims in a single day against a backdrop of low total volume is an escalation signal. Interpretations, in descending likelihood:

1. Batch publication of stalled negotiations — multiple intrusions matured simultaneously; non-payers dumped together.
2. Campaign-level detonation — a single access vector (e.g., a vulnerable Check Point or ScreenConnect campaign) yielded several footholds in the same window.
3. Visibility-seeking — a new or rebranded crew establishing leak-site credibility with a volume spike.

All three interpretations predict additional postings within 7–14 days. Defenders should assume the campaign is ongoing.

2.6 CVE Correlation

The timing alignment is notable: CVE-2026-50751 (Check Point) entered KEV on 2026-06-08, exactly two months before this victim batch — consistent with scan-and-exploit-to-ransomware lead times observed across 2024–2026 campaigns. CVE-2024-1708 (ScreenConnect) remains a perennial ransomware access vector despite its age, precisely because the SMB segment KRYBIT targets patches slowly. Treat every CVE in the set below as a plausible initial access candidate for this campaign until forensic evidence says otherwise:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1) — KEV 2026-06-08
• CVE-2026-48027 — Nx Console embedded malicious code (supply chain) — KEV 2026-05-27
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE — KEV 2026-04-28
• CVE-2023-21529 — Microsoft Exchange deserialization (authenticated RCE) — KEV 2026-04-13
• CVE-2026-20131 — Cisco FMC / SCC Firewall deserialization — KEV 2026-03-19

3. Detection Engineering

The following detections target the TTP chain most consistent with this campaign: edge/VPN exploitation → RMM/tool-based lateral movement → staging and exfiltration → encryption. Deploy the Sigma rules via your pipeline of choice (sigmac/pySigma → Sentinel, Splunk, Elastic), the KQL query in Microsoft Sentinel, and the PowerShell script as a rapid triage sweep on suspect hosts.

---
title: Suspicious Authentication Anomalies Following VPN/Edge Appliance Exploitation
id: 7f3a1c2e-9b4d-4e6a-a1c5-krybit000001
status: experimental
description: Detects successful logon from unusual source IPs shortly after VPN gateway authentication events, consistent with post-exploitation access via compromised Check Point / edge VPN appliances (CVE-2026-50751 pattern). Tune Known_VPN_Gateway IPs to your environment.
author: Security Arsenal Threat Intelligence
date: 2026/08/08
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: authentication
  product: windows
detection:
  selection_logon:
    EventID: 4624
    LogonType:
      - 3
      - 10
  filter_local:
    IpAddress|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '127.'
  condition: selection_logon and not filter_local
timeframe: 15m
falsepositives:
  - Legitimate remote access via VPN concentrators (whitelist concentrator source IPs)
  - Cloud service integrations
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
  - krybit
---
title: RMM Tool Execution and Remote Service Creation (ScreenConnect / PsExec Pattern)
id: 7f3a1c2e-9b4d-4e6a-a1c5-krybit000002
status: experimental
description: Detects execution of common RMM tooling and remote service creation used by ransomware operators for lateral movement after ScreenConnect-style compromise (CVE-2024-1708) or PsExec-based spread. Flags unsigned or non-standard-path RMM binaries and services created remotely.
author: Security Arsenal Threat Intelligence
date: 2026/08/08
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\remcom.exe'
      - '\AnyDesk.exe'
      - '\AteraAgent.exe'
      - '\SplashtopSOS.exe'
  selection_suspicious_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  selection_service:
    CommandLine|contains:
      - ' \\'
      - 'ADMIN$'
      - 'IPC$'
  condition: (selection_rmm and selection_suspicious_path) or (selection_rmm and selection_service)
falsepositives:
  - Legitimate MSP tooling deployed from standard install paths (whitelist known agent hashes/paths)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1219
  - krybit
---
title: Pre-Ransomware Data Staging and Exfiltration Indicators
id: 7f3a1c2e-9b4d-4e6a-a1c5-krybit000003
status: experimental
description: Detects archive creation in staging directories, shadow copy deletion, and cloud exfiltration tooling consistent with double-extortion ransomware preparation observed across SMB-targeting crews including KRYBIT's profile.
author: Security Arsenal Threat Intelligence
date: 2026/08/08
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' a -v'
  selection_staging_dir:
    CommandLine|contains:
      - '\ProgramData\'
      - '\Users\Public\'
      - 'C:\Temp\'
      - 'C:\staging'
  selection_exfil_tool:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\FileZilla.exe'
      - '\winscp.com'
      - '\curl.exe'
  selection_exfil_args:
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - 'mega.nz'
      - 'anonfiles'
      - 'transfer.sh'
      - '--transfers'
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'resize shadowstorage'
  condition: (selection_archive and selection_staging_dir) or (selection_exfil_tool and selection_exfil_args) or selection_vss
falsepositives:
  - Backup administrators running legitimate archiving to ProgramData (scope by user/host baseline)
  - Legitimate rclone backup jobs (whitelist scheduled task names/accounts)
level: critical
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002
  - attack.impact
  - attack.t1490
  - krybit

Microsoft Sentinel — Pre-Ransomware Staging & Lateral Movement Hunt

This KQL query hunts the 48-hour pre-detonation window: remote service creation, RMM execution from non-standard paths, mass archive creation, and shadow copy tampering — the exact chain expected from a KRYBIT-style intrusion before encryption fires.

// Security Arsenal — KRYBIT pre-ransomware staging hunt (48h window)
// Hunt: lateral movement tooling + data staging + defense impairment
let lookback = 48h;
let SuspiciousRMM = dynamic(["psexec","psexesvc","paexec","remcom","screenconnect","anydesk","atera","splashtop"]);
let StagingPaths = dynamic(["\\ProgramData\\","\\Users\\Public\\","C:\\Temp\\","C:\\staging"]);
let Lateral =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName has_any (SuspiciousRMM)
       or (ProcessCommandLine has_any ("ADMIN$","IPC$") and ProcessCommandLine has "\\\\")
    | project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
    | extend Signal = "RMM/Lateral Tool";
let Staging =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("7z.exe","7za.exe","rar.exe","winrar.exe")
    | where ProcessCommandLine has_any (StagingPaths) or ProcessCommandLine has " -p"
    | project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
    | extend Signal = "Archive Staging";
let Exfil =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("rclone.exe","megacmd.exe","winscp.com","filezilla.exe")
       or (FileName =~ "curl.exe" and ProcessCommandLine has_any ("-T","--upload-file","mega.nz","transfer.sh"))
    | project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
    | extend Signal = "Exfil Tooling";
let DefenseImpair =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","resize shadowstorage")
       or (FileName =~ "net.exe" and ProcessCommandLine has_any ("stop","disable") and ProcessCommandLine has_any ("backup","vss","sophos","defender","sentinel","crowdstrike"))
    | project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
    | extend Signal = "Defense Impairment";
union Lateral, Staging, Exfil, DefenseImpair
| summarize Signals = make_set(Signal), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Commands = make_set(ProcessCommandLine, 10) by DeviceName, AccountName
| extend SignalCount = array_length(Signals)
| where SignalCount >= 2  // host showing 2+ stages of the kill chain = prioritize
| sort by SignalCount desc, LastSeen desc

Rapid Triage PowerShell — Suspect Host Sweep

Run on any host suspected of involvement (via elevated remote session or EDR live response). It checks the highest-signal pre-encryption artifacts: new scheduled tasks, shadow copy state, suspicious RMM services, recent large archives, and unexpected RDP exposure.

# Security Arsenal - KRYBIT Rapid Triage Sweep (run elevated)
# Checks: RDP exposure, new scheduled tasks (7d), shadow copies, RMM services, staged archives
$Report = @();
$cutoff = (Get-Date).AddDays(-7)

Write-Host "[*] === KRYBIT Rapid Triage - $env:COMPUTERNAME - $(Get-Date -Format 'u') ===" -ForegroundColor Cyan

# 1. RDP exposure check
Write-Host "`n[1] RDP Configuration" -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
Write-Host ("    RDP Enabled: {0} | NLA: {1}" -f $rdpEnabled, $nla)
if ($rdpEnabled -and $nla -ne 1) { Write-Host "    [!] RDP enabled WITHOUT NLA - brute-force exposure" -ForegroundColor Red }

# 2. Scheduled tasks created/modified in last 7 days (persistence + ransomware staging)
Write-Host "`n[2] Scheduled Tasks Modified Since $cutoff" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff } | ForEach-Object {
    $action = ($_.Actions | Select-Object -First 1).Execute
    Write-Host ("    [!] {0} | {1} | {2}" -f $_.TaskName, $_.Date, $action) -ForegroundColor Red
}

# 3. Volume Shadow Copy status (ransomware deletes these pre-detonation)
Write-Host "`n[3] Volume Shadow Copies" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "    [!] NO shadow copies present - possible vssadmin deletion" -ForegroundColor Red }
else { $shadows | ForEach-Object { Write-Host ("    [+] {0} | {1}" -f $_.ID, $_.InstallDate) } }

# 4. Suspicious RMM / lateral movement services
Write-Host "`n[4] RMM & Remote Exec Services" -ForegroundColor Yellow
$susSvc = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'psexec|psexesvc|screenconnect|anydesk|atera|splashtop|remcom' -or
    ($_.PathName -match '\\Temp\\|\\ProgramData\\|\\Public\\' -and $_.StartName -match 'SYSTEM')
}
if ($susSvc) { $susSvc | ForEach-Object { Write-Host ("    [!] {0} | {1}" -f $_.Name, $_.PathName) -ForegroundColor Red } }
else { Write-Host "    [-] None found" }

# 5. Large archives staged in the last 7 days (exfil prep)
Write-Host "`n[5] Recent Large Archives (>100MB, last 7d) in Staging Dirs" -ForegroundColor Yellow
$stageDirs = @("C:\ProgramData","C:\Users\Public","C:\Temp")
foreach ($dir in $stageDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 100MB } |
            ForEach-Object { Write-Host ("    [!] {0} | {1:N0} MB | {2}" -f $_.FullName, ($_.Length/1MB), $_.LastWriteTime) -ForegroundColor Red }
    }
}

# 6. Recent failed logons (RDP/VPN brute-force signature)
Write-Host "`n[6] Failed Logons (Event 4625, last 24h) by Source" -ForegroundColor Yellow
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    ForEach-Object { [xml]$x = $_.ToXml(); ($x.Event.EventData.Data | Where-Object Name -eq 'IpAddress').'#text' } |
    Group-Object | Sort-Object Count -Descending | Select-Object -First 10 |
    ForEach-Object { Write-Host ("    {0} : {1} failures" -f $_.Name, $_.Count) }

Write-Host "`n[*] Triage complete. Escalate any [!] findings to IR immediately." -ForegroundColor Cyan

4. Incident Response Priorities

4.1 T-Minus Detection Checklist (Pre-Encryption Window)

If you match KRYBIT's victim profile (SMB, French operations, Check Point/ScreenConnect/on-prem Exchange in the stack), sweep for these before detonation:

• Unpatched perimeter: Check Point gateways running IKEv1 unpatched against CVE-2026-50751; ScreenConnect instances below the CVE-2024-1708 fixed build; Exchange without the CVE-2023-21529 update.
• Unexpected external-to-internal logons (Event 4624, LogonType 3/10) from non-VPN-concentrator IPs.
• RMM binaries executing from %TEMP%, %ProgramData%, or %Public% — especially ScreenConnect, AnyDesk, PsExec derivatives not deployed by your MSP.
• New services referencing ADMIN$/IPC$ paths or named to blend in (e.g., "WindowsUpdateSvc").
• Mass archive creation (7z/RAR with password flags -p) in staging directories.
• rclone/MEGA/FileZilla presence or outbound transfers to consumer file-sharing infrastructure.
• Shadow copy deletion commands (vssadmin delete shadows, bcdedit recoveryenabled no) — typically the final act before encryption.
• Security tool tampering: service stop/disable attempts against EDR/backup agents.

4.2 Assets This Profile of Actor Prioritizes for Exfiltration

Based on the SMB victim profile and double-extortion economics, expect targeting of:

1. Finance & accounting data — invoices, banking details, payroll (highest blackmail leverage against SMBs).
2. Client/project files — for professional services and engineering victims (like ernat-bureau-etudes.fr), CAD files, project deliverables, and client contracts carry downstream liability pressure.
3. HR records & identity documents — PII for regulatory (GDPR) pressure, especially potent against EU victims.
4. Email archives — on-prem Exchange data (relevant given CVE-2023-21529 in the KEV cluster) for negotiation intelligence and sensitive correspondence.
5. Backup repositories — to destroy recovery options before detonation.

4.3 Containment Actions — Ordered by Urgency

1. Isolate at the network layer, not the host layer. Disable switch ports / VLAN-quarantine affected segments. Do NOT power off hosts (preserves volatile evidence, avoids triggering dead-man encryption).
2. Disable compromised identity material. Force-reset all accounts showing anomalous logons; revoke VPN sessions and certificates; invalidate ScreenConnect/RMM sessions globally.
3. Block exfil egress. Emergency firewall rules denying outbound to consumer file-sharing/anon-upload domains and known exfil cloud endpoints; inspect for in-flight transfers before cutting.
4. Protect backups. Take backup infrastructure offline from the production network immediately; verify at least one immutable/offline copy exists and is intact.
5. Kill the access vector. Patch or isolate the perimeter appliance (Check Point / ScreenConnect / Exchange) even mid-incident — a live vector means re-entry during recovery.
6. Preserve evidence. Capture memory and triage images from patient zero and any host running the triage script's [!] findings before remediation.
7. Engage IR and counsel. French victims: ANSSI notification considerations and GDPR 72-hour clock apply if personal data was accessed. Do not negotiate or pay without professional guidance.

5. Hardening Recommendations

5.1 Immediate (24 Hours)

• Patch or mitigate the KEV perimeter set: CVE-2026-50751 (Check Point — disable IKEv1 if patching is not immediately possible), CVE-2024-1708 (ScreenConnect — if self-hosted and unpatched, take it offline), CVE-2023-21529 (Exchange), CVE-2026-20131 (Cisco FMC — restrict management plane access).
• Audit all RMM tooling. Enumerate every remote access agent in the environment. Anything not explicitly deployed and managed by IT/MSP should be treated as hostile. KRYBIT-profile crews lean heavily on legitimate RMM for access and movement.
• Enforce MFA on all remote access (VPN, RDP gateways, RMM consoles) — no exceptions for service accounts without compensating controls.
• Block or alert on staging tooling: application-control rules or detections for 7z/RAR with password flags, rclone, MEGAcmd, and curl uploads from servers.
• Protect shadow copies: deploy detection on vssadmin delete shadows / bcdedit tampering; consider restricting vssadmin via AppLocker for non-admin contexts.
• Deploy the Sigma rules and KQL query above and run the triage script against any host with perimeter-adjacent exposure in the last 60 days.

5.2 Short-Term (Two Weeks)

• Segment the network so SMB flat-topology lateral movement (PsExec/WMI over SMB/RPC) fails by design. Workstation-to-workstation SMB should be denied except from management subnets.
• Implement egress filtering with category-based blocking for file-sharing/anon-upload services, plus TLS inspection where legally permissible — exfil is the leverage; make it hard.
• Deploy EDR with tamper protection everywhere, including servers; SMB-targeting crews specifically look for endpoints without agents.
• Move backups to an immutable, logically air-gapped architecture (object-lock or offline copies) with restore testing scheduled — payment pressure collapses when recovery is credible.
• Attack surface management: continuous external scanning for exposed RDP, forgotten ScreenConnect/Check Point instances, and on-prem Exchange — the exact footprint this campaign appears to harvest.
• Supply-chain hygiene for dev environments: given CVE-2026-48027 (malicious Nx Console), pin and verify development tool dependencies, and segregate developer workstations from production credentials.
• Tabletop the double-extortion scenario with leadership and counsel: decision framework for GDPR notification, negotiation posture, and communication before the clock is running.

Analyst's Bottom Line

KRYBIT's August 7 batch is not a sophisticated big-game operation — it is a disciplined SMB-harvesting crew exploiting the gap between KEV publication and SMB patch reality. The French concentration, the 60-day Check Point CVE lead time, and the single-day batch publication all point to a repeatable playbook that will produce more victims in the coming days. If you operate Check Point gateways, ScreenConnect, or on-prem Exchange — especially in France — assume you are in the target set and validate your posture this week, not this quarter.

Security Arsenal continues to monitor the KRYBIT leak site and will update this bulletin as new victims are posted.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub