KRYBIT Ransomware Gang: 5 New Victims Posted — Multi-Region Targeting Analysis & Detection Rules

---
title: KRYBIT Initial Access - Check Point IKEv1 Exploitation
id: 8f3e2a1d-7c4b-4d9f-8a5e-3b7d6c4f2a1e
status: experimental
description: Detects exploitation attempts of CVE-2026-50751 in Check Point Security Gateway IKEv1 key exchange
author: Security Arsenal Research
date: 2026/08/02
references:
  - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: firewall
definition: 'Requirements: Check Point Security Gateway logs forwarded to SIEM'
detection:
  selection:
    product|contains: 'Check Point'
    service: 'IKE'
    version|contains: 'v1'
    action|re: 'authentication_fail|key_exchange_fail|auth_failure'
  filter:
    src_ip_network:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
fields:
  - src_ip
  - dst_ip
  - user
  - protocol
falsepositives:
  - Legitimate VPN configuration issues
  - Misconfigured VPN clients
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.50751
  - krybit
---
title: KRYBIT Lateral Movement - PsExec with Suspicious Parameters
id: 2d4f5g6h-7i8j-9k0l-1m2n-3o4p5q6r7s8t
status: experimental
description: Detects PsExec execution patterns associated with KRYBIT lateral movement, including administrative share mounting and service creation
author: Security Arsenal Research
date: 2026/08/02
references:
  - Internal Threat Intelligence - KRYBIT TTPs
logsource:
  category: process_creation
  product: windows
definition: 'Requirements: Sysmon or advanced Windows logging enabled'
detection:
  selection:
    Image|endswith:
      - '\\PsExec.exe'
      - '\\psexec64.exe'
    CommandLine|contains:
      - '\\'
      - '-accepteula'
      - '-s'
      - '-d'
  context_filter:
    ParentImage|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
    CommandLine|contains:
      - 'sc start'
      - 'net start'
  condition: selection and context_filter
timeout: 30m
fields:
  - User
  - CommandLine
  - ParentCommandLine
  - Image
falsepositives:
  - Legitimate system administration
  - IT support activities
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - krybit
---
title: KRYBIT Pre-Encryption - Volume Shadow Copy Manipulation
id: 9a8b7c6d-5e4f-3g2h-1i0j-k9l8m7n6o5p4
status: experimental
description: Detects VSS shadow copy deletion and manipulation consistent with KRYBIT pre-encryption activity
author: Security Arsenal Research
date: 2026/08/02
references:
  - Internal Threat Intelligence - KRYBIT TTPs
logsource:
  category: process_creation
  product: windows
definition: 'Requirements: Sysmon Event ID 1 enabled'
detection:
  selection_vss:
    Image|endswith:
      - '\\vssadmin.exe'
      - '\\wbadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'delete shadowstorage'
      - 'resize shadowstorage'
  selection_powershell:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_ShadowCopy'
      - 'Remove-WmiObject'
      - '-Class Win32_ShadowCopy'
  timeframe: 5m
  condition: 1 of selection_*
fields:
  - User
  - CommandLine
  - ParentImage
  - Image
falsepositives:
  - Legitimate backup management
  - System maintenance activities
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1083
  - krybit

// KRYBIT Lateral Movement Hunt - Suspicious Service Creation
// Hunts for service creation patterns consistent with KRYBIT TTPs
let timeframe = 7d;
SecurityEvent
| where TimeGenerated > ago(timeframe)
| where EventID in (4624, 4688, 5140, 5145)
| extend ProcessName = tostring(split(Process, '\\')[-1]),
         CommandLine = iff(ProcessName has 'cmd.exe', CommandLine, 
                           iff(ProcessName has 'powershell.exe', CommandLine, ""))
| where ProcessName in ('cmd.exe', 'powershell.exe', 'psexec.exe', 'psexec64.exe', 
                        'wmic.exe', 'sc.exe')
| where CommandLine matches regex @"(sc\s+create|net\s+start|New-Service|psexec.*\\.*\\.*-accepteula)"
| extend Account = strcat(AccountDomain, '\\', AccountName),
         Hostname = Computer
| project TimeGenerated, Hostname, Account, ProcessName, CommandLine, 
          EventID, IpAddress, SubjectUserName
| where Account !in ('NT AUTHORITY\SYSTEM', 'SYSTEM')
| order by TimeGenerated desc
| summarize count() by Hostname, Account, ProcessName, bin(TimeGenerated, 1h)
| where count_ > 3
| project-away count_

# KRYBIT Rapid Response - Pre-Encryption Indicator Check
# Version: 1.0
# Purpose: Rapidly scan for indicators of KRYBIT pre-encryption activity

# Requires Administrator privileges
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "[ERROR] This script must be run as Administrator" -ForegroundColor Red
    exit 1
}

$Results = @()
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

# Check 1: Recent VSS Shadow Copy Activity
Write-Host "[INFO] Checking for recent VSS shadow copy manipulation..." -ForegroundColor Cyan
try {
    $VSSLog = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
    if ($VSSLog) {
        $VSSDestructive = $VSSLog | Where-Object { $_.Message -match 'delete|remove|resize' -and $_.Message -match 'shadow' }
        if ($VSSDestructive) {
            $Results += [PSCustomObject]@{
                Check = "VSS Shadow Copy Manipulation"
                Status = "WARNING"
                Details = "$($VSSDestructive.Count) destructive VSS events in last 24 hours"
                Timestamp = $Timestamp
            }
        }
    }
} catch { $null }

# Check 2: Scheduled Tasks Created in Last 7 Days
Write-Host "[INFO] Checking for recently created scheduled tasks..." -ForegroundColor Cyan
try {
    $Tasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
    if ($Tasks) {
        $SuspiciousTasks = $Tasks | Where-Object { $_.Author -eq '' -or $_.Author -match '^[A-Fa-f0-9]{32}$' -or $_.TaskName -match 'update|maint|service' }
        if ($SuspiciousTasks) {
            $Results += [PSCustomObject]@{
                Check = "Suspicious Scheduled Tasks"
                Status = "WARNING"
                Details = "$($SuspiciousTasks.Count) suspicious tasks created in last 7 days"
                Timestamp = $Timestamp
                Tasks = ($SuspiciousTasks | Select-Object TaskName, Author | ConvertTo-Json)
            }
        }
    }
} catch { $null }

# Check 3: Network Connections to Known Malicious IPs (Recent IOC Set)
Write-Host "[INFO] Checking for suspicious network connections..." -ForegroundColor Cyan
$RecentIOCs = @("45.142.212.0/24", "103.245.236.0/24", "185.220.101.0/24") # Replace with current IOCs
try {
    $Netstat = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
    foreach ($connection in $Netstat) {
        foreach ($IOC in $RecentIOCs) {
            $IP, $Prefix = $IOC -split '/'
            if ($connection.RemoteAddress -like "$IP*") {
                $Process = Get-Process -Id $connection.OwningProcess -ErrorAction SilentlyContinue
                $Results += [PSCustomObject]@{
                    Check = "Suspicious Network Connection"
                    Status = "CRITICAL"
                    Details = "Connection to IOC network $IOC detected"
                    Timestamp = $Timestamp
                    RemoteAddress = $connection.RemoteAddress
                    RemotePort = $connection.RemotePort
                    ProcessName = $Process.ProcessName
                    ProcessId = $connection.OwningProcess
                }
            }
        }
    }
} catch { $null }

# Check 4: RDP Sessions from Non-Admin Accounts
Write-Host "[INFO] Checking for unusual RDP sessions..." -ForegroundColor Cyan
try {
    $RDPEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddHours(-4)} -ErrorAction SilentlyContinue |
                Where-Object { $_.Message -match 'Logon Type:\s*10' -and $_.Message -match 'Source Network Address:' }
    foreach ($Event in $RDPEvents) {
        if ($Event.Message -match 'Account Name:\s*([^
]+)') {
            $Account = $matches[1]
            if ($Account -notin ('Administrator', 'Admin', 'SYSTEM')) {
                if ($Event.Message -match 'Source Network Address:\s*([^
]+)') {
                    $SourceIP = $matches[1]
                    $Results += [PSCustomObject]@{
                        Check = "Unusual RDP Session"
                        Status = "INFO"
                        Details = "RDP session from non-admin account: $Account"
                        Timestamp = $Timestamp
                        SourceIP = $SourceIP
                        Account = $Account
                    }
                }
            }
        }
    }
} catch { $null }

# Output Results
Write-Host ""
Write-Host "==================== KRYBIT RESPONSE SCAN RESULTS ====================" -ForegroundColor Yellow
if ($Results.Count -eq 0) {
    Write-Host "[INFO] No immediate indicators of KRYBIT pre-encryption activity detected." -ForegroundColor Green
} else {
    Write-Host "[ALERT] Indicators detected requiring immediate investigation:" -ForegroundColor Red
    $Results | Format-Table -AutoSize
    
    # Export to file for incident response
    $Results | Export-Csv -Path "C:\Temp\KRYBIT_Response_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[INFO] Results exported to C:\Temp\" -ForegroundColor Gray
}
Write-Host "======================================================================" -ForegroundColor Yellow


---