0APT and KryBit ransomware turf war forces rebuild and rebrand pressure
Threat Actor Meta
Summary
Hide ▲
Show ▼
0APT and KryBit escalated a ransomware turf war in April 2026 by leaking each other's operational data, defacing leak sites, and exposing infrastructure details that undermine their credibility. The clash revealed KryBit's operators, affiliates, negotiation data, and the fact that 0APT's claimed victim list was fabricated. The damage is likely to force both groups to rebuild, rebrand, and deploy new infrastructure to stay active.
Related Happenings
ShinyHunters school-by-school extortion campaign targeting Canvas institutions
Campaign
First: 11.05.2026 13:05
Last: 11.05.2026 13:05
Sources 1
About this happening:
ShinyHunters intensified a **school-by-school extortion campaign** against **Canvas-related institutions**, increasing pressure on schools and universities as the group threatened...
ShinyHunters school-by-school extortion campaign targeting Canvas institutions
CampaignAbout this happening: ShinyHunters intensified a **school-by-school extortion campaign** against **Canvas-related institutions**, increasing pressure on schools and universities as the group threatened...
Instructure hit by cyberattack
Incident
First: 04.05.2026 01:16
Last: 04.05.2026 01:16
Sources 1
About this happening:
**Instructure** disclosed a **cybersecurity incident** that exposed user information and prompted an investigation with outside experts and law enforcement. The event matters beca...
Instructure hit by cyberattack
IncidentAbout this happening: **Instructure** disclosed a **cybersecurity incident** that exposed user information and prompted an investigation with outside experts and law enforcement. The event matters beca...
Latest development: 14.05.2026 23:19
The House Committee on Homeland Security and the US Senate Committee on Health, Education, Labor, and Pensions sought briefings from Instructure over the Canvas compromise, pressing the edtech vendor on whether it paid a ransom, what data was affected, how it handled the recent attacks, and whether the incident was linked to a prior Salesforce compromise.
0APT and KryBit mutual operational data leak
Data Leak
First: 28.04.2026 16:00
Last: 28.04.2026 16:00
Sources 1
How related:
Two ransomware groups are licking their wounds and rebuilding their infrastructure after leaking each other’s operational data online, according to Halcyon.
About this happening:
The **0APT** and **KryBit** ransomware groups are in a live **data leak** fight that exposed internal operator records, victim negotiation data, and core infrastructure files. One...
0APT and KryBit mutual operational data leak
Data LeakHow related: Two ransomware groups are licking their wounds and rebuilding their infrastructure after leaking each other’s operational data online, according to Halcyon.
About this happening: The **0APT** and **KryBit** ransomware groups are in a live **data leak** fight that exposed internal operator records, victim negotiation data, and core infrastructure files. One...
Gentlemen ransomware affiliate campaign expanding toolkit and infrastructure
Campaign
First: 20.04.2026 23:02
Last: 20.04.2026 23:02
Sources 1
About this happening:
The **Gentlemen ransomware** campaign has now been tied to a **ransomware attack on Oltenia Energy Complex** on the **second day of Christmas**, disrupting **ERP systems**, **docu...
Gentlemen ransomware affiliate campaign expanding toolkit and infrastructure
CampaignAbout this happening: The **Gentlemen ransomware** campaign has now been tied to a **ransomware attack on Oltenia Energy Complex** on the **second day of Christmas**, disrupting **ERP systems**, **docu...
2025 Automotive carmakers ransomware surge
Target Trend
First: 16.04.2026 11:35
Last: 16.04.2026 11:35
Sources 1
About this happening:
In **2025**, ransomware became the **fastest-growing** and most disruptive threat to **automotive carmakers**, accounting for **44% of attacks** and **more than doubling** over th...
2025 Automotive carmakers ransomware surge
Target TrendAbout this happening: In **2025**, ransomware became the **fastest-growing** and most disruptive threat to **automotive carmakers**, accounting for **44% of attacks** and **more than doubling** over th...
Timeline
-
28.04.2026 16:00 2 articles · 29d ago
Halcyon discloses 0APT and KryBit mutual leak retaliation
Initial DisclosureHalcyon says 0APT and KryBit escalated a ransomware turf war by leaking each other’s operational data, with KryBit exposing 0APT access logs, PHP source code, and system files after 0APT claimed KryBit, RansomHouse, and Everest Group on its leak site. The exposure showed 0APT’s claimed 190+ January 2026 victims were fabricated, while KryBit’s leaked administrator panel exposed two administrators, five affiliates, 20 potential victims, victim negotiation data, exfiltration volumes of 10-250GB per victim, and ransom demands of $40,000-$100,000; KryBit also maintained defacement of the 0APT leak site, and both groups now appear likely to rebuild, rebrand, and spin up new infrastructure.
Show sources
- Ransomware Turf War as 0APT and KryBit Groups Trade Blows — www.infosecurity-magazine.com — 28.04.2026 16:00
- Ransomware Turf War as 0APT and KryBit Groups Trade Blows — www.infosecurity-magazine.com — 28.04.2026 16:00