INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Ransomware Groups Leak Each Other's Data in Feud

| 2026-04-28 20:13 CRITICAL LOW RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
On April 28, 2026, a feud between two ransomware-as-a-service (RaaS) actors, 0APT and KryBit, led to the exposure of both groups' data. The Halcyon Ransomware Research Center reported that 0APT emerged in late January with nearly 200 victims listed on its blog, although this list was later deemed fabricated due to a lack of evidence pointing towards victim compromises. In response, 0APT reemerged and claimed ransomware attacks against KryBit, Everest, and RansomHouse. Meanwhile, KryBit had both its infrastructure and personnel exposed after breaching and exfiltrating 0APT's data set, listing the latter as a victim, and leaving a message on 0APT's leak site. This incident affected approximately five affiliates of KryBit and potentially up to 20 victims. The attack works by exposing rival groups' admin panels, affiliate data, and victim negotiations in an attempt to gain credibility without actual ransom payments or compromised victims. As of the reported date, both 0APT and KryBit appear to be inactive following their respective breaches.
Technical Mitigations AI-generated
• Data Backup (ATT&CK mitigation for Defacement): Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups a • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Tropic TrooperTropic Trooper WiperWiper
Target & Sectors
DPRK DPRK
Incident Timeline
‎January 2026
Threat actors from feuding ransomware groups, including Tropic Trooper and KryBit, leaked each other's data.
threat_actor Tropic Trooper
Related: Tropic Trooper APT Takes Aim at Home Routers, Japanese Targets Totaro says gang feuds are a net positive for defenders.
‎2026/04/28
0APT reemerged in mid-April, deleting its previous list of fake victims and claiming ransomware attacks against KryBit, Everest, and RansomHouse.
infrastructure Macos
Related: North Korea's Lazarus Targets macOS Users via ClickFix That is not the case with KryBit, which had both its infrastructure and personnel exposed.
infrastructure Windows
Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error KryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi , and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps…
financial 2.0 Ransomware Acts
Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error KryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi , and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps…
victims 200 victims
0APT emerged in late January with a list of nearly 200 victims posted to its data leak blog over the course of a week.
infrastructure Linux
…ct 2.0 Ransomware Acts as Wiper, Thanks to Design Error KryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi , and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps 80…
victims 190 victims
The access logs revealed that the 190+ victims initially posted by 0APT in January 2026 were entirely fabricated and no data was ever exfiltrated from any of the listed victims," the researchers said.
victims 10 legitimate victims
The group published 10 legitimate victims in its first two weeks.
victims 20 potential victims
This revealed that KryBit had two administrators, five affiliates, 20 potential victims, and ransom demands between $40,000 and $100,000.
Tactical Metrics
Metrics
infrastructure
‎Macos
Affected Product
Related: North Korea's Lazarus Targets macOS Users via ClickFix That is not the case with KryBit, which had both its infrastructure and personnel exposed.
Metrics
victims
200
Victims
0APT emerged in late January with a list of nearly 200 victims posted to its data leak blog over the course of a week.
Metrics
infrastructure
‎Windows
Affected Product
Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error KryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi , and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps…
Metrics
infrastructure
‎Linux
Affected Product
…ct 2.0 Ransomware Acts as Wiper, Thanks to Design Error KryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi , and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps 80…
Metrics
financial
2
Ransomware Acts
Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error KryBit emerged in late March, offering RaaS kits targeting Windows, Linux, ESXi , and network-attached storage (NAS) devices, using an 80/20 affiliate model (where the RaaS affiliate keeps…
Metrics
victims
190
Victims
The access logs revealed that the 190+ victims initially posted by 0APT in January 2026 were entirely fabricated and no data was ever exfiltrated from any of the listed victims," the researchers said.
Metrics
victims
10
Legitimate Victims
The group published 10 legitimate victims in its first two weeks.
Metrics
victims
20
Potential Victims
This revealed that KryBit had two administrators, five affiliates, 20 potential victims, and ransom demands between $40,000 and $100,000.
Intelligence Sources
Dark Reading 2026-04-28