kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

Krybit

also tracked as deadlock 1, prinz eugen 1

3 stories · 3 in the wild · June 17, 2026 – June 21, 2026

evidence: 3 observed

malware and tools

  • krybit 3 · Jun 21
  • babuk 2 · Jun 21
  • prinz eugen 1 · Jun 21

techniques

  • exfiltration 1 · Jun 21

attack phases seen

  • Impact 3 · Jun 21
  • Exfiltration 1 · Jun 21

what we reported, newest first, grouped by story

Jun 17 – June 21, 2026 · 3 reports

  • DeadLock is expanding its abuse of Polygon blockchain smart contracts — moving beyond chat-proxy rotation to host its data-leak site entirely on-chain (75 victims since February), with HTML ransom notes fetching victim data live from the contract (ESET). Nextron flagged KRYBIT, a new double-extortion strain whose YARA profile overlaps heavily with the leaked Babuk codebase (Nextron), and Prinz Eugen emerged prioritizing recently-modified files for faster encryption while leaving no ransom note (BleepingComputer). · Jun 21 · observed · as deadlock, prinz eugen · Ransomware & EDR Evasion
  • KRYBIT, a new double-extortion strain built on the leaked Babuk codebase, went from zero to 49 victims across 20+ countries since early April (Nextron, DarkFeed). · Jun 19 · observed · Ransomware
  • KRYBIT emerged as a fast-moving ransomware operation — 49 victims across 20+ countries and all sectors since early April. Ido Cohen. · Jun 17 · observed · Data Breaches & Extortion