Krybit Ransomware: A New Threat Targeting Vietnamese Food Supply Chain
Campaign Summary
The Krybit Ransomware-as-a-Service (RaaS) model has officially increased its activities targeting manufacturing businesses in Southeast Asia. In early July 2026, Krybit posted information about a double extortion attack targeting Enterprise A - a large unit in the agricultural/food processing and export industry in Vietnam - on the data leak site (leak site) on the TOR network.
This attack campaign does not stop at encrypting storage and operating servers, but the threat group also threatens to release from 10 GB to 250 GB of business data, commercial contracts and internal operating records if the victim does not participate in ransom negotiations. The real risk for businesses in the food processing industry is the risk of supply chain disruption, packaging/export chain stoppages and damage to brand reputation in the international market.
Urgent actions for organizations now: Check and cancel all remote login sessions (VPN/RDP) that have not enabled MFA, isolate backup storage partitions from the Active Directory network, and perform a Compromise Assessment based on the IOC index set in this analysis.
Attack Group Profile
Krybit is a new RaaS operating group that has appeared since the end of March 2026 but shows a very active level of activity.
Notably, during the period May - June 2026, Krybit had a fierce infrastructure conflict with a rival RaaS group, 0APT. This dispute led to both sides publicly leaking the Affiliate Panel, the list of victims, and the contents of the negotiation log. However, the internal leak did not shut down Krybit; On the contrary, this group quickly consolidated C2 infrastructure and stepped up attack campaigns targeting businesses in the manufacturing, construction and professional services industries in many countries such as Germany, Spain, India and Vietnam.
TimeLine Events
| Timeline | Recorded Event & Activity | Notes & Assessment |
|---|---|---|
| May – June 2026 | Attackers collected Company A’s login credentials through Infostealer data marketplaces (RedLine, Vidar). | Initial preparation (Reconnaissance) – beginning of the dwell time. |
| Late June 2026 | Conducted remote access through RDP/VPN with insufficient MFA, escalated administrative privileges, deleted Volume Shadow Copies, and exfiltrated internal data. | Deep intrusion and preparation for encryption. |
| 01 July 2026 (14:00 UTC) | Krybit malware activated mass encryption across servers, changing file extensions to .KRYBIT. The Krybit group officially listed Company A on its TOR leak site. |
Encryption outbreak and initiation of the double-extortion campaign. |
| 02 July 2026 | Threat Intelligence platforms (DeXpose, Ransomware.live, and SOCRadar) detected and reported threat indicators associated with the campaign. | Public disclosure across international cybersecurity channels. |
Detailed Analysis of Attack Chain
Để hình dung rõ cách thức vụ tấn công tàn phá một doanh nghiệp chế biến thực phẩm quy mô lớn, chúng ta tiến hành phân tích chi tiết từng mắt xích trong chuỗi tấn công (Cyber Kill Chain), đối chiếu trực tiếp với các hoạt động vận hành thường ngày tại Doanh nghiệp A.
Phase 1: Initial Access (Initial access via leak account)
Actual scenario at Enterprise A: An employee of the Logistics or Import-Export Business department of Enterprise A uses a personal computer or remote working device infected with information-stealing malware (Infostealer such as RedLine or Vidar). This malicious code silently steals login information (Username/Password), browsing history and Cookies saved on the browser for internal ports such as SSL-VPN, Webmail Port (PA Vietnam/Hosting Subject) or Remote Desktop port (RDP) opening to the internet.
Hacker's technical behavior: The attacker (Krybit Affiliate) buys account data sets (Stealer Logs) on Telegram channels or black markets. Because Business A's VPN/RDP gateway does not require two-factor authentication (MFA), the hacker's direct login to the company's internal network is completely legitimate without raising any security alerts.
Phase 2: Scanning and Lateral Movement
Actual scenario at Enterprise A: After successfully standing in the internal network, the attacker from the hijacked computer proceeds to scan the office network partition (Office Network) and the processing plant network (Plant/Factory Network). They hunt for high-value resources:
ERP/Accounting server: Place to store financial transaction information, invoices, and food ingredient supplier information.
Warehouse & Logistics Management Server (WMS): Where to coordinate refrigerated truck schedules, track inventory at factories and dealers.
Common File Storage Server (File Server / NAS): Where to store line drawings, product recipes, quality inspection records (HACCP/ISO) and international trade contracts.
Hacker's technical behavior: Use PowerShell script and WMI tool to escalate privileges to the Domain Admin account. They set up additional anonymous accounts to maintain access (Persistence) in case the initial connection is disconnected.
Phase 3: Defense Evasion & Backup Destruction
Actual scenario at Enterprise A: Business A is equipped with traditional Antivirus solutions and has a daily automatic data backup mechanism (Scheduled Backup) stored right on local file servers or backup servers and Active Directory partitions.
Hacker's technical behavior: Recognizing the enterprise's recovery mechanism, before encryption, the attacker executes a series of deep intervention commands to clear the way:
Turn off or remove the Antivirus/Endpoint Protection service on the servers.
Delete all instant backups (Shadow Copies) on Windows operating system with the command:
- Find the backup drives (NAS/Backup Server) integrated in the internal network and proceed to delete the backup or change the access password, completely destroying the ability of Business A to self-recover data.
Phase 4: Data Staging & Exfiltration
Actual scenario at Enterprise A: The attacker does not encrypt immediately. They spend from a few days to 2 weeks (Dwell Time) searching and gathering the most important data to serve the double extortion threat (Double Extortion).
Hacker's technical behavior:
Gather folders containing: List of international customers, food supply contracts, financial and accounting records, personnel salary list and processing recipes.
Compress all this data into large .zip/.7z files (from 10 GB to 250 GB).
Use an anonymous data transfer tool (like Rclone) to download all this data to the Krybit group's C2 server located abroad (T1041).
Phase 5: Impact & Operational Paralysis
Actual scenario at Enterprise A (Serious operational consequences): In the early morning of July 1, 2026, Krybit malware simultaneously exploded on the entire server and workstation system of Company A.
Immediate consequences for production and business activities:
Packaging & Exporting line stalled: Computers at the factory had the entire warehouse database (WMS) encrypted, workers could not print delivery notes, and could not scan barcodes to verify agricultural/food shipments for loading and unloading onto refrigerated vehicles.
Finance & Accounting frozen: Accounting software server locked database files (.mdf/.ldf), businesses cannot issue electronic invoices, cannot pay for raw materials to farms/suppliers.
Risk of material damage: The delay in logistics coordination puts fresh or frozen food shipments at risk of exceeding the safe storage time, incurring contract delay penalties from foreign partners.
Double extortion pressure: Every folder on the computer has a RECOVER-README.txt file and the file extension is changed to .KRYBIT. Krybit threatens that if the ransom is not paid, all contracts and business data will be released to the public TOR network.
Detailed Technical Analysis
Krybit encryption malware (Babuk Derivative)
Krybit malware inherits the multi-threaded encryption structure from Babuk:
Encryption Algorithm: Uses a combination of ChaCha20 (or AES-256) for file encryption and Curve25519 (ECDH) for encryption key security. This combination delivers extremely fast encryption speeds on large file servers.
Process handling: Before encryption, the malware scans and interrupts processes related to databases and business application services (such as sqlserver.exe, oracle.exe, vmware-vmx.exe, ocssd.exe) to release file locks, ensuring data written in the database is completely encrypted.
Ransom Note structure (RECOVER-README.txt)
The text sample left on the victim's system contains a typical blackmail message:
Infrastructure risks of food industry enterprises
From analyzing the public domain infrastructure footprint of food businesses in Vietnam, the SOC team noted common weaknesses:
Email services (Mail Server) and Web Hosting are often located in the same partition or use shared hosting infrastructure that lacks safe boundary separation.
The SPF record (v=spf1 include:... ~all) configures SoftFail mode, allowing attackers to perform Email Spoofing to send phishing emails internally.
The lack of a centralized incident monitoring solution (SIEM/EDR) leads to Dwell Time (the time an attacker stays in the system) lasting weeks before the encryption behavior breaks out.
IOC
File System
Encrypted file extension: .KRYBIT
Ransom note filename: RECOVER-README.txt
Data Leak Site (Tor)
krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid[.]onion
krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd[.]onion
krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd[.]onion
krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd[.]onion
krybivdln3oc3twbin4budgznzq7dmcolldnsx455lspxxe23b56y5qd[.]onion
Hashes
F65E1621B7A5DC0139FE108B9CD48404082951E7E7F421A07A7B88A8E8111C13C552EA2B0C4C
48B547A7A6195593B9158E4B6160ED0310B2F9AD080992D44EA299878DCCD0551CC7CAD168CD
590586B43A7F5101002EA0167A6E627402512D50B41E1178E484B3DB9616F31ABD9D938D9AC9
0D72935BE65992C164D5BFAFD668ACE2004A317859E360A0851B864AA422EA2E43179699DBE3
B7EA3E6CD89496CDC27FC7A4010DCA634D8EED1282EFD5E1FF876C91DD4AA94193403F29B58C
AD8A7E310F6A6DA2D39A57B1EB034A28EBD35367FA4CCD832CF74F80C464D03CA2AF0547CBCF
515C7E4F8048813CAFCDEBD915D72E9ACDEC588201B6E941422717D4F80753766EFA0462B8BD
Execution Commands
vssadmin.exe delete shadows /all /quiet
wbadmin.exe delete catalog -quiet
bcdedit.exe /set {default} recoveryenabled No
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
net stop "VSS" /y
net stop "memtas" /y
MITRE ATT&CK
| Tactic | Technique ID | Technique Name | Description of the Technique in the Campaign |
|---|---|---|---|
| Initial Access | T1078 |
Valid Accounts | Uses compromised credentials obtained from infostealers. |
T1133 |
External Remote Services | Gains access through RDP/VPN services without MFA protection. | |
| Execution | T1059.001 |
PowerShell | Executes scripts to collect information and download payloads. |
T1047 |
Windows Management Instrumentation | Executes remote commands through WMI. | |
| Persistence | T1547.001 |
Registry Run Keys / Startup Folder | Establishes persistence by automatically launching the malicious binary. |
| Defense Evasion | T1562.001 |
Impair Defenses | Disables or modifies internal Antivirus/EDR security controls. |
T1490 |
Inhibit System Recovery | Deletes Volume Shadow Copies and backup catalogs to prevent system recovery. | |
| Discovery | T1083 |
File and Directory Discovery | Scans directories and network drives to identify accessible files and resources. |
| Exfiltration | T1041 |
Exfiltration Over C2 Channel | Exfiltrates sensitive data to an external server through the Command and Control (C2) channel. |
| Impact | T1486 |
Data Encrypted for Impact | Encrypts files and appends the .KRYBIT extension. |
Expert Opinion
Data encryption incidents for food processing businesses in Vietnam prove the fact: Threat Actor does not only target finance or high technology, but is ready to attack any business with compromised IT infrastructure.
The proprietary food production and processing industry depends greatly on the continuity of the supply chain (from raw material receipt, quality inspection, cold storage to export transportation). Having an IT system encrypted even for just 48-72 hours can cause huge chain damage in terms of material damage, violation of delivery contracts, and fines for delay. Krybit attackers understand this time pressure to push the ransom level up.
In addition, the main penetration source of RaaS campaigns in 2026 in Vietnam does not come from complex Zero-Day techniques, but mainly from Infostealer Market. The personal computer of an employee or partner is infected with malicious code that steals browser login passwords, then these credential files are sold on Telegram/Darknet at very cheap prices. If businesses do not have a CTI (Threat Intelligence) solution to detect these exposed accounts early, attackers will easily step through the firewall through a valid VPN.
Defense Recommendations
EMERGENCY (0 - 24 HOURS)
Force password change & Enable MFA across VPN/RDP/O365.
Immediately isolate the backup partition (Backup) - Switch to Immutable/Offline
Block commands to delete Shadow Copy at Endpoint via Policy/EDR.
SHORT TERM (1 - 7 DAYS)
Check accounts exposed on the Dark Web (Infostealer Monitoring).
Reconfigure SPF (HardFail -all) & DMARC records for Mail Domain.
Scan for vulnerabilities of all VPN Gateway devices, Firewalls, ESXi Hosts.
LONG TERM (STARTEGIC)
Deploy Zero Trust Architecture & IT/OT Partition model.
Equipped with EDR/XDR with behavioral anti-encryption detection capabilities.
Organize Ransomware incident response drills (Tabletop Exercise).
Details of emergency blocking command on Windows server (Group Policy / Script)
To prevent Krybit's Shadow Copy removal technique, system administrators can implement a rule that blocks vssadmin.exe command execution for non-SYSTEM accounts or set up an EDR alert when a command sequence is detected:
Check Volume Shadow Copy status: Get-Wmiobject Win32_ShadowCopy
Enable Audit Process Creation (Event ID 4688) to monitor vssadmin/bcdedit command: Auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
References
0APT vs. KryBit Ransomware Actors List Opposing Operators as Victims
