Ransomware Turf War as 0APT and KryBit Groups Trade Blows

Why It Matters

The public data breaches damage credibility, jeopardizing affiliate recruitment and ransom revenue, and signal a more volatile ransomware landscape for victims and defenders alike.

Key Takeaways

• 0APT's fake victim list exposed, eroding trust with affiliates
• KryBit stole 0APT's source code and defaced its leak site
• Both groups must rebuild infrastructure, likely rebranding within months
• Ransomware payments fell 8% to $820 m despite 50% attack rise

Pulse Analysis

The ransomware ecosystem is entering a period of heightened instability as groups scramble for credibility amid shrinking crypto payouts. Chainalysis data shows ransomware‑related cryptocurrency payments dropped 8% annually to roughly $820 million in 2025, even as the number of attacks surged 50%. This financial squeeze pushes operators to seek new affiliate relationships and larger bounties, making reputation a critical asset.

In the latest showdown, 0APT attempted to boost its profile by publishing a leak that claimed three rival groups, including KryBit, as victims. The leak revealed KryBit’s admin panel, affiliates, and ransom demands between $40,000 and $100,000, forcing KryBit to rotate its infrastructure. KryBit’s counter‑attack was swift: it exfiltrated 0APT’s full source code, access logs, and system files, then defaced the 0APT leak site with a warning. The exposure of fabricated victim data further eroded 0APT’s standing, highlighting how quickly trust can evaporate when operational details are publicized.

For enterprises and cyber‑insurance firms, these developments underscore the need for continuous threat‑intelligence monitoring. As ransomware actors rebuild and rebrand, they may adopt more sophisticated evasion techniques, complicating detection and response. Law‑enforcement agencies must also adapt, focusing on disrupting the infrastructure churn rather than targeting static actors. Ultimately, the ongoing turf war suggests a more fragmented, unpredictable threat landscape, where the battle for credibility can be as damaging as the ransomware attacks themselves.