Summary
The Krybit ransomware group claims to have breached the networks of Ibn Sina Trust (www.ibnsinatrust.com), a leading healthcare provider in Bangladesh. The cyber criminals are threatening to publish a substantial volume of exfiltrated data if their demands are ignored. At this time, the specific ransom amount demanded by the group remains undisclosed.
Incident Details
- Threat Actor: Krybit
- Data at Risk: 116.73 GB (Exfiltrated, currently unpublished)
- DLS Listing Date: September 12, 2026
- Scheduled Leak Time: September 16, 2026, 12:57:47 UTC
- Source: Krybit Dark Web Data Leak Site (DLS)
Threat Actor: Krybit
KryBit is a financially motivated ransomware group that emerged in March 2026, offering a Ransomware-as-a-Service model where affiliates retain a significant share of ransom payments. They employ a double-extortion strategy by encrypting files and exfiltrating sensitive data, with notable public conflicts with rival groups contributing to their visibility in the cybercriminal landscape.
Key insights
- Utilizes a double-extortion model, encrypting files and stealing data.
- Targets multiple operating systems, including Windows, Linux, and ESXi.
- Ransom demands range between $40,000 to $100,000.
- Employs complex evasion techniques, including shadow copy deletion and process injection.
- Communicates with victims through Tor-based channels for negotiations.
- Engages in inter-group conflicts that result in operational revelations.
- Initial access often gained through phishing and exploited services.
Impacted Data Types & Potential Risk
The 116.73 GB of exfiltrated data may contain highly sensitive information, including:
- Protected Health Information (PHI): Medical histories, diagnoses, treatment records, and patient billing details.
- Personally Identifiable Information (PII): National ID numbers, contact details, dates of birth for patients, students, and staff.
- Corporate Data: Internal communications, financial documents, and operational records.
Unauthorized release of these data types poses severe risks of identity theft, financial fraud, and targeted social engineering against affected individuals.
Guidance for Affected Individuals
Potentially impacted individuals (patients, staff, and students) should immediately take the following precautions:
- Monitor Financials: Regularly review credit reports and bank statements for unauthorized activity. Consider a credit freeze.
- Beware of Phishing: Exercise extreme caution with unsolicited communications (email, SMS, phone) referencing medical history or employment.
- Secure Accounts: Immediately change passwords for any Ibn Sina Trust/ISMCH portals. Enable Multi-Factor Authentication (MFA) on all critical personal accounts.
- Review Medical Claims: Scrutinize health insurance statements (Explanation of Benefits) for fraudulent billing.
Evidence
Screenshots captured from the Krybit Data Leak Site confirming the threat actor's claims:
Sources
- Krybit Threat Actor Profile: https://socradar.io/free-tools/ransomware-intelligence/groups/krybit
- Darkfield Intelligence: https://darkfield.orizon.one/victims/e8f3d736-d0aa-43fe-a73f-aa6f3f477de6
Disclaimer: This report is based on dark web intelligence. The situation remains dynamic pending the expiration of the threat actor's countdown timer.