The digital underground rates have risen to the limit.
In the darknet, a rare conflict erupted - one extortionist group decided to put pressure not on companies, but on competitors. The situation looks unusual even for the underground market, where fierce competition has long become the norm.
The group 0APT threatened to reveal the identities of the members of another gang – Krybit. Observers noticed a message on their site on Sunday. The reasons for the pressure remain unclear, but the tone of the publication looks contradictory.
0APT calls Krybit extortionists and at the same time demands a ransom, threatening to publish photos, names and locations of people associated with the group. In parallel, the attackers offered the victims from Krybit free assistance with decryption of data.
As in the classic double blackmail schemes, 0APT posted a small fragment of allegedly stolen information to increase pressure. However, such tactics work worse when the goal is not business, but other cybercriminals. Reputational risks, which are pressure on companies, in the criminal environment almost do not play a role. At the same time, the threat of disclosure of the personality still remains sensitive - the participants of such groups traditionally try to hide.
Barricade Cyber Solutions Analyzes Published files. According to the head of the company Eric Taylor, among the data found accounts in the open form, several crypto wallets and the absence of signs of at least one ransom.
The Krybit website did not work at the time of publication. Instead, a plug is displayed with a promise to restore work in the near future.
The 0APT Group appeared in January 2026 and has already managed to declare itself. Halcyon’s Center for Extortion Expulsion Tests That Participants Have Technical Potential, Although Early Statements on Hundreds of Victims Looked inflated.
Krybit is known much less. Profile companies have not yet published detailed reports, and the activity of the group, judging by the observations on the darknet, began only a few weeks ago.
This is not the first time such clashes between cybercriminals has been going on. In 2025, DragonForce attacked rivals BlackLock and Mamona, and later interfered with the work of RansomeHub, which eventually led to the closure of the project after an internal conflict.
In the darknet, a rare conflict erupted - one extortionist group decided to put pressure not on companies, but on competitors. The situation looks unusual even for the underground market, where fierce competition has long become the norm.
The group 0APT threatened to reveal the identities of the members of another gang – Krybit. Observers noticed a message on their site on Sunday. The reasons for the pressure remain unclear, but the tone of the publication looks contradictory.
0APT calls Krybit extortionists and at the same time demands a ransom, threatening to publish photos, names and locations of people associated with the group. In parallel, the attackers offered the victims from Krybit free assistance with decryption of data.
As in the classic double blackmail schemes, 0APT posted a small fragment of allegedly stolen information to increase pressure. However, such tactics work worse when the goal is not business, but other cybercriminals. Reputational risks, which are pressure on companies, in the criminal environment almost do not play a role. At the same time, the threat of disclosure of the personality still remains sensitive - the participants of such groups traditionally try to hide.
Barricade Cyber Solutions Analyzes Published files. According to the head of the company Eric Taylor, among the data found accounts in the open form, several crypto wallets and the absence of signs of at least one ransom.
The Krybit website did not work at the time of publication. Instead, a plug is displayed with a promise to restore work in the near future.
The 0APT Group appeared in January 2026 and has already managed to declare itself. Halcyon’s Center for Extortion Expulsion Tests That Participants Have Technical Potential, Although Early Statements on Hundreds of Victims Looked inflated.
Krybit is known much less. Profile companies have not yet published detailed reports, and the activity of the group, judging by the observations on the darknet, began only a few weeks ago.
This is not the first time such clashes between cybercriminals has been going on. In 2025, DragonForce attacked rivals BlackLock and Mamona, and later interfered with the work of RansomeHub, which eventually led to the closure of the project after an internal conflict.
