KRYBIT widens its campaign to Colombia

Update September 6, 2026: Security Arsenal said KRYBIT posted 14 victims in 24 hours across 9 countries and more than 8 sectors, while CYFIRMA added Colombia and Chile as targets in the wave. CyberRakshak Labs also urged readers to treat several entries as a cluster of extortion claims, not as fully confirmed breaches.

KRYBIT, EMPERADOR, THEGENTLEMEN and INCRANSOM posted new victims over 24- to 72-hour windows, with confirmed cases in Mexico and the United States and signs of expansion into Latin America. Security Arsenal tied KRYBIT to 14 victims in one day, including two in Mexico, and THEGENTLEMEN to 16 victims in 24 hours, with about 31% from LATAM.

What do KRYBIT’s recent posts show?

KRYBIT showed concentrated, multi-regional activity, with 14 victims posted in 24 hours across 9 countries and more than 8 sectors, according to Security Arsenal. CYFIRMA added Colombia and Chile as target countries in its Weekly Intelligence Report of September 4, 2026, extending the LATAM footprint beyond Mexico.

That monitoring also pointed to a concentration of victims in India, Mexico and the United States, with additional distribution across other countries. At the same time, the group listed the domain tum.com.mx and also uicc.org on its leak site on September 1, 2026, reinforcing the picture of a simultaneous campaign against multiple organizations.

External investigations into tum.com.mx identified the victim as Transportistas Unidos Mexicanos División Norte, S.A. de C.V., one of Mexico’s largest road transport operators. Other breach-tracking sources, however, classified the domain as education, a sector mismatch that does not change the central fact, the presence of a Mexican victim attributed to KRYBIT.

What sector spread appeared in this wave?

KRYBIT’s new batch of posts spans a broader sector taxonomy, including retail, e-commerce, food, health or diagnostics, manufacturing, construction, biotechnology, technology or services, and automotive or transportation, according to CYFIRMA. Security Arsenal, meanwhile, said the victims were concentrated in healthcare, education, professional services and technology, along with other corporate sectors.

Technical victim-monitoring sources also show that several entries from September 1, 2026, including seashellhospital.com and uicc.org, were associated with the health sector. Those records fit a posting sequence that began in April 2026 and showed visible spikes between September 1 and 3, 2026.

What is known about KRYBIT’s technique and infrastructure?

KRYBIT operates a double-extortion model, with a dedicated Tor leak site and channels such as Tox to communicate with victims and affiliates, according to a technical analysis by Picus Security. That same work places the group across business services, consumer services, manufacturing, education and technology, with geographic focus in Germany, Mexico, Thailand, Spain and Austria.

The TTP chain attributed to the group included edge device exploitation, staging remote access tools, lateral movement with PsExec and WMI, data preparation, shadow copy deletion and encryption. The report does not mention victims in Latin America for this batch, but it does show a consistent technical pattern and a clear focus on exposed infrastructure.

In its September review, CyberRakshak Labs also softened the breach narrative. Although several organizations appear on leak sites, in many cases there is not enough public evidence about the stolen data or the exact nature of the exfiltrated sets. For that reason, the report recommends describing the phenomenon as a cluster of extortion claims.

Where did THEGENTLEMEN hit?

THEGENTLEMEN posted 16 victims in 24 hours, and about 31% of those posts were tied to Latin America, with cases in Mexico, Brazil, Puerto Rico and Argentina, according to Security Arsenal. The same analysis placed victims in transportation, healthcare, energy and utilities, agriculture and food production, and retail and e-commerce.

Among the listed cases is Northwest Trophy, a retail victim in the United States that incident aggregators and breach trackers also logged as a case still unconfirmed by the company or regulators. Specialized portals cited technical discovery dates and estimated attack dates, but kept the incident in claim status without corporate validation.

What does INCRANSOM add to this picture?

INCRANSOM added five new victims in 72 hours, and the set included cases in Mexico, the United States and South Africa, with U.S. victims in energy and utilities, professional services and technology, according to Security Arsenal. In LATAM, victim tracking attributed to INCRANSOM the attack against the Mexican company Wittmann, classified as manufacturing.

That cross-check of sources broadens the regional view of the actor, which appears active in manufacturing and energy, with documented presence in Mexico. Its latest posting wave also reinforces that the group operated across more than one geography at the same time, within a short public exposure window on leak sites.