Ransomware gangs are fighting. You still lose.

Two ransomware gangs are at war right now, and one of them just offered to hand a rival’s victims their data back.

If that sounds like good news, I get it. Watching criminals turn on each other feels like it should work in your favor.

It doesn’t. Not if your business is one of the victims caught in the middle.

The feud, in plain English

In April 2026, a group calling itself 0APT threatened a rival ransomware operation known as Krybit. According to reporting from The Register and TechRadar, 0APT said that if Krybit didn’t pay up or reach out, 0APT would publish the names, photos, and locations of the people behind it. Then 0APT went a step further and told Krybit’s own victims to contact 0APT directly to get their files unlocked.

This is a version of double extortion, the tactic where a gang encrypts your files and threatens to leak them too, so paying feels like the only way out. That threat works on a business because a business has a reputation to protect. It doesn’t work the same way on a rival criminal group. Krybit has no legitimate reputation to lose, and cybersecurity researchers have noted that this tactic loses much of its sting once the target is another gang instead of a paying victim.

0APT pressed ahead anyway, releasing a sample of Krybit’s stolen data as a warning shot. A researcher at Barricade Cyber Solutions in South Carolina examined that sample and found plaintext login credentials belonging to Krybit’s own operators, along with five cryptocurrency wallet addresses. The same review turned up no record of any victim ever paying Krybit a ransom, which suggests Krybit’s own success claims may have been overstated. Krybit’s site is offline now, replaced by an apology message.

Gangs turning on each other isn’t new. In 2025, a group called DragonForce defaced two rival operations, BlackLock and Mamona, and leaked their internal communications. DragonForce also took over the ransomware brand RansomHub and shut it down after a month of infighting in April 2025.

If Krybit hit your business, don’t call 0APT

Here’s the part that matters for you. If your business was one of Krybit’s victims, 0APT’s offer might look tempting. Someone claiming they can unlock your files for free, instead of the ransom you were already dreading? Of course that’s tempting.

But think about what you’d actually be doing. It’s two burglars who robbed your house, now fighting over the loot, and one of them is offering to sell your stuff back to you. Would you call that number?

0APT is still a ransomware gang. It has no obligation to follow through on anything it says, no proof it can decrypt Krybit’s malware, and no accountability if the call goes nowhere, or if it just uses your outreach to size you up as its next target. Security firm Halcyon has said 0APT shows real technical skill, but the same group posted a list of hundreds of alleged victims within its first 48 hours, a number researchers believe was padded for effect. Inflating claims is part of how these groups operate, whether the target is a rival gang or a paying customer.

What to do instead

If ransomware hits your business, and anyone outside your own incident response plan offers to help, don’t engage. Preserve your firewall logs and network traffic data. That’s the evidence a real incident response team needs to figure out what happened and whether recovery is possible without paying anyone, criminal or otherwise.

The bigger lesson isn’t really about 0APT and Krybit. It’s what this feud shows about the ransomware world generally: unstable, unpredictable, and full of people who lie to each other as easily as they lie to you. None of that instability protects your business. Tested backups, monitoring that catches unusual activity early, and a response plan you’ve walked through before you need it, that’s what protects you.

Two gangs fighting each other doesn’t change your risk. It just proves nobody in that world can be trusted, including whoever’s offering to help this week. If you want a real look at whether your backups, monitoring, and response plan would hold up under an actual attack, get in touch.