# CESMAC university suffers krybit ransomware attack

Published: 2026-08-04 · Severity: high · Sectors: education
Canonical: https://vorant.io/reports/9de969f9-ec6b-5edd-ae53-e34cb4c40df1/cesmac-university-suffers-krybit-ransomware-attack

> Brazilian university CESMAC compromised via krybit ransomware with 998 users affected and credentials stolen.

CESMAC, a Brazilian educational institution, has been targeted by the krybit ransomware gang. The attack resulted in the compromise of 8 employees, 998 user accounts, and 151 third-party employee credentials. The threat actors also identified 104 items on the victim's external attack surface, indicating reconnaissance and lateral movement capabilities. The incident was publicly disclosed on ransomware.live, a tracking platform that indexes ransomware operator claims. This represents a typical ransomware operation targeting the education sector with credential theft and data exfiltration capabilities.

## Mentioned in this report

- Threat actors: Krybit
- Malware: Krybit

## Detection guidance (public sample)

### Network Packet Capture Started via Built-in or CLI Sniffing Tools

ATT&CK: T1040

Detects netsh trace capture, pktmon capture, or CLI packet sniffers (dumpcap, tshark, windump) being started on a Windows host, which is consistent with credential sniffing before ransomware deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Network Packet Capture Started via Built-in or CLI Sniffing Tools
description: Detects packet capture started from the command line using netsh trace,
  pktmon, or CLI sniffers such as dumpcap, tshark and windump. Ransomware operators
  who harvest credentials may sniff network traffic this way. The report gives no
  tool-level detail, so this rule generalises on the technique only.
tags:
- attack.credential-access
- attack.discovery
- attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_netsh:
    Image|endswith: \netsh.exe
    CommandLine|contains|all:
    - trace
    - start
    - capture=yes
  selection_pktmon:
    Image|endswith: \pktmon.exe
    CommandLine|contains: start
  selection_cli_sniffers:
    Image|endswith:
    - \dumpcap.exe
    - \tshark.exe
    - \windump.exe
  condition: 1 of selection_*
falsepositives:
- Network or help desk engineers troubleshooting connectivity with netsh trace or
  pktmon
- Authorised security staff running Wireshark components such as dumpcap or tshark
level: medium
id: b7066f50-24f0-5f85-944a-3b732909cdcd
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Y2VzbWFjLmVkdS5ickBrcnliaXQ=
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/Y2VzbWFjLmVkdS5ickBrcnliaXQ=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9de969f9-ec6b-5edd-ae53-e34cb4c40df1/cesmac-university-suffers-krybit-ransomware-attack.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup