Ransomware: krybit named EURODITEL/RESOTELECOM

1. Executive summary

The ransomware group tracked as krybit listed EURODITEL/RESOTELECOM, a French managed services provider specialising in telephony and unified communications, on its public leak site on 2026-10-01. The listing carries no country field, no leak screenshot and no stated data volume, so the only confirmed fact is the publication of the victim name. krybit has no MITRE ATT&CK profile in our reference data, so the group's identity, sponsorship and tradecraft are unconfirmed and we do not attribute this activity to any tracked actor. The relevance to EMEA financial services is indirect but real: an MSP in the communications path of French financial firms is a plausible route to downstream clients, and the same group has listed euroins.bg, a Bulgarian insurer, in the same period. No CVE, no exploitation state and no technical indicators are available in the source material, so this advisory is an exposure and third-party risk note rather than a technical detection package.

2. Regulatory framing

DORA Art. 17, 18, 19 and 24 and NIS2 Art. 23 are not engaged on the facts available: there is no confirmed incident at a financial entity, no confirmed data theft, and no confirmed service disruption, so no incident classification, reporting or resilience testing obligation is triggered by this item alone. UK NIS 2018 duties are not engaged because the victim is a French provider and no UK OES or RDSP is identified.

3. Technical analysis & attack chain

The source material does not support an attack chain. What is confirmed is a single event:

1. On 2026-10-01, the krybit leak site published a victim entry naming EURODITEL/RESOTELECOM.
2. The entry carries no country, no leak screenshot and no description beyond the victim name and the provider's business profile.

That is the whole of the confirmed sequence. There is no initial access vector, no exploited component, no CVE, no payload description, no persistence mechanism, no command-and-control detail, no lateral movement, no exfiltration evidence and no stated impact in the source. We will not construct a chain from the generic behaviour of leak-site listings, because doing so would present inference as observation.

The victim profile is the only substantive detail. EURODITEL is described as a French MSP specialising in telephony and unified communications. For a financial services reader the relevant property is not the sector but the position: an MSP in the voice and UC layer typically holds administrative access to PBX platforms, SIP trunks, call routing configuration and the directory data behind them. Whether krybit obtained any of that is unknown. The listing does not say.

Two related listings from the same group appear in our corpus and are worth noting for pattern only. krybit also listed euroins.bg, a Bulgarian insurer, and dmt-group.com, a German-domain entry whose description refers to an Indian consulting company. The euroins.bg listing places an insurance entity in the same group's victim set. This is a weak signal: leak-site victim lists are frequently padded with re-posts, duplicates and entries of uncertain provenance, and ransomware.live indexes what operators publish without verifying it.

Confidence caveats. The victim identity, the group name and the publication timestamp come from a single source, ransomware.live, which indexes operator-posted material. Nothing here is corroborated by a second source, by the victim, or by an independent incident response report. The attribution to a group called krybit rests entirely on the operator's own claim on its leak site. krybit has no MITRE ATT&CK profile in our reference data, so we cannot map this to a known intrusion set, and we treat the attribution as unconfirmed. Do not use the group name as a detection or blocking criterion.

4. Mitigation & containment

The absence of technical indicators means the actions below are exposure management, not incident response. They are written for clients who contract EURODITEL/RESOTELECOM or who route voice traffic through it.

P1 (within 24 hours)

• Confirm whether EURODITEL/RESOTELECOM appears in your ICT third-party register and identify every internal system, SIP trunk, PBX platform or UC tenant that depends on it. If the dependency is unknown, that gap is the finding.
• Contact the provider through a channel you already trust, not through contact details taken from the leak site or from any email referencing this listing, and ask directly whether they have an active incident. Do not accept a denial as closure; ask for the date of their last clean backup verification and whether administrative credentials for the UC platform have been rotated since 2026-09-01.
• If the provider cannot confirm its status within 24 hours, treat the UC platform as untrusted for administrative purposes: suspend non-essential administrative access to the PBX and UC management interfaces, and require re-authentication with MFA for any remaining administrative session.
• Review outbound and inbound call routing configuration for changes you did not make. Unauthorised routing changes are the concrete risk an MSP compromise presents to a telephony customer, and they are visible in configuration rather than in logs.

P2 (within 72 hours)

• Rotate credentials and API keys that the provider holds or has held for your environment, including SIP trunk credentials, UC platform administrator accounts, and any service accounts used for directory synchronisation. Rotation is the remediation step here; there is no patch to apply.
• Pull the last 30 days of authentication logs for UC and telephony administrative interfaces and look for logins from unfamiliar source addresses or at unusual hours. The source gives no indicators to match against, so this is baseline review, not signature hunting.
• Verify that call detail records for the last 30 days reconcile with expected billing and routing. Divergence indicates configuration change or toll fraud.

P3 (within 7 days)

• Reassess the concentration position for this provider under DORA Art. 29 if the arrangement is not substitutable within your tolerance.
• Review the contract against DORA Art. 30 expectations for key contractual provisions, in particular the provider's obligation to notify you of incidents affecting your service and your audit and access rights.
• If you are in scope for NIS2, confirm the supply chain security measures under Art. 21(2)(d) are documented for this relationship rather than assumed.

No vendor fix, patch or version pin applies. There is no CVE in this item.

5. Indicators of compromise

No indicators of compromise available in the source material. The source provides a victim name, a group name and a publication timestamp. It provides no hashes, no domains, no IP addresses, no file paths, no registry keys and no email addresses.

Behavioural indicators

These behaviours are inference from the victim's business profile, not from the source. We state them because a telephony MSP listing has no atomic indicators to offer and the reader needs something actionable, but they carry no evidentiary weight and should not be used to assert that a compromise occurred.

6. Detection

Insufficient indicators to author detection rules.

The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, file paths, registry keys, ransom-note text or hard-coded values. The only strings present are the victim name, the group name and the provider's business description, none of which are artefacts of the threat. A rule built on those would detect reporting about the incident, not the incident.

7. Sources

• Ransomware.live, "Ransomware: krybit named EURODITEL/RESOTELECOM", https://www.ransomware.live/id/RVVUT0RJVEVML1JFU09URUxFQ09NQGtyeWJpdA==, published 2026-10-01.
• Ransomware.live, "Ransomware: krybit named euroins.bg (BG)", https://www.ransomware.live/id/ZXVyb2lucy5iZ0BrcmliaXQ=, date not stated in source.
• Ransomware.live, "Ransomware: krybit named dmt-group.com (DE)", https://www.ransomware.live/id/ZG10LWdyb3VwLmNvbUBrcmliiaXQ=, date not stated in source.
• Ransomware.live, "Ransomware: qilin named Retelit SpA PIVA (IT)", https://www.ransomware.live/id/UmV0ZWxpdCBTcEEgUElWQUBxaWxpbg==, date not stated in source. Included for market context only; a different group and a different victim.

All four are the same indexing platform. There is no independent corroboration of the EURODITEL/RESOTELECOM listing in the material provided.

8. Adverse Trace position

We assess this as a low-confidence, low-specificity item. The confirmed fact is a leak-site listing; everything beyond that, including whether any data was taken, whether any financial entity's telephony service was affected, and whether krybit is a distinct and persistent group, is unconfirmed. We are not raising a severity rating on a victim name alone, and we are not attributing this to any tracked actor: krybit has no MITRE ATT&CK profile in our reference data, so the attribution is unconfirmed and should not be used for blocking or intelligence matching. The client impact is concentrated in a narrow group, those EMEA financial entities that contract EURODITEL/RESOTELECOM for telephony or unified communications, and for them the exposure is administrative access to voice infrastructure rather than data theft. We will monitor ransomware.live and any victim or regulator statement for corroboration, and we will issue a follow-up if the provider confirms an incident, if a second independent source reports the same victim, or if any technical indicator emerges. Clients who hold a EURODITEL/RESOTELECOM dependency should tell us so we can prioritise that follow-up.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.