cyfenced.com →

[ Ransomware claim · krybit · 24 Oct 2026 ]

MODON Developments S.A.E

The ransomware group krybit named MODON Developments S.A.E (Egypt) on its leak site on 24 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Not confirmed so farManufacturing

[ Status ]Has the attack been confirmed?

We have found no statement from MODON Developments S.A.E and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.

[ The organisation ]Who is MODON Developments S.A.E?

What it does
Modon Developments is an Egyptian real estate developer that builds residential, commercial, administrative and mixed-use projects. Its projects include Boutique Village and Golf Town in New Cairo, Villagio in 6th of October City, towers and the New Capital Lagoons in the New Administrative Capital, and Lagoons Al Alamein on the North Coast.
Based in
Egypt
Size
a portfolio of about 11 projects, according to its chief executive
Who it serves
It sells homes, offices and commercial units to buyers and investors in Greater Cairo, the New Administrative Capital and the North Coast. Handovers to buyers in key East and West Cairo projects are planned to start in 2027.

Partners and customers it names publicly

  • Bin Baz Developments, Long-term strategic partner and contractor for joint projects, reported at over EGP 10 billion
  • Campbell Gray Hospitality, Hotel operator for hotels at Modon Golf Town and Villagio Gray
  • El Nady Club, Cooperation protocol for sports facilities and services in its communities
  • New Urban Communities Authority, Cooperation on Lagoons Al Alamein

[ Impact ]Who could be affected

Buyers and investors who have contracts or instalment plans with the developer could face delays in communication or payments, and their personal and financial details could be at risk if records were exposed. Contractors and partners working on its projects could also see disruption to planning and payments.

In manufacturing generally: Production stops ripple down the supply chain to customers waiting for parts and products, and groups often take design files and supplier contracts.

[ The attacker ]About krybit

Krybit is a ransomware-as-a-service group that appeared in early 2026, using double extortion and tools that target Windows, Linux and VMware ESXi systems. Security researchers have questioned some of its public claims, including claims of ransoms paid.

krybit has claimed 7 organisations in the last 30 days, most in Austria, United States and Malaysia, and mostly in retail & e-commerce, manufacturing and transportation.

krybit on Ransomware.live

Other organisations krybit has named

[ What to do ]If you are a customer, partner or neighbour

  1. Buyers should confirm any request to change payment details or pay instalments to a new account directly with the developer's sales office.
  2. Be cautious of calls, messages or emails that mention your unit or contract and ask for documents, passwords or payments.
  3. Keep copies of your contracts, receipts and payment schedules in a safe place.
  4. Watch for official statements from Modon Developments for confirmed information.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.