Search threats, CVEs… ⌘K
← Back to all threat actors

ShadowByt3$

ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.

How we source and review actor profiles
Motivation
ransomware
First seen
2026-05-14
Last seen
2026-09-10
Sectors
technology, education, agriculture-and-food-production, retail-e-commerce, hospitality-and-tourism, professional-services, other, business-services
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimJohn Engel Team listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator6 indicators cataloged

Types: domain, onion.

Claimed
Victim claimBen Leeds Properties listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBayView Real Estate listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBayview Real Estate WARNING listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSinar Mas Agribusiness and Food Golden Agri-Resources) listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimA-Plus Software Limited listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTINYpulse NINTENDO BREACH (nintendo.com) listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNintendo Company (Nintendo.com) listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLead Company (Leadership Boulevard) listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCropwise (Syngenta Group) listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBreachForums is Back (breachforu.ms) listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHotelogix Company (Hotelogix.com) listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimStride Learning listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAmplify Technology listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimUniversity Of Georgia listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHotelogix listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimPowerCampus listed by ShadowByt3$

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

ShadowByt3$Canonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...