ShadowByt3$

Active
ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.
21 Victims
Feb 17, 2026 First Discovered
Sep 16, 2026 Last Discovered
2 Days Inactive
17.6% Infostealer
1/6 Sites Online
Top Countries
US 7
GB 4
JP 2
IN 2
ID 1
CH 1
SG 1
Top Sectors
Education 5
Technology 4
Hospitality 3
Other 2
Professional Services 2
Retail & E-Commerce 2
Agriculture and Food Production 2
Known Locations (6)
sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion
ShadowByt3$
shadowbyt3s.8bit.ca
[SB] Leaks
sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion
Leaks
mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion
SB Group
52rtvdymcqvebbamd3la3wtu3ofrcuzuzja3vrsu6wiyrq223osptzqd.onion
SB Data Leak Site
shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion
Victims (20)
HandyTrac (Greystar Litchfield Park, AZ)
US Other Discovered: Sep 14, 2026 · Attack est.: Sep 14, 2026
We have access to sensitive data. It's in your best interest to contact us and negotiate since it will just hurt you if you don't. We stole a lot of...
John Engel Team
US Professional Services Discovered: Sep 10, 2026 · Attack est.: Sep 10, 2026
Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url...
Ben Leeds Properties
GB Other Discovered: Sep 6, 2026 · Attack est.: Sep 6, 2026
We have emailed the following [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] Reply back and negotiate or all data that we said was stolen gets published. If you comply and...
BayView Real Estate
US Retail & E-Commerce Discovered: Aug 28, 2026 · Attack est.: Aug 28, 2026
Guess your too busy focusing on your clients then changing password and protecting your clients. We breached them through pm.livable.com. You can see screenshots and file tree in the proof...
Bayview Real Estate WARNING
US Retail & E-Commerce Discovered: Aug 28, 2026 · Attack est.: Aug 28, 2026
Check your emails or we will leak the data we are not bluffing we stole 216.6 MB. compromised email: [email protected] compromised site: https://pm.livable.com The following emails below check your emails...
Sinar Mas Agribusiness and Food Golden Agri-Resources)
ID Agriculture and Food Production Discovered: Aug 25, 2026 · Attack est.: Aug 25, 2026
We Breached This company a few months ago. we stole 375.66MB. mirror 1: https://anonfilesnew.com/s/4t-mBJg9wMy More info is on darkforums.ru about this leak.
A-Plus Software Limited
GB Technology Discovered: Aug 25, 2026 · Attack est.: Aug 25, 2026
We Breached A-plus through a sql injection vulnerability and downloaded everything in there backend. We gained access to there system on 08/18/2026 The following data was stolen: 1. Website User...
TINYpulse NINTENDO BREACH
JP Technology Discovered: Jun 16, 2026 · Attack est.: Jun 16, 2026
This will be quick. You don't even want to read the private messages as some will be embarrasing. Some people are confused but this breach doesn't affect you unless if...
Nintendo Company
JP Technology Discovered: Jun 12, 2026 · Attack est.: Jun 12, 2026
proof: https://mega.nz/folder/3kBzQKgR#rIhDePsPMeFpfEGTPopDVQ We are ShadowByt3$ a extortion as a service group. We stole close enough to 1gb. You have 48 hours to contact us nintendo or all data gets leaked....
Lead Company (Leadership Boulevard)
Professional Services Discovered: Jun 2, 2026 · Attack est.: Jun 2, 2026
Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected: The specific schools explicitly named in the exfiltrated folders include: - Arya Vidyapith - Aakarsh...
Cropwise (Syngenta Group)
CH Agriculture and Food Production Discovered: Jun 2, 2026 · Attack est.: Jun 2, 2026
We have breached you and gained access to the following portals: https://operations.cropwise.com/d/users/sign_in https://accounts.cropwise.com/signin proof: https://mega.nz/folder/25hkSLgY#ELjJaFie-TfES9Z_47KFZA company url: https://operations.cropwise.com/ We are ShadowByt3$ a Extortion as a service group. You have been...
Hotelogix Company
IN Hospitality Discovered: May 21, 2026 · Attack est.: May 21, 2026
Should've not messed with us Hotelogix. We gave you guys numerous times to reach back and proceed with payment but you decided to fuck around and you found out. Any...
Stride Learning
US Education Discovered: May 14, 2026 · Attack est.: May 14, 2026
Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's not that hard. This is a warning to all companies that if you don't...
Amplify Technology
GB Technology Discovered: May 14, 2026 · Attack est.: May 14, 2026
Amplify technology has been a victim of an attack. There project they were working on with the pakistan and other countries got stolen. We stole 1.69Gb of data. for all...
University Of Georgia
US Education Discovered: May 14, 2026 · Attack est.: May 14, 2026
ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approximately 3.2 MB in raw text files. No customers were affected just exployees the...
Hotelogix
SG Hospitality Discovered: May 14, 2026 · Attack est.: May 14, 2026
We are ShadowByt3$. We have claimed responsibility for hacking Hotelogix. They have been breached through there amazon s3 buckets and azure blobs. They were misconfigured which allowed us to scrape...
PowerCampus
IN Education Discovered: May 14, 2026 · Attack est.: May 13, 2026
Cloud-based school management and collaboration platform targeting educational institutes in India, covering online fee payments, exam management, online admissions, teacher-parent communication, and e-learning continuity.
StarBucks Company
US Hospitality Discovered: May 21, 2026 · Attack est.: Mar 31, 2026
StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It's not even that much we were asking for. Since you...
UMSA
Education Discovered: Feb 25, 2026 · Attack est.: Feb 17, 2026
File: UMSA_LEAK.7z
Knottingham Trent University
GB Education Discovered: Aug 25, 2026 · Attack est.: Jul 10, 2025
We breached Knottingham trent University on August 19th 2026 by gaining access through webapps.ntu.ac.uk. We alerted the university which they know they have been breached they locked out are access...