Shadowbyt3$
| Active | RaaS
ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.
Victims
12
First Discovered
2026-02-25
victim
Last Discovered
2026-06-16
victim
Inactive Since
42
days
Avg Delay
29
days
Infostealer
77.8%
victims with domain
Countries
6
hit
Attack Velocity — Last 12 months
Exclusive interview with the ransomware group ShadowByt3$
from the CyberSecurityIL Telegram Channel —
ransomware-interviews.base44.app
Known Locations (4)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Leaks | No | 2026-05-24T06:07:15 |
mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion
|
|||
|
ShadowByt3$ | No | 2026-04-28T07:28:57 |
shadowbyt3s.8bit.ca
|
|||
|
SB Group | No | 2026-07-18T22:42:30 |
52rtvdymcqvebbamd3la3wtu3ofrcuzuzja3vrsu6wiyrq223osptzqd.onion
|
|||
|
SB Data Leak Site | No | 2026-07-18T22:42:09 |
shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion
|
Target
Top 5 Activity Sectors
- Education 4
- Technology 3
- Hospitality 3
- Professional Services 1
- Agriculture and Food Production 1
Top 5 Countries
-
United States
3
-
Japan
2
-
India
2
-
Switzerland
1
-
United Kingdom
1
Heatmap
YARA Rules (1)
Victims (12)
This will be quick. You don't even want to read the private messages as some will be embarrasing. So…
proof: https://mega.nz/folder/3kBzQKgR#rIhDePsPMeFpfEGTPopDVQ We are ShadowByt3$ a extortion as a se…
Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected:…
We have breached you and gained access to the following portals: https://operations.cropwise.com/d/u…
Should've not messed with us Hotelogix. We gave you guys numerous times to reach back and proceed wi…
StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It…
Cloud-based school management and collaboration platform targeting educational institutes in India, …
Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's no…
Amplify technology has been a victim of an attack. There project they were working on with the pakis…
ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approxim…
We are ShadowByt3$. We have claimed responsibility for hacking Hotelogix. They have been breached th…