Shadowbyt3$
| Active | RaaS
ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.
Victims
10
First Discovered
2026-02-25
victim
Last Discovered
2026-06-03
victim
Inactive Since
0
days
Avg Delay
29
days
Infostealer
57.1%
victims with domain
Countries
5
hit
Attack Velocity — Last 12 months
-67% vs last month
Exclusive interview with the ransomware group ShadowByt3$
from the CyberSecurityIL Telegram Channel —
ransomware-interviews.base44.app
Known Locations (4)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Leaks | No | 2026-05-24T06:07:15 |
mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion
|
|||
|
ShadowByt3$ | No | 2026-04-28T07:28:57 |
shadowbyt3s.8bit.ca
|
|||
|
SB HOME | Yes | 2026-06-03T06:35:50 | nginx |
52rtvdymcqvebbamd3la3wtu3ofrcuzuzja3vrsu6wiyrq223osptzqd.onion
|
||
|
SB Data Leak Site | Yes | 2026-06-03T06:36:32 | nginx |
shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion
|
Target
Top 5 Activity Sectors
- Hospitality and Tourism 3
- Education 3
- Business Services 1
- Agriculture and Food Production 1
- Technology 1
Top 5 Countries
-
United States
3
-
India
2
-
Switzerland
1
-
United Kingdom
1
-
Singapore
1
Heatmap
YARA Rules (1)
Victims (10)
Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected:…
We have breached you and gained access to the following portals: https://operations.cropwise.com/d/u…
Should've not messed with us Hotelogix. We gave you guys numerous times to reach back and proceed wi…
StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It…
Cloud-based school management and collaboration platform targeting educational institutes in India, …
Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's no…
Amplify technology has been a victim of an attack. There project they were working on with the pakis…
ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approxim…
We are ShadowByt3$. We have claimed responsibility for hacking Hotelogix. They have been breached th…