Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Shadowbyt3$

Inactive for 60 d RaaS
World map Statistics
ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.
Victims
21
none this month
Rank
#168 / 388
#75 over the last 12 months
First victim
2026-02-17
estimated attack date
Last victim
2026-09-16
60 days ago
Attack → claim
29 d
average delay
Countries
7
hit
Infostealer
50.0%
of victims with a domain
Leak-site uptime
5.9% average, 30 days

Victims per month

By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Education 5 · 24%
  • Technology 4 · 19%
  • Other 3 · 14%
  • Hospitality 3 · 14%
  • Professional Services 2 · 10%
  • Retail & E-Commerce 2 · 10%
  • Agriculture and Food Production 2 · 10%

Top countries

What ransomware.live knows about ShadowByt3$

Exclusive interview with ShadowByt3$ by the CyberSecurityIL Telegram channel: read it