Shadowbyt3$
| RaaS
ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.
Victims
12
First Victim
2026-02-17
(est. attack date)
Discovery Date
2026-02-25
Last Seen
2026-06-16
Inactive Since
70
days
Avg Delay
29
days
Infostealer
77.8%
victims with domain
Countries
6
hit
Uptime
10.0% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
Exclusive interview with the ransomware group ShadowByt3$
from the CyberSecurityIL Telegram Channel —
ransomware-interviews.base44.app
Known Locations (6)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Leaks | No | 2026-08-22T08:41:08 |
mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion
|
||||
|
ShadowByt3$ | No | 2026-08-22T08:40:42 |
shadowbyt3s.8bit.ca
|
||||
|
SB Group | No | 2026-08-22T08:41:21 |
52rtvdymcqvebbamd3la3wtu3ofrcuzuzja3vrsu6wiyrq223osptzqd.onion
|
||||
|
SB Data Leak Site | No | 2026-08-22T08:40:59 |
shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion
|
||||
|
No | 2026-08-25T02:12:20 |
sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion
|
|||||
|
[SB] ShadowByt3$ 2.0 | Yes | 2026-08-25T02:13:04 | nginx |
sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion
|
Target
Top 5 Activity Sectors
- Education 4
- Technology 3
- Hospitality 3
- Professional Services 1
- Agriculture and Food Production 1
Top 5 Countries
-
United States
3
-
Japan
2
-
India
2
-
Switzerland
1
-
United Kingdom
1
Heatmap
YARA Rules (1)
Victims (12)
This will be quick. You don't even want to read the private messages as some will be embarrasing. So…
proof: https://mega.nz/folder/3kBzQKgR#rIhDePsPMeFpfEGTPopDVQ We are ShadowByt3$ a extortion as a se…
Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected:…
We have breached you and gained access to the following portals: https://operations.cropwise.com/d/u…
Should've not messed with us Hotelogix. We gave you guys numerous times to reach back and proceed wi…
StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It…
Cloud-based school management and collaboration platform targeting educational institutes in India, …
Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's no…
Amplify technology has been a victim of an attack. There project they were working on with the pakis…
ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approxim…
We are ShadowByt3$. We have claimed responsibility for hacking Hotelogix. They have been breached th…