Back to Threat Groups

ShadowByt3$

ransomware group

ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communic

Victims
20
records
First Discovered
Feb 25, 2026
victim
Last Discovered
Jun 16, 2026
victim
Inactive Since
61
days
Countries
5
hit
Avg Discount
no settlements

Group Activity

Last 12 months
Sep
2025
Oct
2025
Nov
2025
Dec
2025
Jan
2026
1
Feb
2026
Mar
2026
12
Apr
2026
2
May
2026
5
Jun
2026
Jul
2026
Aug
2026

Victims (20)

TINYpulse NINTENDO BREACH (nintendo.com)

ShadowByt3$🇯🇵 JP
Jun 16, 2026

This will be quick. You don't even want to read the private messages as some will be embarrasing. Some people are confused but this breach doesn't affect you un...

TechnologyPublished
nintendo.com

Nintendo Company (Nintendo.com)

ShadowByt3$🇯🇵 JP
Jun 12, 2026

proof: https://mega.nz/folder/3kBzQKgR#rIhDePsPMeFpfEGTPopDVQ We are ShadowByt3$ a extortion as a service group. We stole close enough to 1gb. You have 48 hours...

TechnologyPublished
nintendo.com

Lead Company (Leadership Boulevard)

ShadowByt3$🇮🇳 IN
Jun 3, 2026

Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected: The specific schools explicitly named in the exfiltrated fo...

Education765.9MBPublished
leadschool.in

Cropwise (Syngenta Group)

ShadowByt3$🇨🇭 CH
Jun 2, 2026

We have breached you and gained access to the following portals: https://operations.cropwise.com/d/users/sign_in https://accounts.cropwise.com/signin proof: htt...

Technology765.9MBPublished
operations.cropwise.com

University Of Georgia

ShadowByt3$🇺🇸 US
Jun 2, 2026

We have breached you and gained access to the following portals: https://operations.cropwise.com/d/users/sign_in https://accounts.cropwise.com/signin proof: htt...

Education3.2 MB8.0Published
axcera.io

PowerCampus

ShadowByt3$🇮🇳 IN
May 14, 2026

Cloud-based school management and collaboration platform targeting educational institutes in India, covering online fee payments, exam management, online admiss...

Education1.0Published
powercampus.in

BreachForumsis Back (

ShadowByt3$
May 14, 2026

ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approximately 3.2 MB in raw text files. No customers were affected j...

3.2 MB1.0Published
breachforu.ms

Eric J Taylor Doxx

ShadowByt3$
Apr 22, 2026

Uploader: Anonymous

4Gb1.0Published

Ellucian PowerCampus Warning (Contact Us)

ShadowByt3$🇺🇸 US
Apr 17, 2026

This is a warning for ellucian PowerCampus. Due to not people paying much for are breach we will give you 48 hours to contact us. If you don't it will get publi...

Education1.0Published
ellucian.com

Stride Learning

ShadowByt3$🇺🇸 US
Apr 17, 2026

Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's not that hard. This is a warning to all companies that if you ...

Technology1.0Published500.000 $
stridelearning.com

Amplify Technology

ShadowByt3$🇬🇧 GB
Apr 14, 2026

Amplify technology has been a victim of an attack. There project they were working on with the pakistan and other countries got stolen. We stole 1.69Gb of data....

Technology1.0Published
amplifytechnology.co.uk

University Of Georgia (uga.edu)

ShadowByt3$🇺🇸 US
Apr 14, 2026

Uploader: Anonymous

Education1.0Published
uga.edu

UMSA Argentina

ShadowByt3$
Apr 14, 2026

Uploader: Anonymous

1.0Published

StarBucks Company (StarBucks.com

ShadowByt3$🇺🇸 US
Apr 14, 2026

StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It's not even that much we were asking for. Since you didn't c...

Hospitality and Tourism1.0Published
starbucks.com

Amplify_Technology_breached_032326

ShadowByt3$
Apr 12, 2026
Published

Hotelogix Company (

ShadowByt3$🇮🇳 IN
Apr 12, 2026

Should've not messed with us Hotelogix. We gave you guys numerous times to reach back and proceed with payment but you decided to fuck around and you found out....

Hospitality and Tourism10.4MB1.0Published500.000 $
hotelogix.com

sample_Pay_or_gets_leaked_and_sold_and_on_news

ShadowByt3$
Apr 10, 2026
Published

Sample_Forestal Atlántico Sur (FAS)_fas.com.uy

ShadowByt3$
Apr 9, 2026
Published

Pay_until_timer_runs_outForestal Atlántico Sur (FAS)_fas.com.uy

ShadowByt3$
Apr 9, 2026
Published

UMSA

ShadowByt3$
Feb 25, 2026

File: UMSA_LEAK.7z

1.0Published

Infrastructure

leak site
OFFLINE
http://mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion/leaks.php

never crawled

leak site
OFFLINE

unreachable

http://shadoz22.io/

2544ms

5d ago

leak site
OFFLINE
http://shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion/leaks

never crawled

leak site
OFFLINE
http://sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion/leaks.php

never crawled

leak site
OFFLINE
https://shadowbyt3s.8bit.ca/index.php

never crawled

leak site
OFFLINE

unreachable

https://shadowsblog.cloud-ip.cc/

8960ms

10d ago

leak site
OFFLINE

unreachable

http://shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion/

4151ms

5d ago