Back to Threat Groups

ShadowByt3$

ACTIVE

ransomware group

ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communic

Victims
30
records
First Discovered
Feb 25, 2026
victim
Last Discovered
Sep 15, 2026
victim
Inactive Since
16
days
Countries
6
hit
Avg Discount
—
no settlements

Group Activity

Last 12 months
Nov
2025
Dec
2025
Jan
2026
1
Feb
2026
Mar
2026
12
Apr
2026
2
May
2026
5
Jun
2026
Jul
2026
7
Aug
2026
3
Sep
2026
Oct
2026

Victims (30)

HandyTrac (Greystar Litchfield Park, AZ)

ShadowByt3$🇺🇸 US
16d ago

We have access to sensitive data. It's in your best interest to contact us and negotiate since it will just hurt you if you don't. We stole a lot of sensitive i...

Other1.0Published
new.handytrac.com

John Engel Team

ShadowByt3$🇺🇸 US
20d ago

Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have ...

Professional Services1.0Published
johnengelteam.realscout.com

Ben Leeds Properties

ShadowByt3$🇬🇧 GB
23d ago

We have emailed the following la@benleedsproperties.com nikki@benleedsproperties.com 21736Roscoe@benleedsproperties.com 3327livonia@benleedsproperties.com...

Other3.0Published
benleedsproperties.com

BayView Real Estate

ShadowByt3$🇺🇸 US
Aug 29, 2026

Guess your too busy focusing on your clients then changing password and protecting your clients. We breached them through pm.livable.com. You can see screenshot...

Retail & E-Commerce100 MB1.0Published
pm.livable.com

Copy

ShadowByt3$
Aug 26, 2026
Published

Joining Requirements

ShadowByt3$
Aug 26, 2026

Contact us before registering. You must have valid access or proof of work from previous defunct groups in order to join. If you do not have any valid credentia...

1.0Published
darkforums.ru

Sinar Mas Agribusiness and Food Golden Agri-Resources)

ShadowByt3$🇮🇩 ID
Aug 25, 2026

We Breached This company a few months ago. we stole 375.66MB. mirror 1: https://anonfilesnew.com/s/4t-mBJg9wMy More info is on darkforums.ru about this leak.

Agriculture and Food Production375.66 MB1.0Published
smart-tbk.com

A-Plus Software Limited

ShadowByt3$🇬🇧 GB
Aug 25, 2026

We Breached A-plus through a sql injection vulnerability and downloaded everything in there backend. We gained access to there system on 08/18/2026 The followi...

Technology2.6582 MB1.0Published
a-plussoft.com

Knottingham Trent University

ShadowByt3$🇬🇧 GB
Aug 25, 2026

We breached Knottingham trent University on August 19th 2026 by gaining access through webapps.ntu.ac.uk. We alerted the university which they know they have be...

Education1.0Published
ntu.ac.uk

ShadowByt3$ 2.0

ShadowByt3$
Aug 25, 2026

Operating Since October 2025 Gate Status: AWAITING HANDSHAKE Initialize Security Handshake

2.0Published

TINYpulse NINTENDO BREACH (nintendo.com)

ShadowByt3$🇯🇵 JP
Jun 16, 2026

This will be quick. You don't even want to read the private messages as some will be embarrasing. Some people are confused but this breach doesn't affect you un...

Technology856 MB1.0Published
nintendo.com

Nintendo Company (Nintendo.com)

ShadowByt3$🇯🇵 JP
Jun 12, 2026

proof: https://mega.nz/folder/3kBzQKgR#rIhDePsPMeFpfEGTPopDVQ We are ShadowByt3$ a extortion as a service group. We stole close enough to 1gb. You have 48 hours...

Technology1 GB1.0Published2 Mio. $
nintendo.com

Lead Company (Leadership Boulevard)

ShadowByt3$🇮🇳 IN
Jun 3, 2026

Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected: The specific schools explicitly named in the exfiltrated fo...

Education765.9MB1.0Published
leadschool.in

University Of Georgia

ShadowByt3$🇺🇸 US
Jun 2, 2026

We have breached you and gained access to the following portals: https://operations.cropwise.com/d/users/sign_in https://accounts.cropwise.com/signin proof: htt...

Education3.2 MB8.0Published
axcera.io

Cropwise (Syngenta Group)

ShadowByt3$🇨🇭 CH
Jun 2, 2026

We have breached you and gained access to the following portals: https://operations.cropwise.com/d/users/sign_in https://accounts.cropwise.com/signin proof: htt...

Technology765.9MB1.0Published
operations.cropwise.com

PowerCampus

ShadowByt3$🇮🇳 IN
May 14, 2026

Cloud-based school management and collaboration platform targeting educational institutes in India, covering online fee payments, exam management, online admiss...

Education1.0Published
powercampus.in

BreachForumsis Back (

ShadowByt3$
May 14, 2026

ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approximately 3.2 MB in raw text files. No customers were affected j...

3.2 MB1.0Published
breachforu.ms

Eric J Taylor Doxx

ShadowByt3$
Apr 22, 2026

Uploader: Anonymous

4Gb1.0Published

Ellucian PowerCampus Warning (Contact Us)

ShadowByt3$🇺🇸 US
Apr 17, 2026

This is a warning for ellucian PowerCampus. Due to not people paying much for are breach we will give you 48 hours to contact us. If you don't it will get publi...

Education1.0Published
ellucian.com

Stride Learning

ShadowByt3$🇺🇸 US
Apr 17, 2026

Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's not that hard. This is a warning to all companies that if you ...

Technology1.0Published500.000 $
stridelearning.com

Amplify Technology

ShadowByt3$🇬🇧 GB
Apr 14, 2026

Amplify technology has been a victim of an attack. There project they were working on with the pakistan and other countries got stolen. We stole 1.69Gb of data....

Technology1.69 GB1.0Published
amplifytechnology.co.uk

University Of Georgia (uga.edu)

ShadowByt3$🇺🇸 US
Apr 14, 2026

Uploader: Anonymous

Education1.0Published
uga.edu

UMSA Argentina

ShadowByt3$
Apr 14, 2026

Uploader: Anonymous

1.0Published

StarBucks Company (StarBucks.com

ShadowByt3$🇺🇸 US
Apr 14, 2026

StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It's not even that much we were asking for. Since you didn't c...

Hospitality and Tourism1.0Published
starbucks.com

Amplify_Technology_breached_032326

ShadowByt3$
Apr 12, 2026
Published

Hotelogix Company (

ShadowByt3$🇮🇳 IN
Apr 12, 2026

Should've not messed with us Hotelogix. We gave you guys numerous times to reach back and proceed with payment but you decided to fuck around and you found out....

Hospitality and Tourism10.4MB1.0Published500.000 $
hotelogix.com

sample_Pay_or_gets_leaked_and_sold_and_on_news

ShadowByt3$
Apr 10, 2026
Published

Sample_Forestal Atlántico Sur (FAS)_fas.com.uy

ShadowByt3$
Apr 9, 2026
Published

Pay_until_timer_runs_outForestal Atlántico Sur (FAS)_fas.com.uy

ShadowByt3$
Apr 9, 2026
Published

UMSA

ShadowByt3$
Feb 25, 2026

File: UMSA_LEAK.7z

Education1.0Published

Infrastructure

leak site
ONLINE
https://transfer.it

1792ms

6m ago

leak site
ONLINE
http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion

4117ms

3d ago

leak site
OFFLINE

unreachable

http://shadoz22.io/

501ms

5d ago

leak site
OFFLINE

unreachable

https://shadowsblog.cloud-ip.cc/

8568ms

6d ago

leak site
OFFLINE

unreachable

http://sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion/leaks.php

8199ms

6d ago

leak site
OFFLINE

unreachable

http://shdwbt3ja2ptjt6poluegas44i35727lgmoqqquoww642x3zyocyhuqd.onion/leaks

8224ms

16h ago

leak site
OFFLINE

unreachable

https://shadowbyt3s.8bit.ca/index.php

826ms

6d ago

leak site
OFFLINE

unreachable

http://mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad.onion/leaks.php

4345ms

3d ago

leak site
OFFLINE

unreachable

http://52rtvdymcqvebbamd3la3wtu3ofrcuzuzja3vrsu6wiyrq223osptzqd.onion

2756ms

16h ago