Shadowbyt3$

☆ pin

Also known as ShadowByt3$

Reports

First seen

May 14, 2026

Last seen

Sep 16, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Education ×9 Technology ×6 Retail & E-commerce ×2 Agriculture ×2 Healthcare ×1 Hospitality ×1 Professional Services ×1 Media & Entertainment ×1

Victim regions

×1

×16

United States×16

India×3

United Kingdom×3

Indonesia×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×2T1005 Data from Local System ×2T1567 Exfiltration Over Web Service ×2T1566 Phishing ×1T1110 Brute Force ×1T1526 Enumerate Cloud Resources ×1T1078 Valid Accounts ×1T1087 Account Discovery ×1T1537 Transfer Data to Cloud Account ×1T1041 Exfiltration Over C2 Channel ×1T1567.002 Exfiltration Over Web Service - Exfiltration to Cloud Storage ×1

Indicators

domain ×53url ×15ip_v4 ×14hash_sha256 ×11hash_md5 ×6hash_sha1 ×4

Indicator values are available on Pro and via the API.

Recent reports

High

Shadowbyt3$

Relationships

Targeting

Top ATT&CK techniques

Indicators

Recent reports

Shadowbyt3$ claims HandyTrac Greystar AZ ransomware attack with data exfiltration

Shadowbyt3$ claims HandyTrac (Greystar Litchfield Park) as ransomware victim

Shadowbyt3$ claims breach of John Engel Team real estate firm

Shadowbyt3$ publishes Ben Leeds Properties as ransomware victim

Shadowbyt3$ ransomware gang claims breach of Ben Leeds Properties

Shadowbyt3$ publishes BayView Real Estate breach; 216 MB of corporate and tenant data stolen

Shadowbyt3$ publishes Bayview Real Estate as ransomware victim

Shadowbyt3$ publishes Sinar Mas Agribusiness and Food (Golden Agri-Resources) as ransomware victim

Shadowbyt3$ publishes A-Plus Software Limited breach via SQL injection

Shadowbyt3$ claims breach of Nottingham Trent University

Shadowbyt3$ claims Stride Learning in ransomware extortion

ShadowByt3$ claims breach of University of Georgia, exfiltrates employee and government data

Shadowbyt3$ publishes Starbucks as ransomware victim

Shadowbyt3$ claims Hotelogix in ransomware extortion post

Shadowbyt3$ claims breach of LEAD School platform affecting multiple Indian schools

Shadowbyt3$ claims breach of Cropwise (Syngenta Group) and multiple Indian schools

Shadowbyt3$ claims breach of TINYpulse (Nintendo)

Abbott Laboratories investigating two cyber incidents amid ShinyHunters and ShadowByt3$ extortion claims

Nintendo confirms data stolen in WebMD subsidiary cyberattack

Shadowbyt3$ publishes TINYpulse data breach; Nintendo connection disputed

Shadowbyt3$ claims extortion of Nintendo; 859 MB data theft alleged

Shadowbyt3$ claims breach of Lead Company educational platform affecting multiple Indian schools

Shadowbyt3$ Claims Breach of Cropwise (Syngenta Group); Extortion Demand

Shadowbyt3$ announces BreachForums restoration promotion

Shadowbyt3$ publishes Hotelogix as ransomware victim

Shadowbyt3$ claims Starbucks victim on ransomware.live

Shadowbyt3$ publishes PowerCampus as ransomware victim

Shadowbyt3$ ransomware gang publishes Stride Learning breach

Shadowbyt3$ publishes Amplify Technology as ransomware victim

ShadowByt3$ claims breach of University of Georgia