ShadowByt3$
ShadowByt3$ is a ransomware group known for exfiltrating sensitive data from various organizations, including John Engel Team, Abbott Laboratories, and Nintendo of America, often demanding substantial ransoms. They employ techniques such as SQL injection to breach systems and threaten to leak stolen data if negotiations are not completed within a specified timeframe. The group has also claimed to operate as a Wiper as a Service (WaaS), focusing on data theft and potential data destruction. Their activities include targeting a range of sectors, from education to healthcare, and they have been linked to mass-scanning campaigns for vulnerabilities.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- 🚨🇨🇦 Initial Access: Canadian $500M Company Threat actor ShadowByt3$ is advertising access to an email account within the hightail[.]com domain, linked to whamastodon · Nov 6, 2026
- 🚨🇺🇸 Initial Access: Ryder Invoicing Portal Threat actor ShadowByt3$ is advertising access to Ryder’s invoicing portal, which they describe as part of a corpomastodon · Oct 25, 2026
References
- https://asec.ahnlab.com/en/93633/
- https://www.redpacketsecurity.com/shadowbyt3-ransomware-victim-umsa/
- https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-march-2026
- https://www.ransomlook.io/group/shadowbyt3%24
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.