Ransomware group

ShadowByt3$ ransomware: victims and leak site activity

The ShadowByt3$ ransomware group has listed 21 victims on its leak site since February 2026; its latest post is from 16 September 2026. Most affected countries: United States, United Kingdom and India. Most targeted sector: Education.

Total posts 21
First seen 2026-02-25
Latest post 2026-09-16
Countries hit 7

About ShadowByt3$

ShadowByt3$ is a ransomware-as-a-service group first observed in October 2025, using multi-method extortion and communicating via Telegram and Tox, with a very small confirmed victim list suggesting it remains in early-stage operation.

Leak site (Tor)
http://sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad.onion
Profile
ransomware.live

ShadowByt3$ victims per year

21 2026

All 21 victims

Search every post in the full table.
Victim Country Sector Discovered
HandyTrac Greystar AZ WARNING United States Other
HandyTrac (Greystar Litchfield Park, AZ) United States Other
John Engel Team United States Professional Services
Ben Leeds Properties United Kingdom Other
BayView Real Estate United States Retail & E-Commerce
Bayview Real Estate WARNING United States Retail & E-Commerce
Sinar Mas Agribusiness and Food Golden Agri-Resources) Indonesia Agriculture and Food Production
A-Plus Software Limited United Kingdom Technology
Knottingham Trent University United Kingdom Education
TINYpulse NINTENDO BREACH Japan Technology
Nintendo Company Japan Technology
Lead Company (Leadership Boulevard) — Professional Services
Cropwise (Syngenta Group) Switzerland Agriculture and Food Production
Hotelogix Company India Hospitality
StarBucks Company United States Hospitality
PowerCampus India Education
Stride Learning United States Education
Amplify Technology United Kingdom Technology
University Of Georgia United States Education
Hotelogix Singapore Hospitality
UMSA — Education