ShadowByt3$ is a ransomware group known for exfiltrating sensitive data from various organizations, including John Engel Team, Abbott Laboratories, and Nintendo of America, often demanding substantial ransoms. They employ techniques such as SQL injection to breach systems and threaten to leak stolen data if negotiations are not completed within a specified timeframe. The group has also claimed to operate as a Wiper as a Service (WaaS), focusing on data theft and potential data destruction. Their activities include targeting a range of sectors, from education to healthcare, and they have been linked to mass-scanning campaigns for vulnerabilities.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | ShadowByt3$ |
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names ShadowByt3$, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to ShadowByt3$. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy.