Loading threat actor…
ByteToBreach is a financially motivated cybercriminal persona active since at least June 2025 that operates as a data thief, leak operator, and access broker. The actor has maintained a presence across underground forums and messaging platforms and has used a public-facing “Pentesting Ltd.” brand for self-promotion, victim shaming, and monetization. High-confidence attribution from KELA links the persona to Zakaria Mahdjoub of Oran, Algeria. Romanian authorities have also publicly assessed the actor as likely Algeria-based, although some individual incident claims remain unverified. ByteToBreach targets high-impact organizations across multiple countries and sectors, including government entities, financial institutions, airlines, telecommunications providers, universities, healthcare organizations, insurers, and critical-infrastructure-adjacent enterprises. Reported victim geography includes Romania, the United States, Poland, Hungary, Cyprus, Chile, Kazakhstan, Uzbekistan, Singapore, Ukraine, Ethiopia, Finland, Sweden, France, and others. The actor’s victimology and tradecraft indicate opportunistic target selection driven primarily by data value and monetization potential rather than geopolitical alignment. The actor’s access methods include exploitation of known vulnerabilities in public-facing enterprise software, reuse of credentials obtained from infostealers and phishing, brute-force activity, and abuse of misconfigurations. Reported post-compromise behavior includes reconnaissance of enterprise identity and infrastructure, credential harvesting, privilege escalation, lateral movement, access to databases and backups, and staged exfiltration of sensitive records and internal documents. ByteToBreach has been associated with theft of employee records, customer data, source code, configuration data, backups, and government-related information, and has repeatedly advertised stolen datasets for sale or released portions publicly to reinforce credibility. ByteToBreach has also been linked to extortion activity. In the Romania ANCPI incident, the actor claimed theft of internal databases and source code and claimed ransomware deployment, while Romanian authorities assessed the operation as financially motivated and involving exploitation of known vulnerabilities and leaked credentials. In the Eurofiber France incident, the actor claimed responsibility for compromise of a ticket-management environment and the company filed an extortion report. Additional claimed operations against public-sector and enterprise victims describe ransomware deployment alongside data theft, indicating use of both encryption and data-leak pressure in at least some campaigns, though not every public claim has been independently verified. Known aliases and associated handles include ByteToBreach, bytetobreach, CvHNWwEG, and inesslopez. The actor has used Telegram, Dread, DarkForums, Signal, Session, Pastebin, and cloud-sharing services to communicate, market access, and distribute stolen data.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Serveur ciblé : esb.mvh.allamkincstat.gov.hu Vulnérabilité exploitée : CVE-2017-10271 (WebLogic RCE) Méthode : envoi d’une SOAP envelope déclenchant l’exécution d’un reverse shell Python
Step 1: Initial Foothold : Gained entry through a basic Exchange ProxyLogon exploit.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted a disruptive attack against Romania’s National Agency for Cadastre and Property Registration (ANCPI), stealing employee credentials and internal documents, attempting extortion, and reportedly wiping encrypted data when extortion failed.
Cybercriminal group claiming the compromise of Hungarian public-sector entities, using CVE-2017-10271 for initial access, pivoting through Active Directory trust relationships, extracting credentials from Oracle Identity Manager, accessing VMware infrastructure, encrypting smaller business storage, and exfiltrating critical state databases.
Persistent data leak operator and cybercriminal actor conducting intrusions against high-impact organizations, stealing and exfiltrating sensitive data, publishing or selling stolen datasets, and in at least one reported case deploying ransomware against a Romanian government agency.
Financially motivated initial access broker activity targeting poorly protected systems, claiming responsibility for the ANCPI intrusion and offering allegedly stolen data for sale.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.