Loading threat actor…
BlackVortex1 is a cybercriminal forum persona linked to the emerging ShadowByt3$ ransomware-as-a-service ecosystem that appeared in late 2025 and early 2026. The handle has been observed across multiple underground forums and is associated with promotion, recruitment, and public-facing extortion activity tied to ShadowByt3$. Available reporting indicates that BlackVortex1 helped advertise the operation’s low-barrier affiliate model, including revenue sharing for affiliates, optional operator support during victim negotiations, and onboarding paths for participants who either already possessed corporate access or were willing to pay an entry fee. The persona is connected to ransomware and data-theft extortion operations in which victim data was published or threatened with publication through onion leak infrastructure and Telegram channels. ShadowByt3$ activity linked to BlackVortex1 included leak announcements, release of sample data to pressure victims, time-bound extortion messaging, and threats to sell or redistribute stolen information if demands were not met. The operation also used Telegram and forum posts to recruit collaborators and insiders with access to corporate environments, indicating an emphasis on scaling affiliate-driven intrusion activity. BlackVortex1 has also been tied to claims of exfiltrating proprietary corporate intellectual property in a high-profile extortion case involving Starbucks. In that incident, the persona publicly advertised allegedly stolen source code and operational technology-related assets and supported a ransom demand backed by a leak threat. Reporting further links the broader ShadowByt3$ operation to active scanning for cloud misconfigurations and exploitation of exposed corporate resources. Overall, BlackVortex1 appears to function as a supporting operator or promoter within a financially motivated ransomware and extortion ecosystem centered on data theft, leak-site pressure, affiliate recruitment, and rapid operational growth rather than uniquely advanced tradecraft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A forum identity explicitly linked to the ShadowByt3$ operation, used across multiple cybercrime forums to promote the ecosystem and its RaaS offering, suggesting a coordinated cross-platform persona supporting recruitment and visibility.
Claimed on a dark web forum to have exfiltrated Starbucks intellectual property as part of activity focused on exploiting cloud misconfigurations to obtain sensitive corporate data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.