Loading story…
Researchers traced the emerging ShadowByt3$ ransomware-as-a-service operation from a University of Georgia data leak to a broader extortion ecosystem spanning dedicated onion leak sites, mirrored domains, Telegram channels, and cybercrime forums. The group maintained victim listings, exposed multiple contact methods, and accepted cryptocurrency payments, indicating an actively managed leak and negotiation platform rather than a one-off breach disclosure. Telegram was used to announce leaks, publish limited data samples, pressure victims with deadlines, and distribute extortion messaging.
The investigation also linked ShadowByt3$ to the forum identity BlackVortex1, whose accounts appeared across several criminal forums between late 2025 and early 2026. A Cracked.sh post tied to that identity advertised a low-barrier affiliate model with a 70/30 revenue split favoring affiliates, optional operator support for negotiations, and entry either through existing corporate access or a $250 cryptocurrency fee. The findings portray ShadowByt3$ as an early-stage but coordinated ransomware ecosystem focused on rapid recruitment, accessibility, and scaling rather than advanced technical sophistication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
StealthMole published its investigation tracing ShadowByt3$ across onion sites, Telegram, and forums, and assessing it as an emerging but coordinated ransomware ecosystem focused on accessibility and rapid scaling.
Researchers found ShadowByt3$ using Telegram to announce leaks, share limited data samples, issue extortion deadlines, and recruit affiliates or insiders with corporate access, showing the platform was used for both operations and expansion.
Following the University of Georgia leak, researchers discovered a dedicated ShadowByt3$ onion leak site with mirrored domains, exposed contact methods, victim listings, and cryptocurrency payment options, indicating an actively maintained extortion platform.
In early April 2026, a University of Georgia data leak was attributed to ShadowByt3$, providing the initial trigger for researchers to investigate the group.
A Cracked.sh thread attributed to BlackVortex1 promoted a ransomware-as-a-service offering with a 70/30 affiliate revenue split, optional operator help with negotiations, and entry via existing corporate access or a $250 cryptocurrency fee.
Researchers observed the forum identity BlackVortex1 appearing on several cybercrime forums between late 2025 and early 2026, establishing cross-platform visibility tied to the later ShadowByt3$ operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
stealthmole-intelligence-hub.blogspot.com
Open sourcestealthmole-intelligence-hub.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Leaked internal records exposed how the **Black Basta** ransomware operation relied on the bulletproof hosting provider **Media Land** (also known as **Yalishanda**) for servers, domains, proxy services, bandwidth, and technical support. A leak of roughly 190,000–200,000 Black Basta Matrix chat messages, followed by a leak of Media Land’s internal database, revealed operational links between the two organizations and identified **Aleksandr Volosovik** as the operator behind Yalishanda and **Kirill Zatolokin** (aka **Slim Shady**) as a support and infrastructure operator who bridged Media Land and Black Basta. The disclosures showed Black Basta functioning as a structured ransomware enterprise that used cryptocurrency to pay for infrastructure and maintained abuse-resistant services through a registered front company. The leaked chats and subsequent research also detailed Black Basta’s attack methods across critical infrastructure victims, including phishing, Microsoft Teams and fake IT-support social engineering, exploitation of known vulnerabilities, and use of malware such as **Qakbot**, **Pikabot**, **DarkGate**, **LummaC2**, and **Cobalt Strike**. Researchers found the group abused **EV code-signing certificates**, reused credentials, created corporate-looking domains, and discussed zero-day and CVE exploitation while running double-extortion campaigns. U.S. and allied authorities later sanctioned Media Land, its subsidiary **Data Center Kirishi**, Volosovik, and Zatolokin for supporting cybercrime, underscoring how infrastructure providers enabled Black Basta’s global ransomware operations.
Aug 15, 2026
Krybit has emerged as a ransomware-as-a-service (**RaaS**) operation using **double extortion**, Tor-hosted leak infrastructure, and a likely **Babuk-derived** payload targeting **Windows, Linux, VMware ESXi, and NAS** environments. Reporting indicates the malware deletes shadow copies, appends the `.KRYBIT` extension to encrypted files, and drops a `RECOVER-README.txt` ransom note. The group has pursued broad, opportunistic victimization across **43 countries**, with **Germany, Spain, and Brazil** among the most affected geographies and professional services, technology, and manufacturing among the most targeted sectors. Public visibility into Krybit increased after rival RaaS operator **0APT** breached Krybit’s affiliate panel in April, exposing plaintext credentials, user roles, negotiation data, Tox IDs, and Bitcoin wallets, with leaked records showing about **20 victims** in active negotiations and ransom demands ranging from **$40,000 to $100,000**. Krybit retaliated by compromising and defacing 0APT’s leak site and publishing its operational data, creating a notable ransomware-on-ransomware conflict. Despite the reputational damage and evidence that no confirmed ransom payment had yet been recorded during the leaked period, Krybit continued naming victims through mid-2026 and showed no public signs of shutting down or rebranding.
Jul 13, 2026
LockBit grew from an early ABCD ransomware strain into one of the most prolific ransomware-as-a-service operations, combining fast multithreaded encryption, **double extortion**, and affiliate-driven intrusions against corporate victims worldwide. Researchers and incident reporting tied the group to tactics including UAC bypasses, shadow-copy deletion, log clearing, network-share encryption, and later campaigns using evasive multi-stage loaders, Safe Mode persistence, and password-protected payload delivery. The operation also recruited insiders for direct access to enterprise networks, soliciting VPN, RDP, and email credentials and offering large payouts to employees willing to run malware inside their organizations. LockBit’s criminal ecosystem evolved alongside broader ransomware market shifts, with reporting linking it to affiliate churn, code overlap with other families, and adoption of a modified Conti-based payload branded as **LockBit Green**. By 2023, analysts reported infrastructure and leak-site reliability problems that frustrated affiliates, even as the gang remained tied to major incidents such as the Royal Mail attack. In 2024, Operation Cronos disrupted LockBit infrastructure and seized decryption keys, and U.S., U.K., and Australian authorities later sanctioned and charged Russian national **Dmitry Yuryevich Khoroshev** as the alleged leader, saying LockBit hit more than 2,500 victims in at least 120 countries, collected at least **$500 million** in ransom, and caused billions in wider losses.
Aug 15, 2026