SHADOWBYT3$ Ransomware: 2 US Property-Management Victims Posted — Edge Access, Staging & Detection Rules

Bulletin date: 2026-09-17
Source: ransomware.live collection from criminal .onion leak infrastructure
Confidence: Moderate on observed postings; low-to-moderate on attribution-specific TTPs because SHADOWBYT3$ has limited public telemetry.

Executive Assessment

SHADOWBYT3$’s leak site shows a small but concentrated burst of activity: two U.S. victims in two days, both associated with HandyTrac/Greystar locations in Arizona and categorized as Other. The victim names strongly suggest property-management / real-estate operations rather than a classic enterprise vertical. Treat this as an access-driven campaign likely exploiting exposed edge services, remote access tooling, vulnerable virtualization management, or a third-party/service-provider path into smaller regional sites.

The two postings are: HandyTrac Greystar AZ WARNING published 2026-09-16 and HandyTrac (Greystar Litchfield Park, AZ) published 2026-09-15. The WARNING suffix may indicate escalation pressure before full data release, failed negotiation, or a duplicate/placeholder listing. Security teams should assume data theft claims are being used for leverage even if encryption has not been independently confirmed.

Threat Actor Profile — SHADOWBYT3$

• Aliases: No validated aliases are confirmed in the provided dataset. Track infrastructure overlaps before re-attributing.
• Model: Unclear whether closed group or emerging RaaS. Low posting volume over the last 100 listings is consistent with a small crew, initial access broker reselling, or a new brand testing leak-site operations.
• Ransom demand profile: Not publicly established. For property-management victims, demands commonly track to perceived ability to pay, cyber-insurance coverage, tenant PII volume, and operational disruption risk rather than revenue alone.
• Likely initial access: Prioritize exposed remote access and edge exploitation: VPN concentrators, firewall management planes, RDP, remote monitoring and management tools, vulnerable vCenter, and phished credentials. The related KEV set reinforces edge-device and management-plane risk.
• Extortion approach: Assume double extortion until disproven: encrypt where possible, exfiltrate tenant/applicant PII, financial records, lease files, identity documents, emails, and credential stores first.
• Dwell time: Unknown for this group. In comparable campaigns, hands-on staging often runs 3-14 days before detonation; edge compromise can precede visible leak posting by weeks.

Current Campaign Analysis

Sector targeting: Official tags say Other, but the named victims map to property management, residential real-estate operations, key/entry management workflows, and site-level service delivery. This creates risk for tenant PII, applicant screening data, payment details, vendor credentials, and building-access systems.

Geographic concentration: United States, specifically Arizona-linked Greystar/HandyTrac locations. Concentration in one metro or management portfolio can indicate a shared MSP, shared credential base, common VPN/firewall template, or franchise/site-level exposure.

Victim profile: Likely small-to-mid enterprise operating units under a larger brand umbrella. Revenue may be materially lower than parent-brand perception; however, property portfolios aggregate high-value PII and operational technology dependencies, increasing extortion leverage.

Posting frequency and escalation: Two postings in 48 hours is not high volume, but the WARNING-to-named-victim sequence suggests negotiation pressure or leak-site normalization. Watch for: reposts with countdown timers, file-tree proof, sample data archives, journalist/embargo threats, and new victims sharing the same property-management stack.

KEV connection as candidate access paths: Do not assert confirmed CVE use without host telemetry. Still, prioritize validation for: CVE-2026-59310 VMware vCenter path traversal, CVE-2026-20316 Cisco Secure FMC hard-coded password exposure, CVE-2026-50751 Check Point IKEv1 improper authentication, CVE-2026-48027 Nx Console malicious package/supply-chain risk, and CVE-2024-1708 ConnectWise ScreenConnect path traversal/RCE. These align to management-plane compromise, remote-access abuse, supply-chain developer tooling, and RMM-style persistence.

Detection Engineering

---
title: SHADOWBYT3 Campaign - Office or Script Spawning Staging Tools
id: 8f3f3e31-9d4f-4b4a-8a6d-shadowbyt301
status: experimental
description: Detects Office, browser, or script hosts launching compression, credential, discovery, or shadow-copy tooling often seen before ransomware exfiltration.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - winword.exe
      - excel.exe
      - powerpnt.exe
      - outlook.exe
      - mshta.exe
      - wscript.exe
      - cscript.exe
      - rundll32.exe
  selection_child:
    Image|endswith:
      - powershell.exe
      - pwsh.exe
      - cmd.exe
      - rar.exe
      - 7z.exe
      - robocopy.exe
      - vssadmin.exe
      - wmic.exe
      - nltest.exe
      - net.exe
  condition: selection_parent and selection_child
falsepositives:
  - Administrative scripts
  - Software packaging
level: high
---
title: SHADOWBYT3 Campaign - Pre-Encryption Backup and Log Sabotage
id: 8f3f3e32-9d4f-4b4a-8a6d-shadowbyt302
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, boot recovery changes, and event log clearing near ransomware detonation.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - delete shadows
      - resize shadowstorage
      - wbadmin delete catalog
      - bcdedit /set
      - recoveryenabled no
      - wevtutil cl
      - clear-eventlog
  selection_img:
    Image|endswith:
      - vssadmin.exe
      - wbadmin.exe
      - bcdedit.exe
      - wevtutil.exe
      - powershell.exe
      - cmd.exe
  condition: selection_cmd and selection_img
falsepositives:
  - Backup maintenance
  - Break-fix recovery operations
level: critical
---
title: SHADOWBYT3 Campaign - Remote Service Creation and Lateral Execution
id: 8f3f3e33-9d4f-4b4a-8a6d-shadowbyt303
status: experimental
description: Detects PsExec-style service installs, WMI remote process creation, admin share writes, and suspicious service binaries launched from temp or programdata paths.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_exec:
    CommandLine|contains:
      - \\*
      - admin$
      - ipc$
      - process call create
      - psexec
      - sc \\n      - sc.exe create
      - winrm quickconfig
  selection_paths:
    CommandLine|contains:
      - appdata
      - programdata
      - temp
      - users\public
  condition: selection_exec and selection_paths
falsepositives:
  - Legitimate RMM
  - SCCM or Intune deployment
level: high

let lookback = 14d;
let suspicious_staging = dynamic(["vssadmin","wbadmin","bcdedit","wevtutil","rar.exe","7z.exe","robocopy","nltest","mimikatz","procdump","comsvcs","psexec","wmic"]); 
DeviceProcessEvents
| where Timestamp >= ago(lookback)
| where FileName has_any (suspicious_staging) or ProcessCommandLine has_any (suspicious_staging)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Commands=make_set(ProcessCommandLine, 20), Hosts=make_set(DeviceName, 20), Accounts=make_set(AccountName, 20) by InitiatingProcessFileName, FileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp >= ago(lookback)
    | where RemoteUrl !isempty or RemoteIP !isempty
    | summarize NetFirst=min(Timestamp), RemoteDestinations=make_set(strcat(RemoteIP, RemoteUrl), 25) by DeviceName, InitiatingProcessFileName
) on $left.Hosts has $right.DeviceName and $left.InitiatingProcessFileName == $right.InitiatingProcessFileName
| extend RiskScore = iff(Commands has_any ("delete shadows","wevtutil cl","process call create","admin$"), 90, 60)
| project RiskScore, FirstSeen, LastSeen, InitiatingProcessFileName, FileName, Hosts, Accounts, Commands, RemoteDestinations
| order by RiskScore desc, LastSeen desc

#Requires -RunAsAdministrator
param(
  [switch]$AuditOnly = $true,
  [int]$Days = 7
)
$since = (Get-Date).AddDays(-$Days)
$report = [ordered]@{}

$report.RdpListening = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,OwningProcess)
$report.RdpEnabled = (Get-ItemProperty 'HKLM:/System/CurrentControlSet/Control/Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$report.NewScheduledTasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Date -ge $since } | Select-Object TaskName,TaskPath,Date,State
$report.RecentServices = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object { $_.PathName -match 'AppData|ProgramData|Temp|Users\\Public' } | Select-Object Name,DisplayName,State,StartMode,PathName
$report.ShadowCopies = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Select-Object ID,InstallDate,DeviceObject,VolumeName
$report.SuspiciousProcesses = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.CommandLine -match 'vssadmin|wbadmin|bcdedit|wevtutil|psexec|process call create|admin\$|rar.exe|7z.exe' } | Select-Object ProcessId,Name,CommandLine,CreationDate
$report.EdgeExposure = Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and ($_.DisplayName -match 'RDP|VPN|SSL|FMC|Check Point|ScreenConnect|vCenter|3389|443|8443') } | Select-Object DisplayName,Profile,Action,LocalPort,RemoteAddress

$report | ConvertTo-Json -Depth 6
if (-not $AuditOnly) {
  Disable-NetAdapterBinding -Name '*' -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue
  Set-ItemProperty 'HKLM:/System/CurrentControlSet/Control/Terminal Server' -Name fDenyTSConnections -Value 1 -ErrorAction SilentlyContinue
  Write-Output 'AuditOnly disabled: IPv6 binding disabled and RDP denied. Validate business impact before broad rollout.'
}

Incident Response Priorities

T-minus detection checklist before encryption: new admin-like accounts, VPN logins from impossible geography or anonymizing ASNs, RMM tools not in the approved inventory, vCenter/FMC/Check Point admin actions outside change windows, WMI/PsExec service creation, mass file renames on shares, compression of tenant folders, shadow-copy deletion, event-log clearing, backup job failures, and outbound transfers to rare cloud/storage endpoints.

Assets this victim set likely prioritizes for exfiltration: tenant and applicant PII, background/credit screening outputs, government ID scans, lease agreements, payment and ACH data, maintenance/access-control logs, property-management database exports from platforms such as Yardi/RealPage/OneSite where present, email mailboxes, Active Directory and SSO secrets, MSP/RMM credentials, backup repositories, and network diagrams.

Containment ordered by urgency: 1) isolate affected sites and edge VPN/firewall management interfaces; 2) disable inbound RDP and restrict 443/8443 management planes to trusted admin hosts; 3) reset domain, VPN, SSO, RMM, and property-management SaaS credentials; 4) block known egress destinations and suspend new outbound rules; 5) preserve volatile memory, firewall/VPN logs, EDR telemetry, and leak-site proof; 6) snapshot before shutting down if forensically safe; 7) protect backups by taking immutable copies offline; 8) activate legal, privacy, insurer, and tenant-notification workflows because property data commonly triggers state breach statutes.

Hardening Recommendations

Immediate 24h: Patch or mitigate all listed KEV items; disable IKEv1 where operationally feasible on Check Point; rotate Cisco FMC credentials and audit hard-coded/default secrets; restrict vCenter to management networks; inventory and remove unauthorized ScreenConnect/RMM; enforce phishing-resistant MFA for VPN, SSO, SaaS, and admins; block Office macro internet execution; enable ASR rules for credential theft, process injection, and shadow-copy protection; verify immutable backups and test one restore; hunt the Sigma/KQL logic across the last 14 days.

Short-term 2 weeks: Segment property sites from corporate AD and building-access systems; require just-in-time admin and PAM for vCenter, FMC, Check Point, and RMM; deploy egress filtering with deny-by-default for server VLANs; add canary files in tenant-data repositories; centralize VPN/firewall/RMM/SaaS logs into Sentinel; establish attack surface monitoring for forgotten site portals; run tabletop exercises for double-extortion negotiation, tenant notification, and parent-brand/ franchise coordination.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub