SHADOWBYT3$ Ransomware Gang: 3 New Victims Posted in 24 Hours — Agriculture, Tech & Education Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Briefing Date: 2026-08-26 | Analyst: Security Arsenal Threat Intelligence — From The Dark Side

Threat Actor Profile — SHADOWBYT3$

SHADOWBYT3$ (also stylized SHADOWBYTE$, ShadowBytes) is an emerging ransomware operation that surfaced on underground forums in early 2026 and operates a dedicated .onion leak site monitored by Security Arsenal. Based on posting cadence, negotiation artifacts, and tooling overlaps, we assess the following with moderate confidence:

• Aliases: SHADOWBYTE$, ShadowBytes, SBYTE (forum handle used by affiliated initial access brokers on XSS and Exploit)
• Operating Model: Semi-closed RaaS. The core team maintains the encryptor and leak infrastructure while a small vetted affiliate pool (est. 5–10 operators) handles intrusion and staging. Affiliate recruitment posts observed on Russian-language forums emphasize prior Conti/BlackCat playbook familiarity.
• Ransom Demands: Demands observed in the $150K–$2.5M USD range, calibrated to victim revenue. Payment demanded in Monero preferred, BTC accepted with a 10% surcharge. Negotiation window typically 7–10 days before full data publication.
• Initial Access Methods (ranked by observed frequency):
  1. Exploitation of perimeter devices (VPN gateways, firewalls) — consistent with the KEV-linked CVEs below
  2. Compromised/abused RMM tooling (ScreenConnect-style unauthorized access)
  3. Phishing with malicious attachments (OneNote/LNK/macro-enabled documents)
  4. RDP brute force against internet-exposed hosts, often via purchased access broker listings
• Double Extortion: Yes — standard exfiltrate-then-encrypt model. Data is staged via Rclone/MEGA and compressed archives before encryption. Leak site posts name victims first, then release file trees and samples after negotiation failure.
• Average Dwell Time: Estimated 4–11 days from initial access to detonation — short enough that weekly-only hunting will miss them. Pre-encryption staging activity (shadow copy deletion, AV tampering) typically occurs 6–18 hours before detonation.

Current Campaign Analysis

Victims Posted (2026-08-25)

Sector Targeting

Three victims across three distinct verticals in a single 24-hour posting batch indicates opportunistic access-driven targeting rather than sector-specific intent — classic affiliate behavior where initial access brokers sell whatever footholds are available. However, the mix is telling:

• Agriculture/Food Production (ID): Large agribusiness conglomerates run legacy OT-adjacent IT with flat networks, shared service accounts, and under-patched perimeter gear. High-pressure extortion targets — food supply chain disruption creates urgency to pay.
• Technology (GB): Mid-market software firms hold source code, customer data, and — critically — downstream access. Treat any tech-sector victim as a potential supply chain pivot risk to their customers.
• Education (GB): Universities present large attack surfaces, open-by-design networks, and weak segmentation between research, admin, and student environments. Historically low ransomware maturity.

Geographic Concentration

Indonesia and the United Kingdom. The GB concentration (2 of 3 victims) suggests an affiliate actively working UK-accessible perimeter vulnerabilities. The Indonesian victim aligns with a broader 2026 trend of ransomware crews expanding into Southeast Asian enterprises where incident response maturity and cyber insurance penetration are lower.

Victim Profile

• Size range: Mid-market to enterprise. The agriculture victim is a multinational conglomerate (multi-billion USD revenue); the UK victims are mid-market (est. £5M–£150M revenue).
• Common traits: Externally exposed remote access infrastructure, hybrid on-prem/cloud estates, and (for education) seasonal staffing gaps that degrade SOC coverage.

Posting Frequency / Escalation

3 victims in a single day after a quieter period suggests either (a) a batch detonation event where multiple affiliates completed intrusions in parallel, or (b) a negotiation-failure dump. Watch the next 72 hours: if posting cadence holds above 1/day, this is a sustained campaign surge, not a one-off.

CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries (all confirmed ransomware use) map directly to SHADOWBYT3$'s known access methods:

• CVE-2026-50751 (Check Point Security Gateway — Improper Authentication, IKEv1): Primary suspect for VPN-edge initial access. Unauthenticated exploitation of the perimeter gateway is this group's most probable entry into the UK victims.
• CVE-2024-1708 (ConnectWise ScreenConnect — Path Traversal → RCE): Matches the RMM-abuse pattern. Threat actors deploy or hijack ScreenConnect for hands-on-keyboard access that blends with legitimate admin traffic.
• CVE-2026-48027 (Nx Console — Embedded Malicious Code): Supply-chain-flavored vector targeting developer workstations — highly relevant given the technology-sector victim.
• CVE-2023-21529 (Exchange Deserialization) & CVE-2025-60710 (Windows Link Following privesc): Post-access privilege escalation chain components — Exchange for mailbox/domain persistence, link-following for local privesc on endpoints.

Assessment: SHADOWBYT3$ affiliates are chaining unpatched edge-device exploitation (Check Point, ScreenConnect) for entry with commodity Windows privilege escalation for post-compromise movement. Patching these KEV entries is the single highest-leverage defensive action this week.

Detection Engineering

The following detections target the specific TTP chain: edge/RMM initial access → discovery → lateral movement (PsExec/WMI) → staging/exfil → shadow copy deletion → encryption.

---
title: SHADOWBYT3$ - PsExec-Style Remote Service Execution
description: Detects remote service creation consistent with PsExec-style lateral movement used by SHADOWBYT3$ affiliates
author: Security Arsenal Threat Intelligence
date: 2026/08/26
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_service:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\paexec.exe'
      - '\rundeploy.exe'
  selection_remotesvc:
    - EventID: 7045
    - ServiceName|contains:
        - 'PSEXESVC'
        - 'PAExec'
  condition: selection_service or selection_remotesvc
falsepositives:
  - Legitimate administrative tooling using PsExec
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
---
title: SHADOWBYT3$ - Volume Shadow Copy Deletion Prior to Encryption
description: Detects deletion or resize of Volume Shadow Copies, a pre-encryption staging behavior observed 6-18 hours before SHADOWBYT3$ detonation
author: Security Arsenal Threat Intelligence
date: 2026/08/26
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith:
      - '\wmic.exe'
      - '\WMIC.exe'
    CommandLine|contains: 'shadowcopy'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'bootstatuspolicy'
  selection_diskshadow:
    Image|endswith: '\diskshadow.exe'
  condition: 1 of selection_*
falsepositives:
  - Backup software maintenance windows
  - Storage administrators reclaiming shadow storage space
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: SHADOWBYT3$ - Suspicious Archive Staging and Exfiltration Tooling
description: Detects compression and exfiltration tooling (Rclone, 7z to temp paths, MEGA clients) consistent with SHADOWBYT3$ double-extortion data staging
author: Security Arsenal Threat Intelligence
date: 2026/08/26
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
  selection_7z_temp:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
    CommandLine|contains:
      - 'AppData\Local\Temp'
      - 'C:\ProgramData'
      - 'C:\Users\Public'
  selection_mega:
    Image|endswith:
      - '\MEGAcmd.exe'
      - '\mega-cmd.exe'
      - '\MEGAsync.exe'
  condition: 1 of selection_*
falsepositives:
  - Developers using Rclone legitimately (allowlist by signed binary hash and parent process)
  - Enterprise backup solutions with MEGA integration
level: high
tags:
  - attack.exfiltration
  - attack.t1560.001
  - attack.t1567.002

// SHADOWBYT3$ Hunt: Pre-Ransomware Staging & Lateral Movement Chain
// Correlate shadow copy tampering, suspicious service installs, and
// archive/exfil tooling on the same device within 24h — Sentinel
let timeframe = 24h;
let suspiciousProcs = dynamic(["vssadmin.exe","wmic.exe","bcdedit.exe","rclone.exe","7z.exe","rar.exe","PSEXESVC.exe","MEGAsync.exe","diskshadow.exe"]);
let StagingEvents = DeviceProcessEvents
| where TimeGenerated > ago(timeframe)
| where FileName in~ (suspiciousProcs)
| project DeviceName, StagingTime = TimeGenerated, StagingProc = FileName, StagingCmd = ProcessCommandLine, AccountName, InitiatingProcessFileName;
let RemoteServiceInstalls = SecurityEvent
| where TimeGenerated > ago(timeframe)
| where EventID == 7045
| where ServiceName has_any ("PSEXESVC","PAExec") or ServiceFileName has_any ("PSEXESVC","paexec")
| project DeviceName = Computer, SvcTime = TimeGenerated, ServiceName, ServiceFileName, SvcAccount = Account;
let ScreenConnectAbuse = DeviceProcessEvents
| where TimeGenerated > ago(timeframe)
| where FileName has_any ("ScreenConnect","setup.exe","winupdate.exe") and FolderPath has_any ("Temp","ProgramData")
| project DeviceName, RMMTime = TimeGenerated, RMMProc = FileName, RMMPath = FolderPath;
StagingEvents
| join kind=inner RemoteServiceInstalls on DeviceName
| join kind=leftouter ScreenConnectAbuse on DeviceName
| extend RiskScore = iff(isnotempty(RMMProc), 3, 0) + 2
| summarize
    StagingCommands = make_set(StagingCmd, 5),
    Services = make_set(ServiceName, 5),
    RMMIndicators = make_set(RMMProc, 5),
    FirstSeen = min(StagingTime),
    LastSeen = max(StagingTime),
    Risk = max(RiskScore)
  by DeviceName, AccountName
| sort by Risk desc, LastSeen desc;

<#
.SYNOPSIS
  SHADOWBYT3$ Rapid Triage Script — Security Arsenal IR
.DESCRIPTION
  Run on any suspected host (or domain-wide via GPO/Intune/remote exec) to
  enumerate pre-ransomware staging indicators: recent scheduled tasks,
  shadow copy status, new local admins, and exposed RDP configuration.
#>

$Report = @()

Write-Host "[*] SHADOWBYT3$ Rapid Triage — $(hostname) — $(Get-Date)" -ForegroundColor Cyan

# 1. Volume Shadow Copy status — deletion is a CRITICAL pre-encryption signal
Write-Host "`n[1] Volume Shadow Copies:" -ForegroundColor Yellow
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    Write-Host "    [!] NO shadow copies present — possible pre-encryption tampering" -ForegroundColor Red
    $Report += "CRITICAL: No Volume Shadow Copies found"
} else {
    $shadows | ForEach-Object { Write-Host "    OK: $($_.ID) created $($_.InstallDate)" }
}

# 2. Scheduled tasks created in last 7 days (persistence mechanism)
Write-Host "`n[2] Scheduled Tasks created/modified in last 7 days:" -ForegroundColor Yellow
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
  ForEach-Object {
    Write-Host "    SUSPICIOUS: $($_.TaskName) — $($_.Date) — Action: $($_.Actions.Execute)" -ForegroundColor Red
    $Report += "Task: $($_.TaskName) | $($_.Actions.Execute)"
  }

# 3. New local administrators in last 14 days
Write-Host "`n[3] Local Administrators (flag unexpected accounts):" -ForegroundColor Yellow
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
  ForEach-Object { Write-Host "    $($_.Name) [$($_.ObjectClass)]" }

# 4. RDP exposure check
Write-Host "`n[4] RDP Configuration:" -ForegroundColor Yellow
$rdp = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
if ($rdp -eq 0) {
    Write-Host "    [!] RDP ENABLED. NLA: $(if($nla -eq 1){'ON'}else{'OFF — HIGH RISK'})" -ForegroundColor $(if($nla -eq 1){'Yellow'}else{'Red'})
    if ($nla -ne 1) { $Report += "HIGH: RDP enabled without NLA" }
    Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
      Select-Object -First 1 | Out-Null
}

# 5. RMM tools present (ScreenConnect, AnyDesk, etc.) — inventory for abuse
Write-Host "`n[5] RMM tooling installed:" -ForegroundColor Yellow
$rmm = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'ScreenConnect|AnyDesk|TeamViewer|ConnectWise|Atera|Splashtop' }
if ($rmm) { $rmm | ForEach-Object { Write-Host "    FOUND: $($_.DisplayName)" ; $Report += "RMM: $($_.DisplayName)" } }
else { Write-Host "    None detected" }

# 6. Recently failed logons (RDP brute force sign)
Write-Host "`n[6] Failed logon events (4625) in last 24h:" -ForegroundColor Yellow
$fails = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 2000 -ErrorAction SilentlyContinue
if ($fails.Count -gt 50) {
    Write-Host "    [!] $($fails.Count) failed logons — possible brute force" -ForegroundColor Red
    $Report += "HIGH: $($fails.Count) failed logons in 24h"
} else { Write-Host "    $($fails.Count) failed logons (within normal range)" }

Write-Host "`n===== SUMMARY =====" -ForegroundColor Cyan
if ($Report) { $Report | ForEach-Object { Write-Host "  [FINDING] $_" -ForegroundColor Red } }
else { Write-Host "  No high-confidence SHADOWBYT3$ staging indicators found." -ForegroundColor Green }

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

If you detect ANY of the following in combination, assume detonation is 6–18 hours out and move immediately to containment:

1. Shadow copy deletion or bcdedit recovery disabling — highest-fidelity pre-detonation signal
2. New local admin accounts or suspicious scheduled tasks on servers (persistence)
3. PsExec-style service installs (Event 7045) across multiple hosts in a short window
4. Rclone/7z/MEGA execution on file servers or anywhere outside developer workstations
5. Large outbound transfers to cloud storage (MEGA, Mega.nz endpoints, unknown S3 buckets) from server VLANs
6. AV/EDR tampering events — Defender disabled via registry, exclusions added, sensor services stopped
7. Unexpected ScreenConnect/RMM sessions outside change windows

Critical Assets This Group Prioritizes for Exfiltration

• File servers and NAS shares (finance, HR, legal departments first)
• Database backups and exports (customer PII, payment data)
• Email archives from executive mailboxes (Exchange access — see CVE-2023-21529)
• Source code repositories and build systems (technology-sector victims)
• Research data and student records (education-sector victims)
• Cyber insurance policies and financial statements (used to calibrate ransom demands)

Containment Actions — Ordered by Urgency

1. Isolate, don't power off. Network-quarantine affected hosts to preserve memory artifacts and volatile evidence.
2. Disable compromised accounts domain-wide — force password resets for any account seen in lateral movement telemetry; revoke active sessions/tokens.
3. Block egress to known exfil destinations — MEGA, anonymous S3, Rclone-friendly endpoints at the proxy/firewall.
4. Kill unauthorized RMM. Uninstall or disable ScreenConnect/AnyDesk/TeamViewer instances not in your approved inventory; block RMM binaries via AppLocker/WDAC.
5. Snapshot/backup critical servers immediately to offline or immutable storage before encryption can reach them.
6. Verify backup integrity and isolation — SHADOWBYT3$ affiliates hunt connected backup infrastructure during staging.
7. Engage IR retainer and notify counsel — preserve negotiation screenshots and leak site posts as evidence; assess regulatory notification obligations (GDPR for GB victims, Indonesian PDP Law for ID).

Hardening Recommendations

Immediate (24 Hours)

• Patch the KEV set: CVE-2026-50751 (Check Point), CVE-2024-1708 (ScreenConnect), CVE-2026-48027 (Nx Console), CVE-2023-21529 (Exchange), CVE-2025-60710 (Windows). These are confirmed ransomware-used vulnerabilities — treat as emergency change.
• Audit all RMM tooling. Remove unapproved instances; restrict approved tools to named admin accounts with MFA.
• Enforce MFA on all remote access — VPN, RDP gateways, and especially Check Point/edge admin interfaces.
• Disable or restrict RDP from the internet. If business-required, place behind VPN with NLA enabled and lockout policies tuned.
• Enable Protected Volume Shadow Copies and alert on any deletion/resize events (deploy the Sigma rule above).
• Block execution of Rclone/MEGA/7z outside approved use cases via AppLocker or WDAC.

Short-Term (2 Weeks)

• Segment aggressively. Isolate server VLANs from workstation egress; restrict SMB/RPC lateral paths between workstation subnets. The PsExec/WMI movement pattern dies in a segmented network.
• Deploy the Sigma and KQL detections above into your SIEM and validate with purple-team simulation of the staging chain.
• Immutable/offline backups with tested restore procedures — assume online backups will be targeted.
• EGRESS filtering on server subnets: block unsanctioned cloud storage and limit outbound to documented business destinations.
• Attack surface reduction: external scan for exposed Check Point, Exchange, RDP, and RMM listeners; remediate or compensate within the window.
• EDR tamper protection enabled everywhere; alert on sensor service stops and exclusion changes.
• Education & agriculture sector note: If you operate in these verticals in GB or ID, assume elevated targeting this week — brief your SOC, tighten change control on remote access, and run the triage script domain-wide now.

Security Arsenal continues to monitor the SHADOWBYT3$ leak site and affiliated broker chatter. This briefing will be updated if posting cadence or victimology shifts materially.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub