ByteToBreach

ByteToBreach is a financially motivated cybercriminal actor active since at least June 2025, associated with Algeria. It operates as a data thief, stolen-data trader, and initial access broker, targeting organizations internationally. Its victimology includes banks and other financial institutions, telecommunications providers, airlines, universities, healthcare organizations, and government agencies. Associated personas include the former pseudonyms CvHNWwEG and inesslopez; the actor has also marketed its activities under the branding Pentesting Ltd. ByteToBreach gains access through exploitation of known vulnerabilities in internet-facing enterprise and cloud systems, reuse of credentials obtained through infostealers and phishing, brute-force attacks, and security misconfigurations. Its post-compromise activity emphasizes extracting databases, backups, employee records, source code, and sensitive internal documents. It monetizes stolen information and access through underground forums and uses public releases, victim-shaming pages, and multiple communications platforms to promote its activity and pressure victims. Some associated datasets have been corroborated by affected organizations or contain verifiable technical artifacts. The actor uses ByteToCrypt, a custom Linux ransomware family deployed in environments including VMware ESXi. ByteToCrypt is a generic recursive file encryptor rather than a hypervisor-specific tool. It combines per-file AES-256-CBC encryption with RSA-4096 key wrapping and executes anti-forensic commands intended to disable auditing and remove logs and shell histories. Implementation flaws can cause incomplete encryption or irreversible data loss. ByteToBreach has been linked to the July 2026 attack on Romania's National Agency for Cadastre and Land Registration, which substantially disrupted public services, and claimed responsibility for the confirmed Eurofiber France data breach. The scope of individual theft and ransomware claims is not uniformly verified.