ShadowByt3s
ShadowByt3s is a threat actor associated in the provided content with alleged data theft and extortion operations focused on misconfigured cloud storage, particularly Amazon S3 buckets and Azure Blob storage. The actor is also styled as ShadowByt3S, and in one reported case activity was posted under the persona BlackVortex1. The content links ShadowByt3s to a broader effort branded as "Campaign Operation Cloud." In the provided reporting, ShadowByt3s claimed responsibility for an alleged breach of Starbucks by compromising a misconfigured S3 bucket named "sbux-assets" and exfiltrating approximately 10 GB of proprietary source code, firmware, internal management tools, inventory systems, and operational technology related to Starbucks beverage equipment. Reported exposed assets included beverage dispenser firmware, Siren System and Blue Sparq controller components, Mastrena II espresso machine software, FreshBlends assets, a "New Web UI" for machine management, and an inventory portal identified as "b4-inv." The actor allegedly set an extortion deadline and threatened public release of the data if payment was not made. The content also states that on 2026-04-17 ShadowByt3s claimed a breach involving the Ellucian PowerCampus education platform through misconfigured Amazon S3 buckets and Azure Blob storage operated by Neoskool, an Indian managed service provider. According to the reporting, the incident affected more than eight educational institutions in Manipur and Meghalaya, India, and exposed sensitive student and staff data including Aadhaar numbers, plaintext passwords, photos, medical alerts, fee records, marksheets, certificates, schedules, staff contact details, manifest and configuration files, and daily automated database export ZIP files. The actor reportedly stated it was extorting Ellucian PowerCampus rather than the individual schools, claimed possession of AWS canary files indicating write and delete access to cloud storage, and posted samples on leak sites on both the clearnet and Tor. Across the provided content, ShadowByt3s is described as actively scanning for and exploiting cloud misconfigurations, conducting data theft from cloud storage and information repositories, using extortion, and distributing or advertising stolen data via dark web forums, clearnet and Tor leak sites, Mega.nz, and Telegram. The actor is also described as recruiting insiders and offering a 30/70 revenue split. No nation-state attribution is stated in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Academia & Research
- Software & Services
Where they target
Geographies tied to known operations.
- 🇮🇳 India
- 🇺🇸 United States
Tradecraft
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting data theft and extortion operations against the education sector by exploiting misconfigured cloud storage tied to Ellucian PowerCampus and Neoskool, stealing sensitive student and staff data, publishing samples on leak sites, and recruiting insiders for revenue-sharing.
Conducting data theft and extortion operations against the education sector by exploiting misconfigured cloud storage tied to Ellucian PowerCampus and Neoskool, exposing sensitive student and staff data from multiple schools in North-East India while extorting the U.S.-based platform provider and recruiting insiders.
Claimed responsibility for an alleged cyberattack on Starbucks involving theft of proprietary source code and operational firmware, followed by extortion and threats to leak the data publicly.
Conducting a data theft and extortion campaign targeting misconfigured cloud assets, including the alleged compromise of Starbucks' S3 bucket to steal source code, firmware, and internal management tools, while threatening public leakage and recruiting insiders for revenue-sharing.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.