Loading threat actor…
BYOD is a ransomware and data-extortion group associated with attacks against organizations in the United States and Malaysia. Its identified targets include Trump Mobile, Standpointe / Trinite Solutions, Franklin Empire, and Royal Selangor, spanning telecommunications, professional services, and manufacturing. No geographic origin or state affiliation has been established. BYOD uses a dark-web leak site to publicize victims and expose personal and business information. Its extortion messages threaten publication of stolen data and offer removal of victim listings after contact is established. Personal information attributed to Trump Mobile customers was published, and several affected individuals confirmed the accuracy of their listed details. The group's operations emphasize data exposure as leverage, but system encryption has not been confirmed in these incidents. Its initial-access methods, malware tooling, and claims of continued access remain unverified.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BYOD claimed it breached Trump Mobile by infecting an employee at Florida-based Liberty Mobile with malware. The group published a file reportedly containing 3,615 personal and order records and claimed continued access to Trump Mobile’s backend dashboard. Some records were independently corroborated, but the infection method, access path, ongoing access, and any ransomware encryption remain unconfirmed.
Reportedly conducted a ransomware attack against US-based professional-services organization Standpointe / Trinite Solutions. The breach is dated October 4, 2026, and was discovered October 5, 2026. The incident summary claims exposure of financial statements, tenant documents, customer banking and contact information, employee identities, tax records, and commercial secrets. It directs the victim to establish contact with the group.
Reportedly attacked Franklin Empire in an incident dated October 4, 2026, and discovered October 5, 2026. BYOD claims to possess over 700 GB of data, including customer PII, business documents, AWS keys, AI API keys, and SMTP credentials, and threatens publication unless the victim establishes contact. The supplied content does not independently verify these claims or identify a ransomware payload.
The report attributes a ransomware attack against Malaysian manufacturer Royal Selangor to BYOD. The accompanying claim says registered-user and customer data were affected, comprising approximately 300,000 lines containing names, emails, phone numbers, addresses, purchase amounts, and payment methods. The attackers pressure the victim to establish contact by threatening disclosure and offering to remove the victim's listing once communication begins. The reported breach date is October 4, 2026; discovery was October 5, 2026. The content provides no independent verification of the claimed data volume.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.