Ransomware Group intelligence
BYOD
ActiveTrack BYOD with 16 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
BYOD is tracked by Breach House as a ransomware group with 16 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
16
- Leaked 9 56.2%
- Pending 7 43.8%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion |
Top Activity Sectors (5)
- null 2
- Retail / E-commerce 1
- Telecommunications 1
- IT 1
- Services 1
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue BYOD, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: BYOD executes malicious payloads through PowerShell scripts to stage ransomware components across victim systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: BYOD modifies Windows Registry Run keys to ensure ransomware execution upon system reboot.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: BYOD disables antivirus tools by terminating security processes and modifying Windows Defender policies.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: BYOD deletes Volume Shadow Copies and backup files via vssadmin commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1564.003 Hidden Window Stealth
What they do: BYOD hides malicious processes in hidden windows using stealth techniques to avoid detection.
What that means: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
-
T1083 File and Directory Discovery Discovery
What they do: BYOD uses file and directory discovery via PowerShell to enumerate user data and identify encryption targets.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1486 Data Encrypted for Impact Impact
What they do: BYOD encrypts victim files using custom symmetric encryption routines applied to discovered directories.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: BYOD inhibits system recovery by corrupting restore points and disabling backup service restoration.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (16)
Search, filter and paginate the victim timeline for BYOD. Showing 1–16 of 16.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Decorolala - 500 Line Sample id34947 View details | United States | Retail / E-commerce | leaked | ||
|
Decorolala - 500 Line Sample Canaidan based home essentials, 60,544 customers, Home addresses + ZIP Code, longitude + latitude, Phone Numbers, Emails, First Name, Last Name, UPS Tracking Number & URL (includes photos of outside house), Total Price at Checkout, Device Used at Checkout, Prodcut ID ordered, Time ordered, you get the idea as we go along. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. Reach out to us, first warning. Download NowUpdated on 2026-10-17 |
||||||
| Ransomware | Trump Mobile Wireless (Telecom) id33901 View details | — | Telecommunications | leaked | ||
|
Trump Mobile Wireless (Telecom) Trump mobile was informed they had been breached, they then replied with "We have no team to handle this" and that anyone who hacks them are a terrorist. Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs. Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you. Download Now Updated on 2026-09-29 | SIZE: 755KB × Trump Mobile Wireless (Telecom) Download Mirror #1 - Password: BYOD |
||||||
| Ransomware | Eteam id33900 View details | United States | IT | leaked | ||
|
Eteam Eteam was informed they had been breached, just ignored us, we are not giving any more chances, Enjoy their full BPO list EXTREME PII (some of the most sensitive shit any company has). Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you. Download Now Updated on 2026-09-29 | SIZE: 8.75MB × Eteam Download Mirror #1 - Password: BYOD |
||||||
| Ransomware | Royal Selangor id33899 View details | Malaysia | Services | leaked | ||
|
Royal Selangor Both, your Registered Users & Customer list have been affected. 300K Lines Total, Includes: Names, Emails, Phone Numbers, Addresses, Purchase Amount, Payment Method, Pretty Juicy stuff. Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you. Download Now Updated on 2026-10-04 | SIZE: 126MB × Royal Selangor Download Mirror #1 - Password: BYOD |
||||||
| Ransomware | TMobile id33898 View details | United States | — | pending | ||
|
TMobile You're in big big trouble, oh no, what will you ever do in this situation? Well, we think you should get in touch with BYOD. We won't display what we have for the public to see, just yet, we'll give you the chance. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. PSA Updated on 2026-10-07 |
||||||
| Ransomware | Gate | Crypto Exchange id33897 View details | United States | — | pending | ||
|
Gate | Crypto Exchange 12 Million Users, Phone numbers, Nicknames, Balance/VIP Tier List, 2FA Indicator (differentiates, Passkey/Auth) Region, UIDs, Gender, Position, AUM, Profit Rates, Verification Status, City, Strategy, Account Age, Profile Key, and SO much more. This is terrible, for you guys of course, we wonder what will happen if this ever gets out onto the corners of the internet it shouldn't. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. PSA Updated on 2026-10-07 |
||||||
| Ransomware | Decorolala id33896 View details | — | — | pending | ||
|
Decorolala Canaidan based home essentials, 60,544 customers, Home addresses + ZIP Code, longitude + latitude, Phone Numbers, Emails, First Name, Last Name, UPS Tracking Number & URL (includes photos of outside house), Total Price at Checkout, Device Used at Checkout, Prodcut ID ordered, Time ordered, you get the idea as we go along. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. PSA Updated on 2026-10-13 |
||||||
| Ransomware | Decorolala id33804 View details | — | — | — | leaked | |
|
Canaidan based home essentials, 60,544 customers, Home addresses + ZIP Code, longitude + latitude, Phone Numbers, Emails, First Name, Last Name, UPS Tracking Number & URL (includes photos of outside house), Total Price at Checkout, Device Used at Checkout, Prodcut ID ordered, Time ordered, you get the idea as we go along. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. |
||||||
| Ransomware | Some semi-samples Of Liberty X TMO cause we got yappatrons on twitter id33567 View details | — | — | — | leaked | |
|
Lmao. Amusing tweet. However, nobody cares about Trump Mobile anymore, but you're mistaken if you think that is all we have or if they didn't get breached, or if that's what we were talking about. Sneak peek we guess, Knock yourself out. |
||||||
| Ransomware | TMobile id33549 View details | United States | — | — | pending | |
|
You're in big big trouble, oh no, what will you ever do in this situation? Well, we think you should get in touch with BYOD. We won't display what we have for the public to see, just yet, we'll give you the chance. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. |
||||||
| Ransomware | Gate | Crypto Exchange id33550 View details | Singapore | — | — | pending | |
|
12 Million Users, Phone numbers, Nicknames, Balance/VIP Tier List, 2FA Indicator (differentiates, Passkey/Auth) Region, UIDs, Gender, Position, AUM, Profit Rates, Verification Status, City, Strategy, Account Age, Profile Key, and SO much more. This is terrible, for you guys of course, we wonder what will happen if this ever gets out onto the corners of the internet it shouldn't. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. |
||||||
| Ransomware | Standpointe / Trinite Solutions id33495 View details | — | null | — | pending | |
|
Finished Financial Statements, Tenant documents & files, Customer Bank Accounts, Deposit Slips, Payment/Cheque Registers, Tax & Accounting Records, Customer Information (Names, Phones, Emails, Addresses, Provinces), Employee Identities, Commercial Secrets. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. |
||||||
| Ransomware | Franklin Empire id33469 View details | — | null | — | pending | |
|
You know we have over 700GB of Data, AWS Keys to your buckets, (which we dumped), Moonshot AI API keys, SMTP credentials, Packaging Slips, invoices, PDFs, Business Information, Customer PII, Inventory stash and SO much more. Your team knows how serious the breach is, hence why everything got rotated FAST, you also know how bad it can get if it gets posted in every corner of the dark web, Either reach out to us using the Contact methods listed on our site or face the consequences. Make the right decision, it's only you who can save yourselves. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. |
||||||
| Ransomware | Trump Mobile Wireless (Telecom) id33459 View details | United States | Telecommunications | — | leaked | |
|
Trump mobile was informed they had been breached, they then replied with "We have no team to handle this" and that anyone who hacks them are a terrorist. Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs. Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you. |
||||||
| Ransomware | Eteam id33460 View details | United States | IT | — | leaked | |
|
Eteam was informed they had been breached, just ignored us, we are not giving any more chances, Enjoy their full BPO list EXTREME PII (some of the most sensitive shit any company has). Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you. |
||||||
| Ransomware | Royal Selangor id33461 View details | Malaysia | Services | — | leaked | |
|
Both, your Registered Users & Customer list have been affected. 300K Lines Total, Includes: Names, Emails, Phone Numbers, Addresses, Purchase Amount, Payment Method, Pretty Juicy stuff you don't want getting out there. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. |
||||||