← threat actors
threat actor · not yet in the cluster map
byod
2 stories · 1 in the wild · October 7, 2026 – November 4, 2026
evidence: 1 observed · 1 claimed
sectors
- education 1 · Nov 4
- government 1 · Nov 4
- retail 1 · Oct 7
geography
- brazil 1 · Nov 4
- colombia 1 · Nov 4
techniques
- credential access 1 · Nov 4
attack phases seen
- Collection 1 · Nov 4
- Initial access 1 · Nov 4
- Exfiltration 1 · Oct 7
what we reported, newest first, grouped by story
November 4, 2026
- Unverified leak-site claims worth tracking: a group calling itself "byod" listed IHG Hotels & Resorts, claiming guest folio records, employee PII, AWS keys, Active Directory and CyberArk access obtained through a weak LDAP bind password, with no confirmation from IHG (Daily Dark Web); a separate actor advertises 20,564,434 records attributed to Colombia's national learning service SENA (Daily Dark Web). Posts circulating today for Brazil's DETRAN and Russia's Pension Fund appear to be recirculated listings from earlier in 2026.
· Nov 4 · claimed · Breaches, Leaks & Policy
October 7, 2026
- BYOD, a new RaaS operation, leaked data on 3,615 Trump Mobile customers — names, emails, phone numbers, home addresses and order details, with several listed individuals confirming accuracy. Trump Mobile is only the third victim on the group's leak site (Straight Arrow News, The Register).
· Oct 7 · observed · Ransomware & Law Enforcement