# Syngenta Group subsidiary Cropwise hit by shadowbyt3$ ransomware

Published: 2026-06-02 · Severity: elevated · Sectors: manufacturing
Canonical: https://vorant.io/reports/80e028a0-3b8e-5b32-951e-b0d5efb91948/syngenta-group-subsidiary-cropwise-hit-by-shadowbyt3-ransomware

> Cropwise, a Syngenta Group subsidiary, has been claimed as a victim by shadowbyt3$ ransomware operators.

Cropwise, a digital agriculture platform owned by Syngenta Group, has been publicly claimed as a victim by the shadowbyt3$ ransomware operation. The claim appears on a ransomware leak site, indicating the attackers allege they have exfiltrated data from the organization. Syngenta Group is a major global agriculture company, making this targeting significant for the agricultural and food-production sectors. The article provides minimal technical detail beyond the victim claim and does not specify attack vectors, malware variants, or remediation specifics. Defenders in related sectors should monitor for any data leaks or additional disclosures from this threat actor.

## Mentioned in this report

- Threat actors: ShadowByt3$
- Malware: ShadowByt3$

Source reporting: https://www.ransomware.live/id/Q3JvcHdpc2UgKFN5bmdlbnRhIEdyb3VwKUBzaGFkb3dieXQzJA==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/80e028a0-3b8e-5b32-951e-b0d5efb91948/syngenta-group-subsidiary-cropwise-hit-by-shadowbyt3-ransomware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup