ShinyHuntersThreat actor
- bling libra
- unc6240
ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain. The group is known for its sophisticated attacks against a wide range of targets, including businesses, organizations, and government agencies.From MISP Galaxy
Last reported yesterday, by SecurityWeek133 reports
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1684Social Engineering
“Combined with the contact information listed there, this information could be sold or used to conduct additional, more convincing social engineering attacks.”
- T1053.005Scheduled Task
“It is also critical to watch for suspicious scheduled tasks and unauthorized changes to the Windows Startup folder, which this group uses for persistence.”
- T1552.004Private Keys
“…Mudhra certs: Mozilla has removed the eMuhdra root certificate from Firefox after eight of the company's intermediary certs had their private keys compromised.”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1110.004Credential Stuffing
“…omino's Pizza cred-stuffing attack: Domino's Pizza is contacting users and urging them to change their password after suffering a credential-stuffing attack that compromised their accounts this month.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
133 reports · the newest 20, newest first · the exact sentence from each-
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware“Seized ShinyHunters chats put ransom negotiators under scrutiny”
-
Capcom data breach exposes 11.7 million account records“…is year, with Rockstar Games, the developer of Grand Theft Auto and Red Dead Redemption, confirming an attack in April claimed by the ShinyHunters group.”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“Second ransomware negotiator linked to ShinyHunters: The FBI is investigating a second ransomware negotiator who might have helped the ShinyHunters hacking group extort victims.”
-
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site“Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site”
-
Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion“Mandiant’s reporting on recent GOLD CRYSTAL (ShinyHunters) linked and adjacent SaaS extortion activity has described this exact operational shift, where vishing and credential harvesting are used to obtain SSO access and then fan out into cloud applications for reconnaissance and…”
-
Attack on BAE-managed system disrupts US bankruptcy courts“ShinyHunters' attack on the FBI in September is doubtless the most high-profile of these, although the Arizona Judicial Branch confirmed an attack on the state’s court systems at around the same time.”
-
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation“While the FBI did not publicly announce Dubrovsky’s arrest, the case appears to align with actions taken in the wake of the ShinyHunters’ attack on the FBI’s IT systems, which exposed personal data about thousands of bureau employees.”
-
Srsly Risky Biz: Russia's Digital Detox Boomerang“In our last "Between Two Nerds" discussion Tom Uren and The Grugq examine how ShinyHunters and the FBI both deceived themselves into believing they were immune to cyber threats.”
-
Phase Eight, Hobbs and Whistles owner joins growing list of fashion retailers targeted by hackers“H&M Group is also investigating claims that it was targeted by the cybercriminal group ShinyHunters.”
-
Ransomware gets personal: 'We-know-where-you-are kind of stuff'““I've seen Scattered Spider, I've seen ShinyHunters, I've seen Lapsus$.” For what it's worth, ShinyHunters claimed in an exclusive interview with The Register that they “don't attack human beings.” They did, however, admit that “there are times in the work we do sometimes we have…”
-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“In this edition of Between Two Nerds, Tom Uren and The Grugq examine how ShinyHunters and the FBI both deceived themselves into believing they were immune to cyber threats.”
-
ShinyHunters: Six Years of Cybercrime — Expert Analysis and Ransomware Group Perspectives“ShinyHunters: Six Years of Cybercrime — Expert Analysis and Ransomware Group Perspectives”
-
Owner of fashion brands Hobbs and Whistles joins autumn pwned collection“Meanwhile, H&M is reportedly investigating claims that it was targeted by the notorious ShinyHunters cybercrime group.”
-
ShinyHunters arrest number three: a Canadian ransomware negotiator“ShinyHunters arrest number three: a Canadian ransomware negotiator”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More”
-
Introducing Sekoia Digital Risk: Track Identity-Led Breaches“Our own Threat Detection & Research team has since traced the full arc of the group behind it, from the Snowflake intrusions to the ShinyHunters extortion operation that followed.”
-
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe“Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe”
-
Imagine there's no Shiny Hunters – AI could make human hacking crews obsolete“KETTLE The FBI has announced what appears to be a third arrest in the ShinyHunters investigation, following the group's breach of Bureau systems, even as AI advances potentially leave human hackers on borrowed time.”
-
Net Closes Around ShinyHunters with Another FBI Arrest“Net Closes Around ShinyHunters with Another FBI Arrest”
-
September 2026 Threat Trend Report on Ransomware“CL0P revealed new DLS and onion domains after ShinyHunters compromised an existing DLS, and posted General Electric Company, Harley-Davidson, and TriStar Digital Thread Solutions in the US as Attack Targets.”
Indicators in its reports
named in the reports above- fbijobs[.]govin 2 reports
- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- fed979f93bcaf4e7…c50ce509ad2fin 1 report
- 207d9d891ac756b2bfad88aba5682c65in 1 report
- w32.fed979f93b-95.sbx[.]tgin 1 report
- infosec[.]exchangein 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.