Threat Actors shinyhunters

shinyhunters

G1057 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: UNC6240, Bling Libra

Description

ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members. Known victims: 102

Goals & Targeting

Objectives

Ransomware

Financial Gain

Targeted Sectors

Education

Targeted Countries / Regions

United States of America

Australia

United Kingdom of Great Britain and Northern Ireland

AI Analysis

· 1 week ago

Executive Summary

ShinyHunters is a medium-sophistication criminal cyber threat actor primarily motivated by financial gain through ransomware and extortion activities. They are known for targeting educational institutions and other sectors in the United States, Australia, and the United Kingdom since their first appearance in April 2024. The group operates with a focus on data theft and has expanded their operations to include a ransomware-as-a-service (RaaS) offering called 'shinysp1d3r.' ShinyHunters has been linked to numerous high-profile breaches across multiple industries, including education, finance, retail, and healthcare. Their activities demonstrate a clear intent to exploit vulnerabilities for financial profit and organizational gain.

Goals & Targeting

ShinyHunters' strategic objectives are driven by financial gain through ransomware and data extortion. Their targeting profile focuses on industries with large user bases and sensitive data, such as education, retail, finance, and healthcare. The group's preference for English-speaking countries (United States, Australia, United Kingdom) suggests a potential geographic focus tied to their operational base or language capabilities. ShinyHunters' victims include both small businesses and large enterprises, indicating an adaptive approach to campaign targeting. Their operations often involve high-profile campaigns that attract media attention and serve as a deterrence to other threat actors.

Enhanced Description

ShinyHunters is a financially motivated cybercriminal group that emerged in 2024, primarily targeting organizations across the education sector and other industries through data-theft and extortion campaigns. Initially known for their involvement in ticket sales fraud via malicious software such as 'Snowflake,' ShinyHunters has evolved into a prominent player in the ransomware landscape. By late 2025, they launched their RaaS offering, 'shinysp1d3r,' which enables affiliates to carry out ransomware attacks under their banner. This expansion underscores their strategic shift toward broader criminal operations. The group has demonstrated significant capability in compromising large enterprise systems, including educational platforms like Instructure (Canva LMS) and McGraw Hill, as well as financial institutions, retail chains, and government entities. ShinyHunters' activities are notable for their use of double extortion tactics—encrypting data and threatening to leak it if demands are not met. This approach has made them one of the most impactful criminal groups in the cyber threat landscape. The arrest of four members by French authorities in August 2025 indicates law enforcement efforts to disrupt their operations, though ShinyHunters remains active as of July 2026.

Key Capabilities

Ransomware implementation and deployment
Data exfiltration for extortion purposes
Use of ransomware-as-a-service (RaaS) model
Advanced phishing techniques with malicious email campaigns
Network penetration and exploitation
Credential harvesting and lateral movement within compromised networks

MITRE ATT&CK Tactics

Initial Access

Defense Evasion

Data Exfiltration

Impact

ATT&CK Techniques

T1059.003 - Spear-phishing via Email attachments, Malicious links

T1055 - Use of legitimate credentials

T1068.004 - Exfiltration over Encrypted Channels (e.g., HTTPS)

T1566.001 - Data Archiving as a Tool or Script for Data Exfiltration

T1539.002 - Use of Cloud Storage as C2 Infrastructure

Software / Tooling

ShinySp1d3r (Ransomware)

Cobalt Strike (for attack coordination)

Snowflake (earlier ticket sales fraud tool)

Malicious email campaigns with phishing payloads

Custom malware for data exfiltration

Campaigns & Victims

ShinyHunters' campaigns are characterized by their double extortion tactics and the use of high-pressure demands to ensure payment. Their victims include educational institutions, healthcare providers, financial services companies, and retail chains. Notable campaigns have targeted organizations such as Instructure (Canva LMS), McGraw Hill, and multiple schools affected by the 2024 breach. The group's operational tempo is steady but often shifts in response to law enforcement actions or public exposure. ShinyHunters has demonstrated a preference for encrypting data and using fear tactics to maximize their financial gain.

IOC Patterns

Spear-phishing emails with malicious attachments or links
Use of email domains such as 'tuta.io' or 'proton.me'
Encrypted communication channels via HTTP/S or cloud services
Exfiltration of sensitive data via compromised web services
Ransomware payloads delivered through exploit kits or remote access tools

Recommended Actions

Implement advanced email filtering to detect and block phishing campaigns.
Monitor for suspicious network traffic, especially encrypted communications.
Conduct regular backups and ensure they are stored offline.
Educate employees on spotting malicious emails and links.
Adopt multi-factor authentication (MFA) for critical systems.
Perform regular vulnerability assessments and penetration testing.

Suggested Tags

Ransomware

Extortion

Data Theft

Criminal Group

RaaS

Double Extortion

Confidence Assessment

Confidence in ShinyHunters' threat intelligence is high due to their extensive campaign activity, public reporting, and law enforcement actions. However, gaps exist regarding the group's exact geographic origin and the full extent of their operational infrastructure. Additionally, the evolution of their RaaS offering introduces new potential capabilities that may not yet be fully understood.

ATT&CK Techniques

Collection

4 techniques

T1213.003

Code Repositories

ShinyHunters has gathered information from and has searched for vulnerabilities in the target company’s GitHub repository source code.(Citation: Intel471_SH_Aug2021)

T1213.006

Databases

ShinyHunters has collected Salesforce datasets from victims in the airline and retail sectors.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

T1530

Data from Cloud Storage

ShinyHunters has collected data from insecure cloud buckets.(Citation: SOCRadar_ShinyHunters_Mar2024)

T1560.002

Archive via Library

ShinyHunters has used the following command to compress collected data: ` pv -s "$(du -sb exfil | awk '{print $1}')" | zstd -3 -T0 -o exfil.tar.zst `.(Citation: Google_SHOracle_Jun2026)

Command & Control

4 techniques

T1090.003

Multi-hop Proxy

ShinyHunters has used Tor to host their DLS.(Citation: FBI_SHLMS_May2026)

T1105

Ingress Tool Transfer

ShinyHunters has deployed custom scripts to targeted systems from customized MeshAgents in their staging environment.(Citation: Google_SHOracle_Jun2026)

T1219

Remote Access Tools

ShinyHunters has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.(Citation: Google_SHOracle_Jun2026)(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

T1573.002

Asymmetric Cryptography

ShinyHunters has established a connection between the staging host and the C2 using SSH.(Citation: Google_SHOracle_Jun2026)

Credential Access

3 techniques

T1110

Brute Force

ShinyHunters has performed brute force attacks against edge devices, such as VPNs or firewall solutions.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

T1528

Steal Application Access Token

ShinyHunters has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository.(Citation: Intel471_SH_Aug2021) Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.(Citation: SOCRadar_ShinyHunters_Mar2024)

T1552.001

Credentials In Files

ShinyHunters has gathered PII from database infrastructure.(Citation: Intel471_SH_Aug2021)

Discovery

7 techniques

T1016

System Network Configuration Discovery

ShinyHunters has collected machine names and IP addresses by parsing the process scheduler configuration file psappsrv.cfg.(Citation: Google_SHOracle_Jun2026)

T1018

Remote System Discovery

ShinyHunters has enumerated the internal subnet using ` cat /etc/hosts | grep -E "[redacted_victim_string]"`.(Citation: Google_SHOracle_Jun2026)

T1069.003

Cloud Groups

ShinyHunters has executed API calls to enumerate permissions for compromised AWS accounts.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)

T1082

System Information Discovery

ShinyHunters has used the MeshCentral command-line utility meshctrl.js to collect hostnames and IDs of compromised systems.(Citation: Google_SHOracle_Jun2026)

T1083

File and Directory Discovery

ShinyHunters has checked mount points for Oracle PeopleSoft configurations and has checked the process scheduler configuration file psappsrv.cfg. Additionally, ShinyHunters has read WebLogic server XML configurations files (config.xml).(Citation: Google_SHOracle_Jun2026)

T1580

Cloud Infrastructure Discovery

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: SOCRadar_ShinyHunters_Mar2024)

T1619

Cloud Storage Object Discovery

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to access S3 objects.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)

Execution

4 techniques

T1059.007

JavaScript

ShinyHunters has used the MeshCentral command-line interface utility meshctrl.js and npm to interact with compromised systems. Specifically for npm, ShinyHunters has checked for the authenticode tool using the command `npm list global authenticode`.(Citation: Google_SHOracle_Jun2026) Additionally, ShinyHunters has used the MeshCentral command to execute the propagation script: ` node meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh' `.(Citation: Google_SHOracle_Jun2026)

T1059.009

Cloud API

ShinyHunters has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as `ListBuckets`, `CreateBucket` and `DeleteBucket`.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)

T1072

Software Deployment Tools

ShinyHunters has abused software deployment tools for lateral movement.(Citation: SOCRadar_ShinyHunters_Mar2024)

T1203

Exploitation for Client Execution

ShinyHunters has exploited vulnerabilities in the target company’s GitHub repository source code to enable more complex follow-on third-party or supply chain attacks.(Citation: Intel471_SH_Aug2021)

Exfiltration

1 technique

T1567

Exfiltration Over Web Service

ShinyHunters has used compromised Salesforce CRM (Customer Relationship Management) dashboards to exfiltrate bulk data. Additionally, ShinyHunters has used LimeWire, a file-sharing service, to showcase samples of stolen data.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

Impact

3 techniques

T1485

Data Destruction

ShinyHunters has executed the `DeleteBucket` API call to delete buckets.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)

T1491.001

Internal Defacement

ShinyHunters has left ransom notes titled README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.(Citation: Google_SHOracle_Jun2026)

T1657

Financial Theft

ShinyHunters has called or sent text messages or emails to employees of victim organizations to demand payment in Bitcoin within 72 hours. Email addresses used in extortion activities include shinycorp@tuta[.]com, shinygroup@tuta[.]com, shinycorp@tutanota[.]com, and shinygroup@onionmail[.]com.(Citation: Google Salesforce JUN 2025)(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: FBI_SHLMS_May2026)(Citation: Intel471_SH_Aug2021)(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: SOCRadar_ShinyHunters_Mar2024)(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

Initial Access

2 techniques

T1190

Exploit Public-Facing Application

ShinyHunters has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure.(Citation: Google_SHOracle_Jun2026) ShinyHunters has exploited known vulnerabilities in internet-facing servers.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

T1195.001

Compromise Software Dependencies and Development Tools

ShinyHunters has compromised CI/CD pipelines by gaining access to high privilege engineering accounts on Git version control, BrowserStack, JFrog and other cloud project management platforms.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

Lateral Movement

2 techniques

T1210

Exploitation of Remote Services

ShinyHunters has exploited vulnerabilities in remote services for lateral movement.(Citation: SOCRadar_ShinyHunters_Mar2024)

T1550.001

Application Access Token

ShinyHunters has used stolen OAuth keys to access cloud infrastructure and to bypass two-factor authentication.(Citation: Intel471_SH_Aug2021)

Reconnaissance

5 techniques

T1589.001

Credentials

ShinyHunters has collected credentials containing PII, ultimately selling the information on their DLS.(Citation: Intel471_SH_Aug2021)(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)

T1593.003

Code Repositories

ShinyHunters has searched through target companies’ GitHub repositories for login credentials or API keys.(Citation: SOCRadar_ShinyHunters_Mar2024)

T1595.002

Vulnerability Scanning

ShinyHunters has searched through victim companies’ GitHub repositories for vulnerabilities.(Citation: SOCRadar_ShinyHunters_Mar2024)

T1598

Phishing for Information

ShinyHunters has sent phishing emails to Microsoft Office 365 corporate users in order to steal credentials.(Citation: Intel471_SH_Aug2021)

T1598.003

Spearphishing Link

ShinyHunters has used spearphishing emails with malicious links to gain initial access and credentials.(Citation: SOCRadar_ShinyHunters_Mar2024)

Resource Development

6 techniques

T1583.001

Domains

ShinyHunters has established clearnet and Tor data leak sites (DLS) including one named “SHINYHUNTERS” for the exfiltration and posting of stolen data.(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: FBI_SHLMS_May2026) Additionally, ShinyHunters has registered domains that mimic legitimate Microsoft Azure NetApp Files endpoints, such as azurenetfiles[.]net, and legitimate Okta SSO login pages, such as trial-6857053.okta[.]com.(Citation: Google_SHOracle_Jun2026)(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

T1583.004

Server

ShinyHunters has used five IP addresses to host Python SimpleHTTP servers on port 8888, which exposed staging materials, customized agents, and .bash_history files.(Citation: Google_SHOracle_Jun2026)

T1585.002

Email Accounts

ShinyHunters has established multiple email accounts, such as shinycorp@tutonota[.]com, for use in extortion activities.(Citation: Google Salesforce JUN 2025)(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)

T1587.004

Exploits

ShinyHunters has exploited zero-day vulnerability CVE-2026-35273 against Oracle PeopleSoft application infrastructure.(Citation: Google_SHOracle_Jun2026)

T1588.002

Tool

ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints.(Citation: Google_SHOracle_Jun2026) ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024) ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

T1588.007

Artificial Intelligence

ShinyHunters has used Bland AI to create conversational pathways tailored to specific scenarios during voice phishing attacks.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

Stealth

5 techniques

T1036.005

Match Legitimate Resource Name or Location

ShinyHunters has disguised MeshCentral agent binaries as Microsoft Azure services, e.g. meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, and meshagent64-v2.exe.(Citation: Google_SHOracle_Jun2026)

T1078

Valid Accounts

ShinyHunters has used valid high-privileged SSO users as leverage during negotiations.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)

T1078.002

Domain Accounts

ShinyHunters has used valid domain accounts to gain initial access or to escalate privileges within environments.(Citation: SOCRadar_ShinyHunters_Mar2024)

T1078.004

Cloud Accounts

ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments.(Citation: SOCRadar_ShinyHunters_Mar2024) Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: Intel471_SH_Aug2021)

T1684

Social Engineering

ShinyHunters has used social engineering to demand payment from victims.(Citation: FBI_SHLMS_May2026)

Software / Tooling

No tools linked yet.

Campaigns / Victims

All campaigns →

shinyhunters

Description

Goals & Targeting

AI Analysis

ATT&CK Techniques

Software / Tooling

Campaigns / Victims

Observed Data

Indicators of Compromise

References

Intel Summary

Tags

Details