MITRE ATT&CKgroup
G1057 ShinyHunters
- Domain
- enterprise
- Aliases
- UNC6240, Bling Libra
- Version
- 1.0
- Created
- 2026-07-29
Description
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”
Related
Uses · MITRE ATT&CK (47)
- T1684 Social Engineering technique
- T1213.006 Databases sub-technique
- T1588.007 Artificial Intelligence sub-technique
- T1657 Financial Theft technique
- T1593.003 Code Repositories sub-technique
- T1059.009 Cloud API sub-technique
- T1619 Cloud Storage Object Discovery technique
- T1213.003 Code Repositories sub-technique
- T1589.001 Credentials sub-technique
- T1595.002 Vulnerability Scanning sub-technique
- T1598 Phishing for Information technique
- T1598.003 Spearphishing Link sub-technique
- T1583.004 Server sub-technique
- T1585.002 Email Accounts sub-technique
- T1587.004 Exploits sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1580 Cloud Infrastructure Discovery technique
- T1059.007 JavaScript sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1078.002 Domain Accounts sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1195.001 Compromise Software Dependencies and Development Tools sub-technique
- T1567 Exfiltration Over Web Service technique
- T1069.003 Cloud Groups sub-technique
- T1491.001 Internal Defacement sub-technique
- T1560.002 Archive via Library sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1552.001 Credentials In Files sub-technique
References
- https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications ElecticIQ Buyukkaya_ShinyHunters_Sept2025
- https://www.ic3.gov/PSA/2026/PSA260515 FBI_SHLMS_May2026
- https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion Google Salesforce JUN 2025
- https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack Intel471_SH_Aug2021
- https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/ Unit42KelleyVaya_BlingLibra_Aug2024
- https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit Google_SHOracle_Jun2026
- https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft Mandiant_SHDataTheft_Jan2026
- https://socradar.io/dark-web-profile-shinyhunters/ SOCRadar_ShinyHunters_Mar2024