ShinyHunters
UNC6240Bling Libra
ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain. The group is known for its sophisticated attacks against a wide range of targets, including businesses, organizations, and government agencies. ShinyHunters typically uses phishing attacks and exploit kits to gain access to victim networks, where they deploy malware to steal sensitive data, such as… Source: MISP
Activity on Jábega · 12 weeks
10 stories · first seen on 21 Sep 2026 · last seen on 29 Sep 2026
News
- FBI tells ShinyHunters members to turn themselves in after recent arrestBleepingComputer · 29 Sep 2026
- Dutch Police Arrest Convicted Hacker in ShinyHunters InvestigationSecurityWeek · 29 Sep 2026
- Dutch police confirm arrest in ShinyHunters hacking investigationBleepingComputer · 28 Sep 2026
- ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warnsThe Record · 28 Sep 2026
- Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationKrebsOnSecurity · 28 Sep 2026
- Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft CampaignSecurityWeek · 28 Sep 2026
- ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacksBleepingComputer · 26 Sep 2026
- ShinyHunters hacked Clop leak site using Grav CMS path traversal flawBleepingComputer · 25 Sep 2026
- What We Missed: Google Gemini Joins the AI Escape PartyDark Reading · 25 Sep 2026
- ShinyHunters Hacked Cl0p. Now What About Cl0p's Victims?Dark Reading · 21 Sep 2026
Appears alongside
MITRE ATT&CK techniques
Reconnaissance
T1589.001CredentialsT1593.003Code Repositories 2 Sigma rulesT1595.002Vulnerability Scanning 1 Sigma rulesT1598Phishing for InformationT1598.003Spearphishing Link
Resource Development
T1583.001DomainsT1583.004ServerT1585.002Email AccountsT1587.004ExploitsT1588.002Tool 7 Sigma rulesT1588.007Artificial Intelligence
Initial Access
T1078Valid Accounts 82 Sigma rulesT1078.002Domain Accounts 3 Sigma rulesT1078.004Cloud Accounts 35 Sigma rulesT1190Exploit Public-Facing Application 40 Sigma rulesT1195.001Compromise Software Dependencies and Development Tools 2 Sigma rules
Execution
T1059.007JavaScript 26 Sigma rulesT1059.009Cloud API 3 Sigma rulesT1072Software Deployment Tools 4 Sigma rulesT1203Exploitation for Client Execution 31 Sigma rules
Credential Access
T1110Brute Force 21 Sigma rulesT1528Steal Application Access Token 13 Sigma rulesT1552.001Credentials In Files 20 Sigma rules
Discovery
T1016System Network Configuration Discovery 4 Sigma rulesT1018Remote System Discovery 9 Sigma rulesT1069.003Cloud GroupsT1082System Information Discovery 18 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1580Cloud Infrastructure DiscoveryT1619Cloud Storage Object Discovery
Lateral Movement
T1210Exploitation of Remote Services 14 Sigma rulesT1550.001Application Access Token 2 Sigma rules
Collection
T1213.003Code Repositories 4 Sigma rulesT1213.006DatabasesT1530Data from Cloud StorageT1560.002Archive via Library
Command and Control
T1090.003Multi-hop Proxy 3 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1219Remote Access Tools 46 Sigma rulesT1573.002Asymmetric Cryptography
Exfiltration
Impact
T1485Data Destruction 15 Sigma rulesT1491.001Internal Defacement 3 Sigma rulesT1657Financial Theft
Stealth
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗