ShinyHuntersHACK-SHINYHUNTERS criminal

About this actor

A data-theft extortion crew. ATT&CK dates it to "at least 2019", operating under the ShinyCorp persona, and assigns G1057 with associated groups UNC6240 and Bling Libra; our ATT&CK corpus predates that id. Google/Mandiant splits the activity across clusters — UNC6040 intrudes, UNC6240 extorts under the ShinyHunters name — and ATT&CK associates the group with "The Com", alongside Scattered Spider and LAPSUS$, while cautioning that the joint "Scattered Lapsus$ Hunters" operations are "reportedly conducted". THE NAME IS NOT A RELIABLE IDENTIFIER. GTIG assesses UNC6671 as an independent cluster that used the ShinyHunters name in at least one extortion attempt to make its threats more credible, and splits ShinyHunters-branded activity across several UNC clusters to account for evolving partnerships and possible impersonation. An extortion demand signed "ShinyHunters" is evidence of branding, not of this group. Three phases are documented. (1) Forum sales of stolen databases from 2020, including Tokopedia, followed by administration of BreachForums. (2) SaaS extortion without software exploitation: the 2025 Salesforce campaign used voice phishing to talk staff into authorising a malicious connected application — a modified Data Loader — so the access was OAuth-granted rather than exploited, and NO Salesforce CVE exists for it. (3) From 2026, mass exploitation of enterprise software. The PeopleSoft campaign is the best-documented. CVE-2026-35273 (CVSS 9.8, CWE-306, PeopleTools 8.61/8.62) was exploited as a zero-day from 2026-05-27, fourteen days before Oracle's out-of-band alert on 2026-06-10; CISA added it to KEV on 2026-06-12 with a three-day federal due date. Mandiant notified over 100 organisations, 68 per cent of them in higher education, and attributes the mechanism to Java deserialization in the PSEMHUB hub servlet — Oracle's own alert never states the class. A renewed wave in September 2026 reached technology, healthcare, agriculture, transportation and government, and defeated the published interim mitigation: operators told to block /PSEMHUB/ saw requests to /%50SEMHUB/ instead, where %50 is simply the percent-encoded "P". Mandiant's assessment is that the actor "adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch". Two details are worth carrying for this estate's own work. ATT&CK maps T1588.007 (Obtain Capabilities: Artificial Intelligence) to the group for using Bland AI "to create conversational pathways tailored to specific scenarios during voice phishing attacks" — an AI capability attached to a named actor by an authority, not inferred. And the ShinySp1d3r encryptor, though real and analysed in a Windows debug build, has NO DOCUMENTED ATTACK USE; Linux and ESXi builds are claimed and have never been seen. The group also attacks its own ecosystem. In September 2026 it defaced the Tor leak site of the Clop extortion crew via an unauthenticated path traversal in Grav CMS (CVE-2026-42608, CVSS 9.1, CWE-22), which Grav confirmed as a legitimate flaw whose 1.7 branch had no backport until after the breach. In January 2026 a disgruntled member leaked roughly 324,000 BreachForums user records. In September 2026 the group claimed a breach of the FBI's recruitment portal and demanded retraction of the FBI's 15 May 2026 IC3 public service announcement. THE CLAIMS AND THE CONFIRMATIONS DIVERGE SHARPLY HERE AND ARE SEPARATED IN `evidence`.

How we know this

See how actor data is built for the full pipeline.

Activity timeline

• 2026 — 2 CVE published, 1 KEV added

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

None.

Similar actors