RansomwareG1057

ShinyHunters

Also known as: Bling Libra, UNC6240

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity78

Impact: Critical

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 46

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Credentials Code Repositories Vulnerability Scanning Phishing for Information Spearphishing Link

Resource development

Domains Server Email Accounts Exploits Tool Artificial Intelligence

Initial access

Exploit Public-Facing Application Compromise Software Dependencies and Development Tools

Execution

JavaScript Cloud API Software Deployment Tools Exploitation for Client Execution

Credential access

Brute Force Steal Application Access Token Credentials In Files

Discovery

System Network Configuration Discovery Remote System Discovery Cloud Groups System Information Discovery File and Directory Discovery Cloud Infrastructure Discovery Cloud Storage Object Discovery

Lateral movement

Exploitation of Remote Services Application Access Token

Collection

Code Repositories Databases Data from Cloud Storage Archive via Library

Command and control

Multi-hop Proxy Ingress Tool Transfer Remote Access Tools Asymmetric Cryptography

Exfiltration

Exfiltration Over Web Service

Impact

Data Destruction Internal Defacement Financial Theft

stealth

Match Legitimate Resource Name or Location Valid Accounts Domain Accounts Cloud Accounts Social Engineering

Exploited vulnerabilities 7

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2026-72898CRITICALEPSS 99%KEV Vexday

CVE-2026-35273CRITICALEPSS 97%KEV MITRE ATT&CK

CVE-2026-33634CRITICALEPSS 60%KEV Vexday

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-0176EPSS 46% MITRE ATT&CK

CVE-2026-35273CRITICALEPSS 97%KEV Vexday

References

ShinyHunters uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →