G1057: ShinyHunters
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”[1][2][3][4][5][6][7][8]
Security context for executives and security teams
G1057: ShinyHunters describes [ShinyHunters](https://attack.mitre.org/groups/G1057) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. [ShinyHunters](https://attack.mitre.org/groups/G1057) has been associated with the broader collective called The Community, also k...
Executive priority
G1057: ShinyHunters is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G1057: ShinyHunters by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G1057: ShinyHunters appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
ShinyHunters
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”[1][2][3][4][5][6][7][8]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1560.002 | Archive via LibrarySub-technique | ShinyHunters has used the following command to compress collected data: ` pv -s "$(du -sb exfil | awk '{print $1}')" | zstd -3 -T0 -o exfil.tar.zst `.[6] |
| Enterprise | T1550.001 | Application Access TokenSub-technique | ShinyHunters has used stolen OAuth keys to access cloud infrastructure and to bypass two-factor authentication.[4] |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | ShinyHunters has established a connection between the staging host and the C2 using SSH.[6] |
| Enterprise | T1585.002 | Email AccountsSub-technique | ShinyHunters has established multiple email accounts, such as shinycorp@tutonota[.]com, for use in extortion activities.[8][3] |
| Enterprise | T1082 | System Information Discovery | ShinyHunters has used the MeshCentral command-line utility meshctrl.js to collect hostnames and IDs of compromised systems.[6] |
| Enterprise | T1105 | Ingress Tool Transfer | ShinyHunters has deployed custom scripts to targeted systems from customized MeshAgents in their staging environment.[6] |
| Enterprise | T1190 | Exploit Public-Facing Application | ShinyHunters has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure.[6] ShinyHunters has exploited known vulnerabilities in internet-facing servers.[1] |
| Enterprise | T1530 | Data from Cloud Storage | ShinyHunters has collected data from insecure cloud buckets.[2] |
| Enterprise | T1059.007 | JavaScriptSub-technique | ShinyHunters has used the MeshCentral command-line interface utility meshctrl.js and npm to interact with compromised systems. Specifically for npm, ShinyHunters has checked for the authenticode tool using the command `npm list global authenticode`.[6] Additionally, ShinyHunters has used the MeshCentral command to execute the propagation script: ` node meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh' `.[6] |
| Enterprise | T1078 | Valid Accounts | ShinyHunters has used valid high-privileged SSO users as leverage during negotiations.[1] |
| Enterprise | T1567 | Exfiltration Over Web Service | ShinyHunters has used compromised Salesforce CRM (Customer Relationship Management) dashboards to exfiltrate bulk data. Additionally, ShinyHunters has used LimeWire, a file-sharing service, to showcase samples of stolen data.[1] |
| Enterprise | T1598.003 | Spearphishing LinkSub-technique | ShinyHunters has used spearphishing emails with malicious links to gain initial access and credentials.[2] |
| Enterprise | T1203 | Exploitation for Client Execution | ShinyHunters has exploited vulnerabilities in the target company’s GitHub repository source code to enable more complex follow-on third-party or supply chain attacks.[4] |
| Enterprise | T1528 | Steal Application Access Token | ShinyHunters has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository.[4] Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.[2] |
| Enterprise | T1083 | File and Directory Discovery | ShinyHunters has checked mount points for Oracle PeopleSoft configurations and has checked the process scheduler configuration file psappsrv.cfg. Additionally, ShinyHunters has read WebLogic server XML configurations files (config.xml).[6] |
| Enterprise | T1588.002 | ToolSub-technique | ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints.[6] ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations.[3] ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.[1] |
| Enterprise | T1213.003 | Code RepositoriesSub-technique | ShinyHunters has gathered information from and has searched for vulnerabilities in the target company’s GitHub repository source code.[4] |
| Enterprise | T1684 | Social Engineering | ShinyHunters has used social engineering to demand payment from victims.[5] |
| Enterprise | T1552.001 | Credentials In FilesSub-technique | ShinyHunters has gathered PII from database infrastructure.[4] |
| Enterprise | T1078.004 | Cloud AccountsSub-technique | ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments.[2] Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.[3][4] |
| Enterprise | T1078.002 | Domain AccountsSub-technique | ShinyHunters has used valid domain accounts to gain initial access or to escalate privileges within environments.[2] |
| Enterprise | T1016 | System Network Configuration Discovery | ShinyHunters has collected machine names and IP addresses by parsing the process scheduler configuration file psappsrv.cfg.[6] |
| Enterprise | T1491.001 | Internal DefacementSub-technique | ShinyHunters has left ransom notes titled README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.[6] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | ShinyHunters has disguised MeshCentral agent binaries as Microsoft Azure services, e.g. meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, and meshagent64-v2.exe.[6] |
| Enterprise | T1219 | Remote Access Tools | ShinyHunters has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.[6][1] |
| Enterprise | T1598 | Phishing for Information | ShinyHunters has sent phishing emails to Microsoft Office 365 corporate users in order to steal credentials.[4] |
| Enterprise | T1195.001 | Compromise Software Dependencies and Development ToolsSub-technique | ShinyHunters has compromised CI/CD pipelines by gaining access to high privilege engineering accounts on Git version control, BrowserStack, JFrog and other cloud project management platforms.[1] |
| Enterprise | T1657 | Financial Theft | ShinyHunters has called or sent text messages or emails to employees of victim organizations to demand payment in Bitcoin within 72 hours. Email addresses used in extortion activities include shinycorp@tuta[.]com, shinygroup@tuta[.]com, shinycorp@tutanota[.]com, and shinygroup@onionmail[.]com.[8][7][5][4][3][2][1] |
| Enterprise | T1580 | Cloud Infrastructure Discovery | ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.[3][2] |
| Enterprise | T1018 | Remote System Discovery | ShinyHunters has enumerated the internal subnet using ` cat /etc/hosts | grep -E "[redacted_victim_string]"`.[6] |
| Enterprise | T1059.009 | Cloud APISub-technique | ShinyHunters has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as `ListBuckets`, `CreateBucket` and `DeleteBucket`.[3] |
| Enterprise | T1583.004 | ServerSub-technique | ShinyHunters has used five IP addresses to host Python SimpleHTTP servers on port 8888, which exposed staging materials, customized agents, and .bash_history files.[6] |
| Enterprise | T1072 | Software Deployment Tools | ShinyHunters has abused software deployment tools for lateral movement.[2] |
| Enterprise | T1588.007 | Artificial IntelligenceSub-technique | ShinyHunters has used Bland AI to create conversational pathways tailored to specific scenarios during voice phishing attacks.[1] |
| Enterprise | T1110 | Brute Force | ShinyHunters has performed brute force attacks against edge devices, such as VPNs or firewall solutions.[1] |
| Enterprise | T1213.006 | DatabasesSub-technique | ShinyHunters has collected Salesforce datasets from victims in the airline and retail sectors.[1] |
| Enterprise | T1589.001 | CredentialsSub-technique | ShinyHunters has collected credentials containing PII, ultimately selling the information on their DLS.[4][3] |
| Enterprise | T1593.003 | Code RepositoriesSub-technique | ShinyHunters has searched through target companies’ GitHub repositories for login credentials or API keys.[2] |
| Enterprise | T1583.001 | DomainsSub-technique | ShinyHunters has established clearnet and Tor data leak sites (DLS) including one named “SHINYHUNTERS” for the exfiltration and posting of stolen data.[7][5] Additionally, ShinyHunters has registered domains that mimic legitimate Microsoft Azure NetApp Files endpoints, such as azurenetfiles[.]net, and legitimate Okta SSO login pages, such as trial-6857053.okta[.]com.[6][1] |
| Enterprise | T1090.003 | Multi-hop ProxySub-technique | ShinyHunters has used Tor to host their DLS.[5] |
| Enterprise | T1587.004 | ExploitsSub-technique | ShinyHunters has exploited zero-day vulnerability CVE-2026-35273 against Oracle PeopleSoft application infrastructure.[6] |
| Enterprise | T1485 | Data Destruction | ShinyHunters has executed the `DeleteBucket` API call to delete buckets.[3] |
| Enterprise | T1619 | Cloud Storage Object Discovery | ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to access S3 objects.[3] |
| Enterprise | T1595.002 | Vulnerability ScanningSub-technique | ShinyHunters has searched through victim companies’ GitHub repositories for vulnerabilities.[2] |
| Enterprise | T1069.003 | Cloud GroupsSub-technique | ShinyHunters has executed API calls to enumerate permissions for compromised AWS accounts.[3] |
| Enterprise | T1210 | Exploitation of Remote Services | ShinyHunters has exploited vulnerabilities in remote services for lateral movement.[2] |
Groups, software, and campaigns
S0183: Tor
Tor is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routing information. Tor utilizes "Onion Routing," in which messages are encrypted with multiple layers of encryption; at each step in the proxy network, the topmost layer is decrypted and the contents forwarded on to the next node until it reaches its destination. [1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | 97bdc5a69263… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]ElecticIQ Buyukkaya_ShinyHunters_Sept2025
Büyükkaya, A. (2025, September 22). ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications. Retrieved May 18, 2026.
Open source URL - [2]SOCRadar_ShinyHunters_Mar2024
SOCRadar. (2024, March 18). Dark Web Profile: ShinyHunters. Retrieved May 18, 2026.
Open source URL - [3]Unit42KelleyVaya_BlingLibra_Aug2024
Kelley, M., Vaya, C. (2024, August 23). Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware. Retrieved May 18, 2026.
Open source URL - [4]Intel471_SH_Aug2021
Intel 471. (2021, August 23). Here’s how to guard your enterprise against ShinyHunters. Retrieved July 29, 2026.
Open source URL - [5]FBI_SHLMS_May2026
Federal Bureau of Investigation. (2026, May 15). ShinyHunters: Cyber Criminal Group Attacks Learning Management System. Retrieved July 1, 2026.
Open source URL - [6]Google_SHOracle_Jun2026
Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026.
Open source URL - [7]Mandiant_SHDataTheft_Jan2026
Mandiant. (2026, January 30). Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft. Retrieved June 16, 2026.
Open source URL - [8]Google Salesforce JUN 2025
Google Threat Intelligence Group. (2025, June 4). The Cost of a Call: From Voice Phishing to Data Extortion. Retrieved October 22, 2025.
Open source URL - [9]Bling Libra
(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)
- [10]UNC6240
(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: Google_SHOracle_Jun2026)
- [11]mitre-attackG1057Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.