ShinyHunters
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups,…
- ATT&CK ID
- G1057
- Techniques
- 39
- Tools
- 1
Also tracked as UNC6240 · Bling Libra
Vulnerabilities it has exploited
Techniques
Reconnaissance
Gather Victim Identity InformationSearch Open Websites/DomainsActive ScanningPhishing for Information
Resource Development
Acquire InfrastructureEstablish AccountsDevelop CapabilitiesObtain Capabilities
Initial Access
Valid AccountsExploit Public-Facing ApplicationSupply Chain Compromise
Execution
Command and Scripting InterpreterSoftware Deployment ToolsExploitation for Client Execution
Persistence
Privilege Escalation
Stealth
MasqueradingValid AccountsSocial Engineering
Credential Access
Brute ForceSteal Application Access TokenUnsecured Credentials
Discovery
System Network Configuration DiscoveryRemote System DiscoveryPermission Groups DiscoverySystem Information DiscoveryFile and Directory DiscoveryCloud Infrastructure DiscoveryCloud Storage Object Discovery
Lateral Movement
Software Deployment ToolsExploitation of Remote ServicesUse Alternate Authentication Material
Collection
Data from Information RepositoriesData from Cloud StorageArchive Collected Data
Command and Control
ProxyIngress Tool TransferRemote Access ToolsEncrypted Channel
Exfiltration
Impact
Data DestructionDefacementFinancial Theft
Software
Tor