Threat intelligence / Group

ShinyHunters

[ShinyHunters](https://attack.mitre.org/groups/G1057) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. [ShinyHunters](https://attack.mitre.org/groups/G1057) has been associated with the broader collective called The Community, also known as The Com whose members have also included [Scattered Spider](https://attack.mitre.org/groups/G1015) and [LAPSUS$](https://attack.mitre.org/groups/G1004). Public reporting has mentioned a variety of names for operations [ShinyHunters](https://attack.mitre.org/groups/G1057) members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)(Citation: SOCRadar_ShinyHunters_Mar2024)(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: Intel471_SH_Aug2021)(Citation: FBI_SHLMS_May2026)(Citation: Google_SHOracle_Jun2026)(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: Google Salesforce JUN 2025)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ShinyHunters](https://attack.mitre.org/groups/G1057) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. [ShinyHunters](https://attack.mitre.org/groups/G1057) has been associated with the broader collective called The Community, also known as The Com whose members have also included [Scattered Spider](https://attack.mitre.org/groups/G1015) and [LAPSUS$](https://attack.mitre.org/groups/G1004). Public reporting has mentioned a variety of names for operations [ShinyHunters](https://attack.mitre.org/groups/G1057) members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)(Citation: SOCRadar_ShinyHunters_Mar2024)(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: Intel471_SH_Aug2021)(Citation: FBI_SHLMS_May2026)(Citation: Google_SHOracle_Jun2026)(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: Google Salesforce JUN 2025)

47 recorded

Relationships

uses

to Application Access Token

Technique

uses

to Archive via Library

Technique

uses

to Artificial Intelligence

Technique

uses

to Asymmetric Cryptography

Technique

uses

Technique

uses

to Cloud Accounts

Technique

uses

Technique

uses

to Cloud Groups

Technique

uses

to Cloud Infrastructure Discovery

Technique

uses

to Cloud Storage Object Discovery

Technique

uses

to Code Repositories

Technique

uses

to Code Repositories

Technique

uses

to Compromise Software Dependencies and Development Tools

Technique

uses

Technique

uses

to Credentials In Files

Technique

uses

Technique

uses

to Data Destruction

Technique

uses

to Data from Cloud Storage

Technique

uses

to Domain Accounts

Technique

uses

Technique

uses

to Email Accounts

Technique

uses

to Exfiltration Over Web Service

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Exploit Public-Facing Application

Technique

uses

Technique

uses

to File and Directory Discovery

Technique

uses

to Financial Theft

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internal Defacement

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Multi-hop Proxy

Technique

uses

to Phishing for Information

Technique

uses

to Remote Access Tools

Technique

uses

to Remote System Discovery

Technique

uses

Technique

uses

to Social Engineering

Technique

uses

to Software Deployment Tools

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Application Access Token

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

to Tor

Tool

uses

to Valid Accounts

Technique

uses

to Vulnerability Scanning

Technique

11 external

References

mitre-attack

G1057

UNC6240

—

Bling Libra

—

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications

FBI_SHLMS_May2026

https://www.ic3.gov/PSA/2026/PSA260515

Google Salesforce JUN 2025

https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion

Intel471_SH_Aug2021

https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack

Unit42KelleyVaya_BlingLibra_Aug2024

https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/

Google_SHOracle_Jun2026

https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit

Mandiant_SHDataTheft_Jan2026

https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft

SOCRadar_ShinyHunters_Mar2024

https://socradar.io/dark-web-profile-shinyhunters/