Overview
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”
T1560.002Archive via LibraryCollection
T1550.001Application Access TokenLateral Movement
T1573.002Asymmetric CryptographyCommand and Control
T1585.002Email AccountsResource Development
T1082System Information DiscoveryDiscovery
T1105Ingress Tool TransferCommand and Control
T1190Exploit Public-Facing ApplicationInitial Access
T1530Data from Cloud StorageCollection
Malware & Tools — 1
TorToolLinux / Windows / macOS
T1059.007
JavaScript
Execution
T1078Valid AccountsStealth
T1567Exfiltration Over Web ServiceExfiltration
T1598.003Spearphishing LinkReconnaissance
T1203Exploitation for Client ExecutionExecution
T1528Steal Application Access TokenCredential Access
T1083File and Directory DiscoveryDiscovery
T1588.002ToolResource Development
T1213.003Code RepositoriesCollection
T1684Social EngineeringStealth
T1552.001Credentials In FilesCredential Access
T1078.004Cloud AccountsStealth
T1078.002Domain AccountsStealth
T1016System Network Configuration DiscoveryDiscovery
T1491.001Internal DefacementImpact
T1036.005Match Legitimate Resource Name or LocationStealth
T1219Remote Access ToolsCommand and Control
T1598Phishing for InformationReconnaissance
T1195.001Compromise Software Dependencies and Development ToolsInitial Access
T1657Financial TheftImpact
T1580Cloud Infrastructure DiscoveryDiscovery
T1018Remote System DiscoveryDiscovery
T1059.009Cloud APIExecution
T1583.004ServerResource Development
T1072Software Deployment ToolsExecution
T1588.007Artificial IntelligenceResource Development
T1110Brute ForceCredential Access
T1213.006DatabasesCollection
T1589.001CredentialsReconnaissance
T1593.003Code RepositoriesReconnaissance
T1583.001DomainsResource Development
T1090.003Multi-hop ProxyCommand and Control
T1587.004ExploitsResource Development
T1485Data DestructionImpact
T1619Cloud Storage Object DiscoveryDiscovery
T1595.002Vulnerability ScanningReconnaissance
T1069.003Cloud GroupsDiscovery
T1210Exploitation of Remote ServicesLateral Movement