Healthtech Under Sustained Attack: ShinyHunters, Social Engineering, and a Growing Supply Chain Problem

The medical technology sector is absorbing a sustained campaign of data theft, extortion, and supply chain compromise. The most significant recent development: pharmaceutical distribution giant McKesson discovered a cybersecurity incident on August 25, 2026, and subsequently disclosed it in a Form 8-K filing with the SEC on August 28, 2026, after the ShinyHunters extortion group claimed to have stolen 284 million patient data records [2]. McKesson stated that the incident involved unauthorized access to third-party applications and data exfiltration [2]. The investigation is ongoing, and McKesson has not yet determined whether the incident is material [2].

This is not an isolated event. Over the past several months, iRhythm and device manufacturers including Contec have all faced incidents that expose a common vulnerability: the third-party application layer and the human element that protects it. Health-ISAC's 2026 Global Health Sector Threat Landscape report identifies the healthcare sector as a persistent, high-value target for both cybercriminal groups and hacktivists [3]. This report examines each incident, the threat actor behind the largest of them, and provides consolidated intelligence and detection guidance.

McKesson: ShinyHunters Claims 284 Million Patient Records

McKesson is one of the largest healthcare companies in the United States, distributing pharmaceuticals, medical supplies, and technology services to healthcare providers and pharmacies. On August 25, 2026, McKesson discovered unauthorized access to third-party applications and confirmed data exfiltration [2]. The Form 8-K was filed with the SEC on August 28, 2026 [2].

The ShinyHunters extortion group claimed responsibility. CyberInsider reported the breach, and McKesson subsequently filed with the SEC [2]. In a notice to customers, McKesson stated: "We take the security and privacy of our partners, customers and their patients very seriously. Upon discovery, we immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to assist in our response" [2]. McKesson also warned that customers may experience intermittent service degradation [2].

The scale of the claim (284 million patient records) has not been independently verified by McKesson, which stated in its SEC filing that it "has not determined that the incident is material or that the incident has had, or is reasonably likely to have, any material impact on the company, including its financial condition or results of operations" [2].

ShinyHunters: Profile and TTPs

ShinyHunters is a financially motivated data extortion group that first emerged in 2020 [1]. The group primarily targets enterprise cloud and SaaS platforms, including Salesforce, Snowflake, Okta, and Microsoft 365, across finance, insurance, education, telecom, retail, and healthcare [1].

Their operational model is "pay-or-leak": they demand bitcoin ransom within 72 hours, threatening to publish stolen data rather than encrypting systems [1]. This distinction matters for defenders. Traditional ransomware detection focused on encryption behavior will miss ShinyHunters activity entirely.

Initial Access: Voice Phishing and Credential Theft

Voice phishing (vishing) is ShinyHunters' signature initial access method [1]. Operators impersonate IT support staff and scale calls using AI voice agents [1]. The objective is to harvest valid SSO, Okta, and Microsoft 365 credentials. Once obtained, intrusions begin by simply logging in with stolen credentials, bypassing many preventive controls [1].

ShinyHunters also operates Okta-themed phishing infrastructure. The domain bless-invite.com was identified as an Okta-themed phishing domain cloned from an Okta subdomain and reused across many hosts [1].

Supply Chain Compromise via OAuth Tokens

A defining ShinyHunters tactic is supply chain compromise through stolen OAuth tokens [1]. A single compromised OAuth token can cascade an intrusion across hundreds of downstream Salesforce and SaaS customer organizations [1]. This is directly relevant to the McKesson incident, where third-party applications were the access vector [2].

Oracle PeopleSoft Zero-Day: CVE-2026-35273 (Unverified)

Recent ShinyHunters campaigns reportedly exploited an Oracle PeopleSoft zero-day tracked as CVE-2026-35273, hitting over 100 organizations across roughly 300 instances, mostly universities [1]. This CVE has not been independently verified against Oracle's official security advisories or the MITRE CVE database. All references to this CVE in this report are based solely on Picus Security reporting [1] and should be treated as unverified. The group reportedly deployed MeshCentral agents disguised as cloud-operations tools, connecting back to the C2 domain azurenetfiles.net [1]. The C2 domain was crafted to mimic a legitimate cloud-storage address [1].

After gaining access, ShinyHunters used a fanout script to spray SSH passwords across internal hosts [1]. The group also dropped a defacement and extortion marker file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in WebLogic and process-scheduler folders [1].

iRhythm: Social Engineering Against the Business Application Layer

iRhythm, a cardiac monitoring company, disclosed a breach via SEC Form 8-K on June 16, 2026 [2]. The timeline:

• June 8, 2026: Unauthorized activity involving third-party-hosted business applications identified [2]
• June 9, 2026: Threat actor contacted iRhythm demanding payment to withhold disclosure of stolen data [2]
• June 10, 2026: Incident deemed material due to the volume of potentially affected data [2]

iRhythm confirmed that data was exfiltrated from third-party applications via social engineering [2]. The stolen data included proprietary data, patient protected health information (PHI), and other personal information [2].

The company stated in its SEC filing: "On June 9, 2026, the Company received communications from a threat actor claiming to have obtained sensitive information, including proprietary data, patient protected health information and other personal data" [2].

No ransomware group publicly claimed the attack as of reporting [2]. iRhythm activated its cybersecurity response plan and engaged external cybersecurity experts [2]. The company confirmed that products, clinical or medical device systems, patient safety, and financial reporting systems were not affected, and that iRhythm does not store payment card or financial account information [2].

Contec CMS8000: Firmware-Level Security Concerns

Health-ISAC's 2026 report flagged a different category of threat affecting medical devices. The Contec CMS8000 patient monitor was identified by the FDA as containing firmware with hard-coded IP addresses that present security concerns [3]. The IP address 202.114.4.119 was found hard-coded in the firmware, and the FDA recommended blocking the 202.114.4.0/24 range [3].

This is not a breach in the traditional sense. It represents a supply chain integrity risk at the firmware level, where monitoring equipment ships with embedded network connections that defenders may not be aware of.

Health Sector Threat Overview: Broader Context

Health-ISAC's 2026 Global Health Sector Threat Landscape report provides sector-wide context for these incidents [3]. The report identifies multiple ransomware gangs actively targeting healthcare: Qilin, INC Ransomware, SAFEPAY, Sinobi, and WorldLeaks [3]. Hacktivist attacks against the health sector are also documented, along with significant data breaches including the Episource breach [3].

The report also notes a positive development: the disruption of RaccoonO365, a phishing-as-a-service platform that had been used to target healthcare organizations [3].

Common Patterns Across Incidents

Three patterns are consistent across the McKesson, iRhythm, and broader ShinyHunters campaigns:

1. Third-party applications as the entry point. McKesson's breach involved "third-party applications" [2]. iRhythm's breach involved "third-party-hosted business applications" [2]. ShinyHunters' supply chain model cascades a single OAuth token compromise across hundreds of downstream organizations [1].

1. Social engineering as the primary initial access vector. iRhythm confirmed social engineering [2]. ShinyHunters' signature method is voice phishing [1]. These attacks target people, not technical vulnerabilities (with the possible exception of CVE-2026-35273, which remains unverified).

1. Extortion without encryption. Both iRhythm's attacker and ShinyHunters use pay-or-leak models [1][2]. Data exfiltration and extortion have replaced ransomware encryption as the primary monetization method in many healthcare intrusions.

IOC Table

Note: IOCs sourced from Picus Security reporting [1] should be independently validated before operationalizing in production detection rules. CVE-2026-35273, referenced in the report body, has not been independently verified.

MITRE ATT&CK Mapping

Network-Based Detection

Block and alert on connections to known ShinyHunters infrastructure. At minimum, create DNS sinkhole or firewall rules for bless-invite.com and azurenetfiles.net [1].

Monitor for MeshCentral agent traffic on your network. MeshCentral uses WebSocket connections over HTTPS. Look for outbound WebSocket connections to unexpected domains, particularly those mimicking cloud service names [1].

For Contec CMS8000 devices, block all traffic to the 202.114.4.0/24 range as recommended by the FDA [3].

Endpoint-Based Detection

Hunt for the specific filenames associated with ShinyHunters MeshCentral deployment:

filename:meshagent32-azure-ops.exe OR filename:meshagent64-azure-ops.exe OR filename:meshagent64-v2.exe

Search for the extortion marker file across file servers, WebLogic installations, and application directories:

filename:"README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT"

Identity and Access Monitoring

ShinyHunters' reliance on stolen SSO credentials means identity monitoring is the most important detection layer [1]. Focus on:

• Failed and successful MFA challenges from unusual locations or devices, particularly following reports of IT support phone calls
• OAuth token grants to unfamiliar applications or service principals
• Bulk data access from newly provisioned or recently modified accounts in Salesforce, Snowflake, or Microsoft 365
• Okta authentication logs showing sign-ins from IP ranges not associated with your organization, particularly following vishing reports

Sigma Rule: ShinyHunters MeshCentral Agent Detection

title: ShinyHunters MeshCentral Agent File Creation
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects creation of MeshCentral agent files matching ShinyHunters naming convention
author: RedSheepSec
date: 2026/09/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - 'meshagent32-azure-ops.exe'
            - 'meshagent64-azure-ops.exe'
            - 'meshagent64-v2.exe'
    condition: selection
falsepositives:
    - Legitimate MeshCentral deployments with custom naming
level: high
tags:
    - attack.persistence
    - attack.t1219

Sigma Rule: ShinyHunters Extortion Marker File

title: ShinyHunters Extortion Marker File Detection
id: 9a4b3c2d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of README extortion file used by ShinyHunters
author: RedSheepSec
date: 2026/09/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT'
    condition: selection
falsepositives:
    - Very unlikely in production environments
level: critical
tags:
    - attack.impact
    - attack.t1491.001

Analysis

The McKesson claim of 284 million patient records would, if verified, make it one of the largest healthcare data breaches in history. McKesson's SEC filing language is cautious and noncommittal regarding materiality [2]. The company has not confirmed the volume of records. ShinyHunters has a track record of credible claims, though like many extortion groups, their claimed data volumes should be independently verified before being accepted at face value.

The third-party application vector is the thread connecting McKesson, iRhythm, and the broader ShinyHunters playbook. Healthcare organizations outsource critical workflows to SaaS platforms and managed applications. When those platforms are compromised, the healthcare organization bears the regulatory and reputational consequences regardless of where the technical failure occurred.

ShinyHunters' expansion into healthcare follows a logical progression. Healthcare data is widely assessed to command premium prices on criminal markets, driven by the density of PII and the difficulty of changing medical identifiers. HIPAA notification requirements likely create additional pressure on victims to pay extortion demands, as breach disclosure can carry significant reputational and regulatory costs. The group's vishing-to-OAuth-to-SaaS kill chain is particularly effective against healthcare organizations, which often have large, distributed workforces with varying levels of security awareness.

The Contec CMS8000 issue represents a different threat category entirely: firmware-level supply chain risk in medical devices. This type of risk is harder to detect, harder to remediate, and has direct patient safety implications that data breaches do not.

References

1. The ShinyHunters Domino Effect: One Breach, Hundreds of Victims - Picus Security
2. McKesson discloses breach after ShinyHunters claims patient data theft - BleepingComputer
3. 2026 Global Health Sector Threat Landscape - Health-ISAC

Event Timeline

Entity Relationships

Diamond Model

Hunt Guide: ShinyHunters Healthcare Data Extortion Campaign & Supply Chain Compromise

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If ShinyHunters or related threat actors leveraging social engineering and OAuth token abuse are active in our environment, we expect to observe DNS queries to known phishing/C2 domains (bless-invite.com, azurenetfiles.net), MeshCentral agent binaries masquerading as cloud-operations tools, SSH password spraying activity, anomalous OAuth token grants, and extortion marker files in application directories across endpoint, DNS, identity, and network telemetry sources.

Intelligence Summary: ShinyHunters, a financially motivated data extortion group, claimed to have stolen 284 million patient records from pharmaceutical distributor McKesson via compromise of third-party applications; McKesson has not confirmed the volume and has not determined materiality. The group's operational model centers on voice phishing to harvest SSO/Okta/M365 credentials, supply chain compromise via stolen OAuth tokens cascading across downstream SaaS customers, and a pay-or-leak extortion model that avoids encryption. Concurrently, iRhythm disclosed a breach involving social engineering against third-party-hosted business applications, and the FDA flagged Contec CMS8000 patient monitors for hard-coded IP addresses presenting firmware-level supply chain risk.

Confidence: Moderate | Priority: Critical

Scope

• Networks: All enterprise network segments, with emphasis on healthcare application servers, SaaS-integrated systems (Okta, Salesforce, Microsoft 365, Snowflake), medical device VLANs hosting Contec CMS8000 monitors, and Oracle PeopleSoft instances
• Timeframe: 90 days retrospective from current date, covering the period from June 2026 forward to capture both the iRhythm (June 8, 2026) and McKesson (August 25, 2026) incident timelines and any related precursor activity
• Priority Systems: Identity infrastructure (Okta, Azure AD, Microsoft 365), SaaS platforms with OAuth integrations (Salesforce, Snowflake), pharmaceutical distribution and patient data systems, Oracle PeopleSoft instances, WebLogic servers, medical device network segments, and any systems with third-party application integrations

MITRE ATT&CK Techniques

T1566.004 — Phishing: Spearphishing Voice (Initial Access) [P2]

ShinyHunters operators impersonate IT support staff using AI voice agents to harvest valid SSO, Okta, and Microsoft 365 credentials via voice phishing (vishing). This is their signature initial access method.

Splunk SPL:

index=cloud-azure sourcetype="azure:monitor:aad" properties.authenticationRequirement="multiFactorAuthentication" properties.status.errorCode!=0
| stats count by properties.userPrincipalName, properties.ipAddress, properties.location.city, properties.location.countryOrRegion
| where count > 3
| sort - count
| table properties.userPrincipalName, properties.ipAddress, properties.location.city, properties.location.countryOrRegion, count
| rename properties.userPrincipalName AS User, properties.ipAddress AS SourceIP, properties.location.city AS City, properties.location.countryOrRegion AS Country

Elastic KQL:

event.dataset:"azure.signinlogs" AND azure.signinlogs.properties.authentication_requirement:"multiFactorAuthentication" AND NOT azure.signinlogs.properties.status.error_code:0

Sigma Rule:

title: Suspicious MFA Challenge Failures Indicating Possible Vishing
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects multiple failed MFA challenges from a single user which may indicate credential harvesting via voice phishing
author: RedSheepSec
date: 2026/09/01
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.authenticationRequirement: 'multiFactorAuthentication'
    filter:
        properties.status.errorCode: 0
    condition: selection and not filter
    timeframe: 15m
falsepositives:
    - Users with legitimate MFA issues
    - MFA enrollment activities
level: medium
tags:
    - attack.initial_access
    - attack.t1566.004

Correlate MFA failures with help desk tickets reporting unsolicited IT support calls. ShinyHunters operators scale calls using AI voice agents, so look for clusters of MFA failures across multiple users within short windows. Tune threshold based on baseline MFA failure rates.

T1078 — Valid Accounts (Initial Access) [P2]

ShinyHunters uses stolen SSO/Okta/M365 credentials obtained via vishing to authenticate directly, bypassing many preventive controls. Intrusions begin by simply logging in with legitimate credentials.

Splunk SPL:

index=cloud-azure sourcetype="azure:monitor:aad" properties.status.errorCode=0
| iplocation properties.ipAddress
| where NOT cidrmatch("10.0.0.0/8", properties.ipAddress) AND NOT cidrmatch("172.16.0.0/12", properties.ipAddress)
| stats dc(properties.ipAddress) as unique_ips, values(properties.ipAddress) as IPs, values(Country) as Countries, count by properties.userPrincipalName
| where unique_ips > 2
| sort - unique_ips
| table properties.userPrincipalName, unique_ips, IPs, Countries, count

Elastic KQL:

event.dataset:"azure.signinlogs" AND azure.signinlogs.properties.status.error_code:0 AND NOT source.ip:(10.0.0.0/8 OR 172.16.0.0/12 OR 192.168.0.0/16)

Sigma Rule:

title: Successful Authentication from Anomalous Location Post-MFA
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: experimental
description: Detects successful sign-ins from unusual geographic locations that may indicate use of stolen credentials obtained via vishing
author: RedSheepSec
date: 2026/09/01
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.status.errorCode: 0
    filter_internal:
        properties.ipAddress|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Legitimate remote work from new locations
    - VPN usage
level: medium
tags:
    - attack.initial_access
    - attack.t1078

Baseline normal login locations per user. Focus on accounts that successfully authenticate from new geolocations within 24 hours of reported vishing attempts or MFA anomalies. Correlate with impossible travel detections.

T1199 — Trusted Relationship (Initial Access) [P1]

ShinyHunters compromises OAuth tokens to cascade intrusions across hundreds of downstream Salesforce and SaaS customer organizations. A single compromised OAuth token provides access to all connected downstream tenants. This is directly relevant to the McKesson incident where third-party applications were the access vector.

Splunk SPL:

index=cloud-azure sourcetype="azure:monitor:aad" operationName="Consent to application"
| stats count by initiatedBy.user.userPrincipalName, targetResources{}.displayName, targetResources{}.modifiedProperties{}.newValue
| sort - count
| table initiatedBy.user.userPrincipalName, targetResources{}.displayName, targetResources{}.modifiedProperties{}.newValue, count

Elastic KQL:

event.dataset:"azure.auditlogs" AND azure.auditlogs.operation_name:"Consent to application"

Sigma Rule:

title: Suspicious OAuth Application Consent Grant
id: c3d4e5f6-a7b8-9012-cdef-345678901234
status: experimental
description: Detects OAuth application consent grants that may indicate supply chain compromise via stolen OAuth tokens as used by ShinyHunters
author: RedSheepSec
date: 2026/09/01
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        operationName: 'Consent to application'
    condition: selection
falsepositives:
    - Legitimate application onboarding
    - Admin-approved OAuth grants
level: high
tags:
    - attack.initial_access
    - attack.t1199

All OAuth consent grants in the past 90 days should be reviewed. Focus on grants to unfamiliar application names, applications with broad permissions (Mail.Read, Files.ReadWrite.All), or grants initiated by accounts showing other anomalous activity. Cross-reference with the known ShinyHunters pattern of cascading OAuth abuse.

T1219 — Remote Access Software (Command and Control) [P1]

ShinyHunters deploys MeshCentral agents disguised as cloud-operations tools (meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, meshagent64-v2.exe) connecting back to the C2 domain azurenetfiles.net for persistent remote access.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" (EventCode=1 OR EventCode=11)
| search (Image="*meshagent32-azure-ops.exe" OR Image="*meshagent64-azure-ops.exe" OR Image="*meshagent64-v2.exe" OR TargetFilename="*meshagent32-azure-ops.exe" OR TargetFilename="*meshagent64-azure-ops.exe" OR TargetFilename="*meshagent64-v2.exe")
| table _time, Computer, User, EventCode, Image, TargetFilename, CommandLine, ParentImage, ParentCommandLine

Elastic KQL:

(process.name:("meshagent32-azure-ops.exe" OR "meshagent64-azure-ops.exe" OR "meshagent64-v2.exe")) OR (file.name:("meshagent32-azure-ops.exe" OR "meshagent64-azure-ops.exe" OR "meshagent64-v2.exe"))

Sigma Rule:

title: ShinyHunters MeshCentral Agent File Creation
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects creation of MeshCentral agent files matching ShinyHunters naming convention
author: RedSheepSec
date: 2026/09/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - 'meshagent32-azure-ops.exe'
            - 'meshagent64-azure-ops.exe'
            - 'meshagent64-v2.exe'
    condition: selection
falsepositives:
    - Legitimate MeshCentral deployments with custom naming
level: high
tags:
    - attack.persistence
    - attack.command_and_control
    - attack.t1219

MeshCentral uses WebSocket connections over HTTPS. Also hunt for any MeshCentral agent process (meshagent.exe) even without the specific naming convention, as the group may change filenames. If MeshCentral is not an approved RMM tool, any instance is suspicious.

T1036 — Masquerading (Defense Evasion) [P1]

ShinyHunters disguises MeshCentral agent binaries as cloud-operations tools using names containing 'azure-ops' to blend with legitimate cloud administration tooling. The C2 domain azurenetfiles.net was also crafted to mimic a legitimate cloud-storage address.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=1
| search (Image="*azure-ops*" OR CommandLine="*azure-ops*")
| where NOT like(Image, "%\\Program Files%") AND NOT like(Image, "%\\Program Files (x86)%")
| table _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, Hashes

Elastic KQL:

(process.name:*azure-ops* OR process.command_line:*azure-ops*) AND NOT process.executable:(*Program\ Files* OR *Program\ Files\ \(x86\)*)

Sigma Rule:

title: Process Execution with Azure-Ops Masquerading Name
id: d4e5f6a7-b8c9-0123-def0-456789012345
status: experimental
description: Detects execution of processes with azure-ops in the filename, potentially MeshCentral agents masquerading as legitimate cloud tools
author: RedSheepSec
date: 2026/09/01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains: 'azure-ops'
    filter_legit:
        Image|startswith:
            - 'C:\\Program Files\\'
            - 'C:\\Program Files (x86)\\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate internal tools named with azure-ops prefix
level: high
tags:
    - attack.defense_evasion
    - attack.t1036

Expand the hunt to include any executable with 'meshagent' in the name that is not part of an approved RMM deployment. The masquerading technique may evolve — look for other cloud-themed naming patterns (aws-ops, gcp-ops, etc.).

T1110.003 — Brute Force: Password Spraying (Credential Access) [P2]

After gaining initial access, ShinyHunters used a fanout script to spray SSH passwords across internal hosts for lateral movement.

Splunk SPL:

index=linux-server sourcetype="linux:secure" "Failed password"
| rex field=_raw "Failed password for (?:invalid user )?(?<target_user>\S+) from (?<src_ip>\S+) port (?<src_port>\d+)"
| stats count dc(target_user) as unique_users values(target_user) as users by src_ip
| where count > 20 AND unique_users > 5
| sort - count
| table src_ip, count, unique_users, users

Elastic KQL:

event.dataset:"system.auth" AND system.auth.ssh.event:"Failed" AND event.outcome:"failure"

Sigma Rule:

title: SSH Password Spraying Detection
id: e5f6a7b8-c9d0-1234-ef01-567890123456
status: experimental
description: Detects SSH password spraying activity consistent with ShinyHunters fanout script behavior
author: RedSheepSec
date: 2026/09/01
logsource:
    product: linux
    service: sshd
detection:
    selection:
        sshd.authfail: true
    condition: selection | count() by srcip > 20
    timeframe: 5m
falsepositives:
    - Vulnerability scanners
    - Misconfigured service accounts
level: high
tags:
    - attack.credential_access
    - attack.t1110.003

Look for a single source IP attempting SSH authentication against many unique usernames across multiple hosts in a short timeframe. The fanout script pattern suggests automated, parallelized spraying. Correlate with any prior MeshCentral agent detections to identify the spray origin.

T1021.004 — Remote Services: SSH (Lateral Movement) [P2]

ShinyHunters uses SSH for lateral movement across internal hosts after obtaining credentials via password spraying.

Splunk SPL:

index=corelight sourcetype="corelight_ssh"
| stats count dc(id.resp_h) as unique_targets values(id.resp_h) as targets by id.orig_h
| where unique_targets > 10
| sort - unique_targets
| table id.orig_h, unique_targets, targets, count

Elastic KQL:

event.dataset:"corelight.ssh" AND event.action:"login"

Focus on internal-to-internal SSH connections. A single host initiating SSH sessions to many unique internal destinations within a short window is highly suspicious and consistent with ShinyHunters' lateral movement pattern. Baseline normal SSH patterns in your environment first.

T1190 — Exploit Public-Facing Application (Initial Access) [P2]

ShinyHunters reportedly exploited an Oracle PeopleSoft zero-day tracked as CVE-2026-35273, hitting over 100 organizations across roughly 300 instances. This CVE has not been independently verified against Oracle's official security advisories.

Splunk SPL:

index=webserver (sourcetype="apache:access" OR sourcetype="ms:iis:auto" OR sourcetype="weblogic:access")
| search uri_path="*PeopleSoft*" OR uri_path="*psc/*" OR uri_path="*psp/*"
| stats count by src_ip, uri_path, status, http_method
| where count > 50
| sort - count
| table src_ip, uri_path, http_method, status, count

Elastic KQL:

url.path:(*PeopleSoft* OR *psc\/* OR *psp\/*) AND http.response.status_code:(200 OR 301 OR 302)

CVE-2026-35273 is unverified. Monitor PeopleSoft web application logs for unusual request patterns, especially POST requests to authentication or data access endpoints. If your organization runs PeopleSoft, prioritize patching to the latest Oracle CPU regardless of CVE verification status.

T1041 — Exfiltration Over C2 Channel (Exfiltration) [P1]

ShinyHunters exfiltrates stolen data over their C2 channel to infrastructure such as azurenetfiles.net. The pay-or-leak model means data exfiltration is the primary objective rather than encryption.

Splunk SPL:

index=corelight sourcetype="corelight_http"
| where (host="azurenetfiles.net" OR host="bless-invite.com")
| stats count sum(response_body_len) as total_bytes by id.orig_h, host, uri
| sort - total_bytes
| table id.orig_h, host, uri, count, total_bytes

Elastic KQL:

destination.domain:("azurenetfiles.net" OR "bless-invite.com")

Also look for large outbound data transfers to any external destinations that are unusual for your environment. ShinyHunters may use additional infrastructure not yet identified. Monitor for WebSocket connections over HTTPS to unknown domains.

T1491.001 — Defacement: Internal Defacement (Impact) [P1]

ShinyHunters drops a defacement and extortion marker file named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in WebLogic and process-scheduler folders as an extortion notification.

Splunk SPL:

index=sysmon sourcetype="XmlWinEventLog" EventCode=11 TargetFilename="*README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED*"
| table _time, Computer, User, Image, TargetFilename

Elastic KQL:

file.name:"README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT"

Sigma Rule:

title: ShinyHunters Extortion Marker File Detection
id: 9a4b3c2d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of README extortion file used by ShinyHunters
author: RedSheepSec
date: 2026/09/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT'
    condition: selection
falsepositives:
    - Very unlikely in production environments
level: critical
tags:
    - attack.impact
    - attack.t1491.001

Detection of this file likely indicates an advanced stage of compromise. Immediately escalate and initiate IR procedures. Also search Linux hosts and WebLogic directories.

T1583.001 — Acquire Infrastructure: Domains (Resource Development) [P1]

ShinyHunters registers phishing domains like bless-invite.com (Okta-themed) and C2 domains like azurenetfiles.net crafted to mimic legitimate cloud-storage addresses.

Splunk SPL:

index=corelight sourcetype="corelight_dns"
| where query="bless-invite.com" OR query="azurenetfiles.net" OR query="*.bless-invite.com" OR query="*.azurenetfiles.net"
| table _time, id.orig_h, query, answers, rcode_name

Elastic KQL:

dns.question.name:("bless-invite.com" OR "azurenetfiles.net" OR *.bless-invite.com OR *.azurenetfiles.net)

These domains should be sinkholed or blocked at the DNS resolver and web proxy. Also search historical DNS logs for any past resolutions to identify potentially already-compromised hosts.

T1566 — Phishing (Initial Access) [P1]

iRhythm confirmed social engineering was used to compromise third-party-hosted business applications; specific method was undisclosed. ShinyHunters also operates Okta-themed phishing infrastructure via bless-invite.com.

Splunk SPL:

index=corelight sourcetype="corelight_dns" query="bless-invite.com"
| stats count by id.orig_h, query, answers
| table id.orig_h, query, answers, count

Elastic KQL:

dns.question.name:"bless-invite.com" OR url.domain:"bless-invite.com"

Monitor for any DNS resolutions or HTTP connections to bless-invite.com, which was identified as an Okta-themed phishing domain cloned from an Okta subdomain. Any user navigating to this domain may have been targeted for credential theft.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=corelight sourcetype="corelight_dns" (query="bless-invite.com" OR query="*.bless-invite.com")
| stats count by id.orig_h, query, answers, _time
| sort - _time
| table _time, id.orig_h, query, answers, count

index=corelight sourcetype="corelight_dns" (query="azurenetfiles.net" OR query="*.azurenetfiles.net")
| stats count by id.orig_h, query, answers, _time
| sort - _time
| table _time, id.orig_h, query, answers, count

index=sysmon sourcetype="XmlWinEventLog" (EventCode=1 OR EventCode=11) (Image="*meshagent32-azure-ops.exe" OR TargetFilename="*meshagent32-azure-ops.exe" OR CommandLine="*meshagent32-azure-ops.exe")
| table _time, Computer, User, EventCode, Image, TargetFilename, CommandLine

index=sysmon sourcetype="XmlWinEventLog" (EventCode=1 OR EventCode=11) (Image="*meshagent64-azure-ops.exe" OR TargetFilename="*meshagent64-azure-ops.exe" OR CommandLine="*meshagent64-azure-ops.exe")
| table _time, Computer, User, EventCode, Image, TargetFilename, CommandLine

index=sysmon sourcetype="XmlWinEventLog" (EventCode=1 OR EventCode=11) (Image="*meshagent64-v2.exe" OR TargetFilename="*meshagent64-v2.exe" OR CommandLine="*meshagent64-v2.exe")
| table _time, Computer, User, EventCode, Image, TargetFilename, CommandLine

index=sysmon sourcetype="XmlWinEventLog" EventCode=11 TargetFilename="*README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED*"
| table _time, Computer, User, Image, TargetFilename
| append [search index=crowdstrike sourcetype="CrowdStrike:Event:Streams:JSON" "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED" | table _time, ComputerName, FileName]

index=corelight sourcetype="corelight_conn" (id.orig_h="202.114.4.119" OR id.resp_h="202.114.4.119")
| stats count by id.orig_h, id.resp_h, id.resp_p, proto, service
| table id.orig_h, id.resp_h, id.resp_p, proto, service, count
| append [search index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="202.114.4.119" OR dest_ip="202.114.4.119") | table _time, src_ip, dest_ip, dest_port, action]

YARA Rules

ShinyHunters_MeshCentral_Agent — Detects ShinyHunters MeshCentral agent binaries based on known filenames and associated strings

rule ShinyHunters_MeshCentral_Agent
{
    meta:
        description = "Detects ShinyHunters MeshCentral agent binaries disguised as cloud-operations tools"
        author = "RedSheepSec"
        date = "2026-09-01"
        reference = "https://www.picussecurity.com/resource/blog/the-shinyhunters-domino-effect-one-breach-hundreds-of-victims"
        threat_actor = "ShinyHunters"
        tlp = "white"

    strings:
        $fn1 = "meshagent32-azure-ops" ascii wide nocase
        $fn2 = "meshagent64-azure-ops" ascii wide nocase
        $fn3 = "meshagent64-v2" ascii wide nocase
        $c2 = "azurenetfiles.net" ascii wide nocase
        $mesh1 = "MeshAgent" ascii wide
        $mesh2 = "MeshCentral" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        filesize < 20MB and
        (any of ($fn*) or ($c2 and any of ($mesh*)))
}

ShinyHunters_Extortion_Marker — Detects the ShinyHunters extortion marker file README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT

rule ShinyHunters_Extortion_Marker
{
    meta:
        description = "Detects ShinyHunters extortion marker file content"
        author = "RedSheepSec"
        date = "2026-09-01"
        reference = "https://www.picussecurity.com/resource/blog/the-shinyhunters-domino-effect-one-breach-hundreds-of-victims"
        threat_actor = "ShinyHunters"
        tlp = "white"

    strings:
        $marker = "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED" ascii wide nocase
        $ext = "YOUVE-BEEN-HACKED" ascii wide nocase

    condition:
        any of them and filesize < 1MB
}

Suricata Rules

SID 2026001 — Detects DNS query to ShinyHunters Okta-themed phishing domain bless-invite.com

alert dns $HOME_NET any -> any 53 (msg:"HUNT ShinyHunters Phishing Domain - bless-invite.com DNS Query"; dns.query; content:"bless-invite.com"; nocase; classtype:social-engineering; sid:2026001; rev:1; metadata:created_at 2026_09_01, threat_actor ShinyHunters;)

SID 2026002 — Detects DNS query to ShinyHunters C2 domain azurenetfiles.net

alert dns $HOME_NET any -> any 53 (msg:"HUNT ShinyHunters C2 Domain - azurenetfiles.net DNS Query"; dns.query; content:"azurenetfiles.net"; nocase; classtype:trojan-activity; sid:2026002; rev:1; metadata:created_at 2026_09_01, threat_actor ShinyHunters;)

SID 2026003 — Detects TLS/SSL connections to ShinyHunters C2 domain azurenetfiles.net

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT ShinyHunters C2 TLS Connection - azurenetfiles.net"; tls.sni; content:"azurenetfiles.net"; nocase; classtype:trojan-activity; sid:2026003; rev:1; metadata:created_at 2026_09_01, threat_actor ShinyHunters;)

SID 2026004 — Detects TLS/SSL connections to ShinyHunters phishing domain bless-invite.com

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"HUNT ShinyHunters Phishing TLS Connection - bless-invite.com"; tls.sni; content:"bless-invite.com"; nocase; classtype:social-engineering; sid:2026004; rev:1; metadata:created_at 2026_09_01, threat_actor ShinyHunters;)

SID 2026005 — Detects outbound connections to Contec CMS8000 hard-coded IP 202.114.4.119 flagged by FDA

alert ip $HOME_NET any -> 202.114.4.0/24 any (msg:"HUNT Contec CMS8000 Firmware Hardcoded IP Range - FDA Alert"; classtype:bad-unknown; sid:2026005; rev:1; metadata:created_at 2026_09_01, reference FDA_advisory;)

Data Source Requirements

Recommendations

• Deploy all IOC sweep queries (Appendix: IOCs section) across Splunk immediately and configure as scheduled searches with P1 alerting for any matches to bless-invite.com, azurenetfiles.net, or ShinyHunters MeshCentral agent filenames
• Block domains bless-invite.com and azurenetfiles.net at DNS resolvers, web proxies, and firewall rules. Add to threat intelligence blocklists for automated enforcement
• Block all network traffic to the 202.114.4.0/24 IP range at the network perimeter as recommended by the FDA for Contec CMS8000 firmware concerns. Isolate any Contec CMS8000 patient monitors on a dedicated VLAN with no internet access
• Audit all OAuth application consent grants in Azure AD, Okta, and Salesforce for the past 90 days. Revoke any unrecognized, dormant, or overly permissioned grants. Implement approval workflows requiring admin consent for new OAuth integrations
• Migrate all SSO-protected applications from SMS/voice-based MFA to phishing-resistant MFA (FIDO2/WebAuthn), prioritizing Okta, Microsoft 365, and Salesforce. SMS and voice-based MFA are insufficient against ShinyHunters' vishing campaigns
• Inventory all Oracle PeopleSoft instances in the environment and apply the latest Oracle Critical Patch Update. Even though CVE-2026-35273 is unverified, ensure PeopleSoft instances are not internet-exposed without WAF protection
• Deploy Suricata rules (SIDs 2026001-2026005) to network sensors for real-time alerting on ShinyHunters infrastructure connections and Contec firmware IP range traffic
• Enumerate all RMM tools present across endpoints and create an approved RMM allowlist. Block execution of MeshCentral and any other unapproved remote access tools via application control policies
• Conduct a tabletop exercise within 30 days focused on the pay-or-leak extortion scenario: a threat actor claims exfiltrated patient data and demands payment within 72 hours. Ensure IR plan covers SEC disclosure timelines, HIPAA breach notification, and law enforcement engagement
• Review third-party vendor security posture for all SaaS and managed application providers, focusing on OAuth integration security, breach notification timelines, and contractual security requirements

Sources

• The ShinyHunters Domino Effect: One Breach, Hundreds of Victims - Picus Security
• McKesson discloses breach after ShinyHunters claims patient data theft - BleepingComputer
• 2026 Global Health Sector Threat Landscape - Health-ISAC