- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Canada(high confidence)
- Motivation
- Financial gain
- Seen
- 2020–2026
- Status
- Active
- ATT&CK
- G1057 · 46 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0054 · shinyhunters
CanadaWhat it is
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Mandiant
- UNC5537, UNC6240
- Microsoft
- Storm-3127
- PwC
- White Dev 100
- Other names
- Bling Libra, Shiny Hunters, ShinyCorp
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- CloudDuke
- Cyber Eye RAT
- CyberGate
- Tor
- Unknown Logger
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de