Loading threat actor…
ShinyHunters, also known as Shiny Hunters, ShinyHunter, and BLING LIBRA, is a financially motivated cybercriminal group active since approximately 2019–2020. Its operations center on stealing sensitive information from corporate networks, web applications, and cloud software-as-a-service platforms, then monetizing that information through extortion. Targets have included technology providers, retailers, telecommunications organizations, and education institutions. Its campaigns can expose both an organization's internal information and data belonging to customers of compromised service providers. The group uses phishing, voice phishing, social engineering, stolen credentials, and authentication tokens to obtain access. Its techniques include targeting single sign-on accounts, device-code phishing to obtain Microsoft authentication tokens, and compromising third-party integrations connected to SaaS environments. Following data exfiltration, it demands payment under threat of public disclosure and uses data-leak infrastructure to publish stolen information. ShinyHunters also provides extortion services to other attackers. Its established extortion model does not require file encryption. Extortion campaigns attributed to ShinyHunters include incidents involving Crunchbase and data center operator CyrusOne, with stolen information subsequently published. Arrests and disputes among rival claimants have complicated attribution under the ShinyHunters name. Impersonators have also used the brand for unsupported breach claims, so use of the name alone does not establish involvement by the original group. A verified organizational relationship with the Scattered Lapsus$ Hunters label has not been established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
76 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
19 malware families attributed to this actor across reporting.
14 additional families tracked in Mallory.
7 CVEs this actor has used in observed campaigns. 7 of them exploited in the wild.
The incident occurred because a contractor failed to implement a critical security patch for Oracle's PeopleSoft ERP software. This vulnerability, identified as CVE-2026-35273, was exploited by threat actors like ShinyHunters, who modified their attacks to bypass existing security measures.
The origins of the hostility trace to autumn 2025 during an extortion campaign centered on an Oracle E-Business Suite (EBS) zero-day vulnerability designated as CVE-2025-61882. Threat intelligence tracking revealed that unpatched enterprise Oracle EBS instances were systematically targeted to exfiltrate critical corporate databases from over one hundred corporations.
BleepingComputer reported that threat actors leveraged credentials stolen through the Trivy supply chain compromise (CVE-2026-33634) to breach Cisco's internal development environment... The CISA KEV remediation deadline for CVE-2026-33634 is today, April 8, 2026... Beyond patching Trivy to v0.69.2+, trivy-action to v0.35.0, or setup-trivy to v0.2.6, organizations must also complete credential rotation for any secrets that may have been exposed during the March 19-27 compromise window.
Параллельный вектор — эксплуатация CVE-2021-35587 в Oracle Access Manager... неаутентифицированный атакующий с сетевым доступом по HTTP получает полный контроль над Oracle Access Manager. Уязвимость включена в каталог CISA KEV; по данным AlienVault OTX имеет более 50 пульсов с тегом «actively exploited».
CISA on Monday added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog, confirming its exploitation.
2 more CVEs tied to this actor tracked in Mallory.
213 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The article describes ShinyHunters as a data-theft and extortion group that has reportedly collected more than $70 million. It attributes an FBI breach to exploitation of an unpatched Oracle PeopleSoft vulnerability at a contractor operating FBIjobs.gov, followed by lateral movement into AWS GovCloud and theft of approximately 2–3 TB of employee data. It also reports that ransomware negotiator Edward Dubrovsky faces extortion-related charges connected to the ShinyHunters investigation, with allegations that he worked for the attackers while presenting himself as a victim-side negotiator.
Mentioned as responsible for a September attack on the FBI, providing background on recent attacks against the US public sector. The article does not link ShinyHunters to the Bankruptcy Noticing Center incident.
The ShinyHunters brand is being contested by rival factions and exploited by impersonators making false breach claims and demanding payments to delete supposedly stolen data. The content reports the arrest of Saif Al-Din Khader, also known as Rey, a leader of one faction claiming the brand. These claims should not be treated as verified operations by the genuine group.
A cyber-extortion group whose identity has become contested following arrests of original members in 2025. At least two rival factions claim its brand, and the leak of its authentication PGP key has undermined verification of those claims. Impersonators using the name assert fabricated breaches and demand payment to delete data. The article does not establish that these fraudulent claims originate from the original group.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.