Shinycorp

ShinyCorp is a cybercriminal entity associated with ShinyHunters and linked in reporting to the ShinySpider (also styled Sh1nySp1d3r or ShinySP1D3R) ransomware-as-a-service ecosystem. It has been described as participating in the monetization of stolen data, including the sale of large breached datasets in cooperation with ransomware partners and other e-crime actors. Reporting also associates the broader cluster with extortion activity involving theft of victim data, pressure through public leaking of samples, and seven-figure payment demands. Activity attributed to this cluster includes targeting enterprise identity infrastructure and single sign-on environments, as well as operations affecting retail, aviation, and telecommunications organizations. The associated ransomware capability has been described as focusing on VMware ESXi environments to enable large-scale encryption of virtualized infrastructure. Additional tactics reported for the broader associated actors include voice-phishing-enabled initial access, supply-chain compromise, insider recruitment, and collaboration with other criminal communities including actors tied to Scattered Spider and The Com. At high confidence from the available information, ShinyCorp appears financially motivated and involved in data theft and extortion-oriented cybercrime rather than state-directed operations. The relationship between ShinyCorp, ShinyHunters, and ShinySpider is reported as close, but the precise organizational boundaries and whether ShinyCorp is a distinct group, sub-group, or brand are not fully resolved from the available information.