Loading threat actor…
ShinyEquationCartel is a Telegram-based cybercrime brand that opened its channel on October 10, 2026, amid competing claims to the ShinyHunters identity following arrests of suspected participants. It presented itself as a collective of former ShinyHunters, LAPSUS$, HellCat, and LockBit members, but that membership has not been independently established. A channel using the ShinyHunters (SLSH) name publicly announced that it was joining ShinyEquationCartel. The brand's observed activity centers on monetizing purported stolen data through negotiations and auctions. On October 11, 2026, it claimed responsibility for an Orange breach and advertised a negotiation contact previously used by an Aegis-associated channel. On October 13, it auctioned purported H&M data while disputing a rival operator's possession of that data. These advertisements do not establish that ShinyEquationCartel conducted either intrusion; H&M stated that its investigation had found no indication that its data environment was compromised. ShinyEquationCartel also announced a BreachForums revival and publicly feuded with the Aegis faction. Shared contacts and overlapping data advertisements do not establish common operational control or make the brand a verified alias of ShinyHunters or its other claimed predecessor groups.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 indicator attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.