Threat actor

Aegis

Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

2 mentions · peak 2 in a dayToday

CVEs0Associated

Malware0Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: Financial
Ransomware tactics: Data theft extortion
Capabilities: Extortion

Also known asAegis

Aegis is a Telegram-centered faction associated with the fragmentation of ShinyHunters following arrests in September 2026. The faction promoted the Aegis persona as the group's “Grand Founder” after Rey's arrest and contested other factions' claims to the ShinyHunters identity. It operated through Telegram communities including SH, SH Group, Other And Other, and Escanors Marketplace/Files. The faction participated in a stolen-data distribution and extortion ecosystem alongside the ShinyHunters leak-site faction and ShinyEquationCartel. Despite publicly denouncing one another, all three factions directed users to the same infrastructure to download stolen data. Aegis is a distinct faction label rather than an established alias for the entire ShinyHunters operation. Its documented activity centers on Telegram-based promotion, stolen-data distribution, and disputes over leadership and ownership of the ShinyHunters identity.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Activity feed

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyberveilleNews · Nov 4, 2026ShinyHunters : bataille pour le contrôle du nom après les arrestations de septembre 2026 | CyberVeilleA Telegram-based faction claiming the ShinyHunters identity after Rey's arrest. The faction promotes the Aegis persona and operates through several named channels. The report describes unstable identity claims and public disputes; this entry represents the named faction rather than treating the individual persona as a separate threat group.Read more ↗

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingMITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malwareFamilies linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

Aegis

Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

2 mentions · peak 2 in a dayToday

CVEs0Associated

Malware0Families

ATT&CK0Techniques

IOCs0Tracked

Motivation: Financial
Ransomware tactics: Data theft extortion
Capabilities: Extortion

Also known asAegis

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure