Loading story…
Threat actor ShinyHunters claimed to have hacked cybersecurity firm ReliaQuest, with one breach-tracking report listing the incident as a ransomware-related compromise affecting the U.S.-based technology company and its reliaquest.com domain. The claim surfaced after ReliaQuest had publicly reported on ShinyHunters activity, and the threat actor’s message reportedly referenced Mandiant as part of its taunt.
A separate report said the claim remained unverified because ShinyHunters did not publish proof of compromise. It added that ReliaQuest’s threat research account had posted days earlier that it was tracking another ShinyHunters campaign, and that after a forum user replied with screenshots and the remark “Who’s hunting who?”, the related post was deleted and the account had not posted again, fueling attention around the alleged incident without confirming that a breach occurred.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Another forum user replied with screenshots and the comment "Who's hunting who?" in connection with the ShinyHunters claim involving ReliaQuest. Reporting says ReliaQuestTR then deleted its earlier August 17 tweet.
A reported ransomware-related data breach targeting ReliaQuest, LLC was attributed to ShinyHunters. The incident's breach and discovery time were both listed as 2026-08-23 02:27 UTC, though separate reporting said the actor provided no proof for its claim.
On August 22, 2026, threat actors impersonated ReliaQuest security staff, used a lookalike domain and fake SSO portal, and convinced one employee to enter credentials and approve an MFA push. ReliaQuest said the attackers gained only a temporary view-only identity-dashboard session, then had the session terminated and the account reset, with no access to internal systems or customer data.
ReliaQuest's @ReliaQuestTR account tweeted that it was tracking another ShinyHunters campaign. The post was later referenced in reporting about ShinyHunters' subsequent claim against ReliaQuest.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcehookphish.com
Open sourcereliaquest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The hacking group **ShinyHunters** claimed to have breached the internal systems of *Resecurity*, a US-based cybersecurity firm, releasing screenshots purportedly showing access to sensitive dashboards, user management panels, API keys, employee data, and internal communications. ShinyHunters alleged they exfiltrated internal chats, client lists, threat intelligence data, and employee information, framing the attack as retaliation for Resecurity's alleged attempts to infiltrate threat actor groups by posing as buyers on dark web markets. The group also credited Devman Ransomware for assistance in the attack and published evidence to support their claims. However, *Resecurity* responded by stating that the data accessed by ShinyHunters was part of a sophisticated honeypot operation designed to monitor and log threat actor activity. According to Resecurity, the honeypot included simulated data and a planted honeytrap account, and there was no impact on actual customers or internal operations. Resecurity confirmed that all data referenced by ShinyHunters originated from the honeypot, and they had already logged the attackers' IP addresses. The incident highlights the ongoing cat-and-mouse dynamics between cybersecurity firms and threat actors, as well as the use of deception technologies in cyber defense.
Jun 29, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026
**Crunchbase** confirmed a cybersecurity incident after the **ShinyHunters** cybercrime group claimed it stole **over 2 million personal records**. ShinyHunters reportedly posted a **402 MB compressed archive** online after an extortion attempt failed, and Crunchbase stated the threat actor **exfiltrated certain documents from its corporate network**. Crunchbase said business operations were not disrupted, the incident was **contained**, external cybersecurity experts were engaged, and **federal law enforcement** was notified while the company reviews the exposed data to determine required legal notifications. In a separate ShinyHunters-linked extortion case, French crypto tax platform **Waltio** was reported to be facing a ransom threat tied to alleged theft of personal data for **nearly 50,000 users**, including threatened exposure of users’ **2024 tax reports**. Waltio stated its services and production systems remained secure and that **no sensitive banking or crypto access data** was compromised. The activity aligns with ShinyHunters’ established pattern of **data theft and leak-site pressure** when ransom demands are not met.
Jun 29, 2026