ShinyHunters

Techniques (MITRE ATT&CK)46

Sourceransomware.live

Also known as:UNC6240Bling Libra

Vexday analysis

ShinyHunters é um grupo motivado financeiramente, ativo desde 2020, especializado em roubo de dados e extorsão, responsável por violações de alto perfil como Ticketmaster (via Snowflake) e PowerSchool. Em 2025, o grupo lançou uma oferta de Ransomware-as-a-Service denominada "shinysp1d3r", expandindo seu modelo operacional. Em agosto de 2025, autoridades francesas prenderam quatro membros da organização.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity70

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 46

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Credentials Code Repositories Vulnerability Scanning Phishing for Information Spearphishing Link

Resource development

Domains Server Email Accounts Exploits Tool Artificial Intelligence

Initial access

Exploit Public-Facing Application Compromise Software Dependencies and Development Tools

Execution

JavaScript Cloud API Software Deployment Tools Exploitation for Client Execution

Credential access

Brute Force Steal Application Access Token Credentials In Files

Discovery

System Network Configuration Discovery Remote System Discovery Cloud Groups System Information Discovery File and Directory Discovery Cloud Infrastructure Discovery Cloud Storage Object Discovery

Lateral movement

Exploitation of Remote Services Application Access Token

Collection

Code Repositories Databases Data from Cloud Storage Archive via Library

Command and control

Multi-hop Proxy Ingress Tool Transfer Remote Access Tools Asymmetric Cryptography

Exfiltration

Exfiltration Over Web Service

Impact

Data Destruction Internal Defacement Financial Theft

stealth

Match Legitimate Resource Name or Location Valid Accounts Domain Accounts Cloud Accounts Social Engineering

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV CVE-2026-35273CRITICALEPSS 95%KEV CVE-2016-6662EPSS 68%CVE-2017-0176EPSS 46%

References

ShinyHunters uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →