ShinyHunters

ShinyHunters is a financially motivated cybercriminal collective and data-theft extortion brand active since at least 2020. It has persisted through changes in membership, arrests and disruption of its infrastructure. Name variants include ShinyHunter and Shiny Hunters; associated tracking names include Bling Libra, UNC6040 and UNC6240, although these labels should not necessarily be treated as interchangeable descriptions of every operation. The collective targets corporate cloud and software-as-a-service accounts, as well as government systems. Its targets span information technology, healthcare, telecommunications, professional services, retail and food distribution. Initial-access methods include phishing, voice phishing, impersonation of IT support personnel, use of stolen credentials and exploitation of unpatched enterprise applications. Its social-engineering operations target enterprise identity services, including Okta, while its cloud attacks abuse legitimate OAuth mechanisms to obtain data through activity that can resemble ordinary application traffic. ShinyHunters compromised numerous Snowflake customer environments lacking multifactor authentication and used stolen data for extortion. ShinyHunters primarily monetizes stolen information through demands for payment backed by threats of public disclosure, rather than file encryption. It operates a leak site, publishes victim listings and negotiation deadlines, and releases stolen information to increase pressure. Its activity has included the compromise of the FBI's recruitment platform, exposing employee personal information, sensitive assignment details and medical information. The intrusion was attributed to a failure to apply an issued security patch on a third-party-managed platform. International law-enforcement investigations have resulted in multiple arrests of suspected participants, but the brand and its data-publication infrastructure have continued to operate.