Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Cybercrime10 malware familiesExploits CVEs in the wild

ShinyHunters

Also known asBling Librashiny_huntersshinyhuntershinyhuntersUNC6040unc6240

ShinyHunters is a financially motivated cybercriminal extortion group known for data theft and "pay or leak" operations. Aliases in the provided content include bling_libra, shinyhunter, shinyhunters, shiny_hunters, UNC6040, and UNC6240. The content also references Mandiant tracking related ShinyHunters-affiliated vishing activity under clusters including UNC6240 and UNC6661. Based on the provided reporting, ShinyHunters has targeted a wide range of organizations, including insurance, telecommunications infrastructure, sports and entertainment, higher education, and education technology. Reported victims or claimed victims in the content include the National Association of Insurance Commissioners (NAIC), American Tower, Madison Square Garden / Madison Square Garden Sports / Madison Square Garden Entertainment, Instructure Canvas, and the University of Nottingham. The group is described as specializing in extortion and cascading or supply-chain-style campaigns. Multiple reports in the content state that ShinyHunters conducted "pay or leak" extortion, published stolen data on a dark web leak site, and in some cases leaked data after ransom demands were not met. The content specifically describes publication of allegedly stolen data from NAIC, American Tower, Madison Square Garden, Madison Square Garden Sports, and the European Commission-related incident where ShinyHunters later published stolen data. Tactics and techniques directly mentioned in the content include exploitation of Oracle PeopleSoft vulnerabilities, including reporting that ShinyHunters began exploiting a reported PeopleSoft zero-day on May 27 and that more than 100 organizations were compromised before Oracle released an emergency update on June 10. The content also states that ShinyHunters claimed to exploit a combination of zero-day vulnerabilities and older unpatched flaws in PeopleSoft environments, affecting both cloud-hosted and on-premises deployments. Separately, the content repeatedly associates ShinyHunters with social engineering, especially vishing. In the Madison Square Garden Entertainment intrusion, reporting cited in the content says the initial compromise occurred through a voice-phishing call to a low-level employee, leading to theft of Microsoft Entra credentials. The content also says ShinyHunters used a similar vishing playbook against Charter Communications and breached ADT by compromising an Okta SSO account and then moving into Salesforce. The content further notes that phishing-resistant MFA can eliminate social-engineering vectors exploited by groups like ShinyHunters. The group is portrayed as capable of causing major disruption without relying on malware or zero-days in every case. The content explicitly states that groups like ShinyHunters do not necessarily need malware or zero-day exploits to cause massive damage. Reported post-compromise activity includes data theft from ticketing systems, customer support platforms, SharePoint and OneDrive-related environments, and publication of large archives containing customer, corporate, and operational data. The content also links ShinyHunters to broader criminal ecosystem activity. One report says TeamPCP maintained partnerships or overlap with ShinyHunters, and another states ShinyHunters later published data stolen in the TeamPCP-related European Commission incident. The content does not provide high-confidence evidence that ShinyHunters is a nation-state actor; it is described as a cybercriminal group.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Government & Administration
MITRE ATT&CK

Tradecraft

39 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

13 of 15 tactics44 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
3 techniques
T1589
Gather Victim Identity Information
T1590
Gather Victim Network Information
T1598×2
Phishing for Information
T1598.004×2
Spearphishing Voice
TA0001
Initial Access
4 techniques
T1078×7
Valid Accounts
T1078.004
Cloud Accounts
T1190×8
Exploit Public-Facing Application
T1195×2
Supply Chain Compromise
T1566×2
Phishing
T1566.002
Spearphishing Link
T1566.004
Spearphishing Voice
TA0002
Execution
1 technique
T1203
Exploitation for Client Execution
TA0003
Persistence
1 technique
T1078×7
Valid Accounts
T1078.004
Cloud Accounts
TA0004
Privilege Escalation
1 technique
T1078×7
Valid Accounts
T1078.004
Cloud Accounts
TA0005
Stealth
2 techniques
T1036
Masquerading
T1078×7
Valid Accounts
T1078.004
Cloud Accounts
TA0006
Credential Access
3 techniques
T1528
Steal Application Access Token
T1621
Multi-Factor Authentication Request Generation
T1649×4
Steal or Forge Authentication Certificates
TA0007
Discovery
2 techniques
T1082×2
System Information Discovery
T1083
File and Directory Discovery
TA0008
Lateral Movement
4 techniques
T1021
Remote Services
T1021.004
SSH
T1534
Internal Spearphishing
T1550
Use Alternate Authentication Material
T1570
Lateral Tool Transfer
TA0009
Collection
5 techniques
T1074×4
Data Staged
T1119
Automated Collection
T1213×7
Data from Information Repositories
T1530
Data from Cloud Storage
T1560
Archive Collected Data
T1560.001
Archive via Utility
TA0011
Command and Control
2 techniques
T1071
Application Layer Protocol
T1219
Remote Access Tools
TA0010
Exfiltration
4 techniques
T1041×5
Exfiltration Over C2 Channel
T1048×2
Exfiltration Over Alternative Protocol
T1537×5
Transfer Data to Cloud Account
T1567×5
Exfiltration Over Web Service
T1567.003
Exfiltration to Text Storage Sites
TA0040
Impact
2 techniques
T1486×10
Data Encrypted for Impact
T1657×9
Financial Theft
WEAPONIZED

Associated vulnerabilities

5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.

CVE-2026-35273Unauthenticated RCE in Oracle PeopleSoft PeopleTools Environment Management Hub (PSEMHUB)In the wildEvidence23

The group added a fourth vector in June 2026: exploitation of CVE-2026-35273, a critical remote code execution zero-day in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62, rated CVSS 9.8. The vulnerability sits in the Updates Environment Management component, specifically the Environment Management Hub (PSEMHUB) endpoints, and requires no authentication, no user interaction, and only HTTP network access to achieve remote code execution.

CVE-2026-33634Trivy supply chain compromise via malicious release and retagged GitHub ActionsIn the wildEvidence4

BleepingComputer reported that threat actors leveraged credentials stolen through the Trivy supply chain compromise (CVE-2026-33634) to breach Cisco's internal development environment... The CISA KEV remediation deadline for CVE-2026-33634 is today, April 8, 2026... Beyond patching Trivy to v0.69.2+, trivy-action to v0.35.0, or setup-trivy to v0.2.6, organizations must also complete credential rotation.

CVE-2025-61882Unauthenticated RCE in Oracle E-Business Suite Concurrent Processing BI Publisher IntegrationIn the wildEvidence3

It has since been determined that hackers likely exploited known EBS vulnerabilities patched in July, likely along with a zero-day flaw tracked as CVE-2025-61882. The hacker groups ShinyHunters and Scattered Spider ... have published a proof-of-concept (PoC) exploit that appears to target CVE-2025-61882 ... according to Oracle, CVE-2025-61882 allows unauthenticated remote code execution. CrowdStrike has found evidence that exploitation of CVE-2025-61882 started on August 9.

CVE-2025-61884Authentication Bypass in Oracle E-Business Suite Oracle Configurator Runtime UIIn the wildEvidence2

CISA on Monday added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog, confirming its exploitation.

CVE-2021-35587Oracle Access Manager OpenSSO Agent takeover vulnerabilityIn the wildEvidence1

According to data obtained from a public Telegram channel operated by the ShinyHunters team, the threat actor persona ‘Yukari’ exploited an Oracle Access Manager vulnerability (CVE-2021-35587). The attack targeted financial institutions and manufacturers.

IOCS

Observables

63 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping39

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal10

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs5

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables63

Domains, IPs, and hashes tied to this actor, refreshed continuously.