Loading malware…
ShinySp1d3r is an emerging ransomware family and ransomware-as-a-service offering associated in public reporting with operators linked to ShinyHunters, Scattered Spider, and LAPSUS$, often grouped under the Scattered LAPSUS$ Hunters or SLSH branding. It has been described as a custom encryptor under active development, with multiple reports indicating that it is intended to support sustained criminal operations rather than one-off extortion campaigns. Reporting also indicates overlap with actors previously involved in data theft, SaaS-focused extortion, insider recruitment, and social-engineering-led intrusions.
The malware’s core purpose is file encryption for extortion. Reported functionality includes encryption of local files, the ability to target open network shares, and features for propagation within victim environments using remote administration and enterprise deployment mechanisms. Additional reported behaviors include termination of processes to facilitate encryption, suppression of Windows telemetry or event tracing, and free-space overwriting intended to hinder recovery or analysis. Some reporting also describes support or planned support for VMware ESXi encryption, indicating an ambition to impact virtualized enterprise infrastructure in addition to conventional endpoints and servers.
ShinySp1d3r appears to be positioned as an evolution beyond the operators’ earlier emphasis on pure data theft and extortion. Public reporting suggests the same ecosystem has historically relied on stolen credentials, social engineering, vishing, compromised SaaS integrations, and insider access to obtain footholds in enterprise environments. In that broader intrusion model, ransomware deployment would represent a later-stage monetization step following unauthorized access, data theft, and lateral movement. Some reporting also claims the family may derive from or incorporate elements of HellCat ransomware, but the exact lineage is not fully settled.
Observed and reported targeting is enterprise-focused, with emphasis on large organizations and sectors previously targeted by the associated actor ecosystem, including retail, aviation, telecommunications, finance, software, cloud services, and other high-revenue organizations. Windows is the primary confirmed platform in current reporting, while Linux and ESXi support have been reported as in development or planned. The family remains immature relative to established major ransomware brands, and its name, feature set, and operational use may continue to evolve.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Unit 42 recently identified numerous malicious files while investigating a report on ShinySp1d3r ransomware, which is linked to the cybercrime group ShinyHunters.
On Oct. 4, 2025, the threat actors claimed to be developing a new form of ransomware named “SHINYSP1D3R” as noted in Figures 6 and 7.
...a Telegram channel purportedly led by members of the ShinyHunters, Scattered Spider, and LAPSUS$ hacking groups, which touted the development of the ShinySp1d3r ransomware-as-a-service platform...
...a Telegram channel purportedly led by members of the ShinyHunters, Scattered Spider, and LAPSUS$ hacking groups, which touted the development of the ShinySp1d3r ransomware-as-a-service platform...
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Unit 42 recently identified numerous malicious files while investigating a report on ShinySp1d3r ransomware, which is linked to the cybercrime group ShinyHunters.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named ransomware family referenced in the content via a Unit 42 report title.
In-development RaaS platform attributed to SLSH, adding encryption to an existing data-extortion/social-engineering model; described with evasion, data destruction, and self-contained propagation, with Linux/ESXi versions in development.
A purported joint Ransomware-as-a-Service (RaaS) platform under development, intended to support intrusion and extortion operations.
ShinySp1d3r is a Ransomware-as-a-Service (RaaS) platform promoted by threat actors associated with ShinyHunters, Scattered Spider, and Lapsus$. It is designed to facilitate ransomware operations by providing tools and infrastructure to affiliates, focusing on acquiring privileged access through insider recruitment and initial access brokers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.