ShinyHunters

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”^12345678

1. ElecticIQ Buyukkaya_ShinyHunters_Sept2025
2. SOCRadar_ShinyHunters_Mar2024
3. Unit42KelleyVaya_BlingLibra_Aug2024
4. Intel471_SH_Aug2021
5. FBI_SHLMS_May2026
6. Google_SHOracle_Jun2026
7. Mandiant_SHDataTheft_Jan2026
8. Google Salesforce JUN 2025

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

Technique use

Aliases

Bling Libra · ShinyHunters · UNC6240

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections