ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”12345678
- ElecticIQ Buyukkaya_ShinyHunters_Sept2025
- SOCRadar_ShinyHunters_Mar2024
- Unit42KelleyVaya_BlingLibra_Aug2024
- Intel471_SH_Aug2021
- FBI_SHLMS_May2026
- Google_SHOracle_Jun2026
- Mandiant_SHDataTheft_Jan2026
- Google Salesforce JUN 2025
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1560.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1530 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1528 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1491.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1580 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.009 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.004 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1072 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.007 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.006 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.004 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1485 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1619 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1059.007 | JavaScript | — |
| T1059.009 | Cloud API | — |
| T1069.003 | Cloud Groups | — |
| T1072 | Software Deployment Tools | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1090.003 | Multi-hop Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1110 | Brute Force | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.001 | Compromise Software Dependencies and Development Tools | — |
| T1203 | Exploitation for Client Execution | — |
| T1210 | Exploitation of Remote Services | — |
| T1213.003 | Code Repositories | — |
| T1213.006 | Databases | — |
| T1219 | Remote Access Tools | — |
| T1485 | Data Destruction | — |
| T1491.001 | Internal Defacement | — |
| T1528 | Steal Application Access Token | — |
| T1530 | Data from Cloud Storage | — |
| T1550.001 | Application Access Token | — |
| T1552.001 | Credentials In Files | — |
| T1560.002 | Archive via Library | — |
| T1567 | Exfiltration Over Web Service | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1580 | Cloud Infrastructure Discovery | — |
| T1583.001 | Domains | — |
| T1583.004 | Server | — |
| T1585.002 | Email Accounts | — |
| T1587.004 | Exploits | — |
| T1588.002 | Tool | — |
| T1588.007 | Artificial Intelligence | — |
| T1589.001 | Credentials | — |
| T1593.003 | Code Repositories | — |
| T1595.002 | Vulnerability Scanning | — |
| T1598 | Phishing for Information | — |
| T1598.003 | Spearphishing Link | — |
| T1619 | Cloud Storage Object Discovery | — |
| T1657 | Financial Theft | — |
| T1684 | Social Engineering | — |
别名
Bling Libra · ShinyHunters · UNC6240
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。