ShinyHunters: threat actor profile

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. (MITRE ATT&CK, G1057)

Also known as: UNC6240, Bling Libra

Attacks we reported

1. Nov 3, 2026 Harvard Data Breach Exposes 850,537 Accounts on Have I Been Pwned
2. Oct 29, 2026 Unit 42 Warns Retailers of Peak Season Cyber Threats
3. Oct 27, 2026 Zero Day Initiative discloses SSRF-to-RCE in Oracle PeopleSoft

46 techniques MITRE has documented for this group

1. Reconnaissance Gather Victim Identity Information: Credentials T1589.001 · Search Open Websites/Domains: Code Repositories T1593.003 · Active Scanning: Vulnerability Scanning T1595.002 · Phishing for Information T1598 · Phishing for Information: Spearphishing Link T1598.003
2. Resource Development Acquire Infrastructure: Domains T1583.001 · Acquire Infrastructure: Server T1583.004 · Establish Accounts: Email Accounts T1585.002 · Develop Capabilities: Exploits T1587.004 · Obtain Capabilities: Tool T1588.002 · Obtain Capabilities: Artificial Intelligence T1588.007
3. Initial Access Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Cloud Accounts T1078.004 · Exploit Public-Facing Application T1190 · Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1195.001
4. Execution Command and Scripting Interpreter: JavaScript T1059.007 · Command and Scripting Interpreter: Cloud API T1059.009 · Software Deployment Tools T1072 · Exploitation for Client Execution T1203
5. Persistence Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Cloud Accounts T1078.004
6. Privilege Escalation Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Cloud Accounts T1078.004
7. Stealth Masquerading: Match Legitimate Resource Name or Location T1036.005 · Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Cloud Accounts T1078.004 · Social Engineering T1684
8. Credential Access Brute Force T1110 · Steal Application Access Token T1528 · Unsecured Credentials: Credentials In Files T1552.001
9. Discovery System Network Configuration Discovery T1016 · Remote System Discovery T1018 · Permission Groups Discovery: Cloud Groups T1069.003 · System Information Discovery T1082 · File and Directory Discovery T1083 · Cloud Infrastructure Discovery T1580 · Cloud Storage Object Discovery T1619
10. Lateral Movement Software Deployment Tools T1072 · Exploitation of Remote Services T1210 · Use Alternate Authentication Material: Application Access Token T1550.001
11. Collection Data from Information Repositories: Code Repositories T1213.003 · Data from Information Repositories: Databases T1213.006 · Data from Cloud Storage T1530 · Archive Collected Data: Archive via Library T1560.002
12. Command and Control Proxy: Multi-hop Proxy T1090.003 · Ingress Tool Transfer T1105 · Remote Access Tools T1219 · Encrypted Channel: Asymmetric Cryptography T1573.002
13. Exfiltration Exfiltration Over Web Service T1567
14. Impact Data Destruction T1485 · Defacement: Internal Defacement T1491.001 · Financial Theft T1657

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).