Skip to content

ShinyHunters

IntrusionSet · ATTACK:enterprise:G1057

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1057",
  "title": "ShinyHunters",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1057",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--5e30362d-935b-4b1c-8bf2-96c7b7b7e299",
  "external_id": "G1057",
  "domain": "enterprise",
  "created": "2026-07-29T14:27:00.016Z",
  "modified": "2026-07-31T18:47:57.967Z",
  "version": "1.0",
  "aliases": [
    "ShinyHunters",
    "UNC6240",
    "Bling Libra"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "UNC6240"
    },
    {
      "source_name": "Bling Libra"
    },
    {
      "source_name": "ElecticIQ Buyukkaya_ShinyHunters_Sept2025",
      "url": "https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"
    },
    {
      "source_name": "FBI_SHLMS_May2026",
      "url": "https://www.ic3.gov/PSA/2026/PSA260515"
    },
    {
      "source_name": "Google Salesforce JUN 2025",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"
    },
    {
      "source_name": "Intel471_SH_Aug2021",
      "url": "https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"
    },
    {
      "source_name": "Unit42KelleyVaya_BlingLibra_Aug2024",
      "url": "https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"
    },
    {
      "source_name": "Google_SHOracle_Jun2026",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"
    },
    {
      "source_name": "Mandiant_SHDataTheft_Jan2026",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft"
    },
    {
      "source_name": "SOCRadar_ShinyHunters_Mar2024",
      "url": "https://socradar.io/dark-web-profile-shinyhunters/"
    }
  ]
}

Explicit source assertions (47)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1560.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a2a16f7-92e1-4065-897f-b12f3856dcba

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1550.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1af6f63b-b54b-496a-a85f-dbedf2f79b9c

Intel471_SH_Aug2021

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ba12f04-859e-471e-9dfd-4f74e402220d

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ce64576-d10f-4ea6-b818-801436d8cc39

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1585.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23c5db03-ed4a-4021-835f-32f719e4bd9c

Google Salesforce JUN 2025 · Unit42KelleyVaya_BlingLibra_Aug2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--272163a2-0b55-4d7a-b955-b7fa1022a7e2

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--366015da-df59-466c-98fb-8d31d545d09c

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--430c6ce1-4461-4c3a-b7e2-3617cc82483a

ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--441bf771-bc3a-43ba-bd84-7d77f82d5ab3

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4677c432-d537-4d61-bc25-efe1b608c378

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cbfc615-1e0d-4140-bf36-8b83b6a087d2

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1567

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58fd919a-44e2-46d5-ac18-bb327e80b3ff

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1598.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f8667b5-b957-4f45-9c58-07321db8f62a

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--630900fe-588f-44af-8f46-f722c503b6fd

Intel471_SH_Aug2021

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1528

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68501418-9bf5-4f7f-a29e-0c11111bf791

Intel471_SH_Aug2021 · SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69d75d5b-0780-4618-aca4-3a9c9b1e2aee

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ef45519-7ca1-44a4-8421-152af4e85d68

ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · Unit42KelleyVaya_BlingLibra_Aug2024 · Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1213.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79305255-7451-45ad-b265-b641e97f7182

Intel471_SH_Aug2021

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1684

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8315ce9b-e122-467d-8304-5b0badcef750

FBI_SHLMS_May2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8658fc97-dc3a-4d39-8cb6-c0590b88cd14

Intel471_SH_Aug2021

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1078.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8afa26f2-4df2-4d97-b2c8-747683443803

Intel471_SH_Aug2021 · Unit42KelleyVaya_BlingLibra_Aug2024 · SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9102a3f8-73c4-4a07-934c-13045415cc6a

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:S0183

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--923e0272-913c-4b2e-a59e-d40fd5e0ba64

FBI_SHLMS_May2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9604d3ad-329e-47bc-863e-a7528ad13739

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1491.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b48e1b5-e52b-44a2-9a8e-6e21126c3705

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c368600-66c9-4fad-bd0f-faa82eb26304

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1219

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c3aa1cd-a210-4995-851f-7364bf5bb313

ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1598

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e666441-93dc-406d-b8bd-d92155746fa3

Intel471_SH_Aug2021

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1195.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e76a5cb-c329-4ee6-937e-c1a37c248d19

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1657

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adae2782-ce69-4587-bfb0-2417ee44e0fa

ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · FBI_SHLMS_May2026 · Google Salesforce JUN 2025 · Intel471_SH_Aug2021 · Unit42KelleyVaya_BlingLibra_Aug2024 · Mandiant_SHDataTheft_Jan2026 · SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1580

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b04004a8-57bd-4245-813b-9e64ede24a18

Unit42KelleyVaya_BlingLibra_Aug2024 · SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bae9c6ec-2d33-418b-b7db-8b99af22e32f

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1059.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc4b3d58-4a4c-43e4-94c5-bced84db2c97

Unit42KelleyVaya_BlingLibra_Aug2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1583.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf1ca7bb-41e7-45ea-88b1-893600ac5b90

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1072

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c331ae1d-c490-4366-9b39-e2b68073e606

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1588.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c53d31c2-d849-41cc-b505-fb8f21447dc3

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1110

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c728ccae-df91-4801-824d-2e235269eb8f

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1213.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0d35cd6-3fdb-476e-b830-214f32c2d104

ElecticIQ Buyukkaya_ShinyHunters_Sept2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1589.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2ac3384-00db-49f0-bf3b-6c545c1b91e0

Intel471_SH_Aug2021 · Unit42KelleyVaya_BlingLibra_Aug2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1593.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3d82b76-254e-4cdc-b50d-66bdd5a70efd

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df55f1d1-f7a0-4e93-af6a-ee4e47d0b809

ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · FBI_SHLMS_May2026 · Google_SHOracle_Jun2026 · Mandiant_SHDataTheft_Jan2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e415632a-d3e4-4b15-b285-4eab032989e4

FBI_SHLMS_May2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1587.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e66f8174-7b2f-43bc-885e-fab4859398fb

Google_SHOracle_Jun2026

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1485

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f105ba9c-5c64-4728-9f97-aa3b6d8ed274

Unit42KelleyVaya_BlingLibra_Aug2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1619

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3a9dfb6-a028-4f80-8823-32b43c9a3fc2

Unit42KelleyVaya_BlingLibra_Aug2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1069.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f453dbd9-d26e-4e56-88eb-25d37f7aae39

Unit42KelleyVaya_BlingLibra_Aug2024

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1595.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9304e7f-8ce3-488d-b5b7-32351024fe4a

SOCRadar_ShinyHunters_Mar2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.