Watch Floor
RansomwareMITRE G1057

ShinyHunters

Also known as UNC6240, Bling Libra

9mentions, 7 days
24mentions, 30 days
0victims posted, 30 days
Nov 5, 2026last mentioned

ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain. The group is known for its sophisticated attacks against a wide range of targets, including businesses, organizations, and government agencies. ShinyHunters typically uses phishing attacks and exploit kits to gain access to victim networks, where they deploy malware to steal sensitive data, such as names, addresses, phone numbers, Social Security numbers, and credit card information.

CVEs in recent coverage

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1036.005 Match Legitimate Resource Name or LocationT1059.007 JavaScriptT1059.009 Cloud APIT1069.003 Cloud GroupsT1072 Software Deployment ToolsT1078 Valid AccountsT1078.002 Domain AccountsT1078.004 Cloud AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1090.003 Multi-hop ProxyT1105 Ingress Tool TransferT1110 Brute ForceT1190 Exploit Public-Facing ApplicationT1195.001 Compromise Software Dependencies and Development ToolsT1203 Exploitation for Client ExecutionT1210 Exploitation of Remote ServicesT1213 Data from Information RepositoriesT1213.003 Code RepositoriesT1213.006 DatabasesT1219 Remote Access ToolsT1485 Data DestructionT1486 Data Encrypted for ImpactT1491.001 Internal DefacementT1528 Steal Application Access TokenT1530 Data from Cloud StorageT1550.001 Application Access TokenT1552.001 Credentials In FilesT1552.004 Private KeysT1560.002 Archive via LibraryT1566.003 Spearphishing via ServiceT1567 Exfiltration Over Web ServiceT1573.002 Asymmetric CryptographyT1580 Cloud Infrastructure DiscoveryT1583.001 DomainsT1583.004 ServerT1585.002 Email AccountsT1587.004 ExploitsT1588.002 ToolT1588.007 Artificial IntelligenceT1589.001 CredentialsT1593.003 Code RepositoriesT1595.002 Vulnerability ScanningT1598 Phishing for InformationT1598.002 Spearphishing AttachmentT1598.003 Spearphishing LinkT1619 Cloud Storage Object DiscoveryT1657 Financial TheftT1684 Social Engineering

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.