← All threat actors
ShinyHuntersG1057 ↗
ShinyHunters is a cybercriminal group of unknown origin that is motivated by financial gain. The group is known for its sophisticated attacks against a wide range of targets, including businesses, organizations, and government agencies. ShinyHunters typically uses phishing attacks and exploit kits to gain access to victim networks, where they deploy malware to steal sensitive data, such as names, addresses, phone numbers, Social Security numbers, and credit card information.
Motivation
Unknown
Suspected origin
Unknown
Reports / IOCs (VT)
2,721 reports · 22 IOCs
Reported activity
2022 – 2026
Targeted industries
—Targeted regions
—CVEs seen in reporting
ATT&CK techniques in reports
- T1078 Valid Accounts19
- T1567 Exfiltration Over Web Service13
- T1190 Exploit Public-Facing Application12
- T1566 Phishing12
- T1528 Steal Application Access Token12
- T1078.004 Cloud Accounts10
- T1199 Trusted Relationship9
- T1213 Data from Information Repositories9
- T1566.004 Spearphishing Voice8
- T1530 Data from Cloud Storage8
- T1486 Data Encrypted for Impact7
- T1027 Obfuscated Files or Information6
- T1552.001 Credentials In Files6
- T1567.002 Exfiltration to Cloud Storage6
- T1219 Remote Access Tools5
- T1580 Cloud Infrastructure Discovery5
- T1598.004 Spearphishing Voice5
- T1005 Data from Local System5
- T1090 Proxy4
- T1657 Financial Theft4