Home / Threat actors / ShinyHunters

ShinyHunters G1057

🔔 Create alert

Also known as: UNC6240, Bling Libra

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

56

Techniques

1

Malware and tools

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”

Ransomware operations linked to this group ransomware.live

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2026-35273 Critical · 9.8 KEV Ransomware Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

“ShinyHunters has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure.”

Techniques by tactic

Reconnaissance

T1589.001 Credentials T1593.003 Code Repositories T1595.002 Vulnerability Scanning T1598 Phishing for Information T1598.003 Spearphishing Link

Resource Development

T1583.001 Domains T1583.004 Server T1585.002 Email Accounts T1587.004 Exploits T1588.002 Tool T1588.007 Artificial Intelligence

Initial Access

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application T1195.001 Compromise Software Dependencies and Development Tools

Execution

T1059.007 JavaScript T1059.009 Cloud API T1072 Software Deployment Tools T1203 Exploitation for Client Execution

Persistence

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts

Privilege Escalation

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts

Stealth

T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1684 Social Engineering

Credential Access

T1110 Brute Force T1528 Steal Application Access Token T1552.001 Credentials In Files

Discovery

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1069.003 Cloud Groups T1082 System Information Discovery T1083 File and Directory Discovery T1580 Cloud Infrastructure Discovery T1619 Cloud Storage Object Discovery

Lateral Movement

T1072 Software Deployment Tools T1210 Exploitation of Remote Services T1550.001 Application Access Token

Collection

T1213.003 Code Repositories T1213.006 Databases T1530 Data from Cloud Storage T1560.002 Archive via Library

Command and Control

T1090.003 Multi-hop Proxy T1105 Ingress Tool Transfer T1219 Remote Access Tools T1573.002 Asymmetric Cryptography

Exfiltration

T1567 Exfiltration Over Web Service

Impact

T1485 Data Destruction T1491.001 Internal Defacement T1657 Financial Theft

Malware and tools

TorToolS0183

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.