Início / Grupos de ameaça / ShinyHunters

ShinyHunters G1057

🔔 Criar alerta

Também conhecido como: UNC6240, Bling Libra

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

56

Técnicas

1

Malwares e ferramentas

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”

Operações de ransomware ligadas a este grupo ransomware.live

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2026-35273 Crítica · 9.8 KEV Ransomware Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

“ShinyHunters has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure.”

Técnicas por tática

Reconhecimento

T1589.001 Credentials T1593.003 Code Repositories T1595.002 Vulnerability Scanning T1598 Phishing for Information T1598.003 Spearphishing Link

Desenvolvimento de recursos

T1583.001 Domains T1583.004 Server T1585.002 Email Accounts T1587.004 Exploits T1588.002 Tool T1588.007 Artificial Intelligence

Acesso inicial

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application T1195.001 Compromise Software Dependencies and Development Tools

Execução

T1059.007 JavaScript T1059.009 Cloud API T1072 Software Deployment Tools T1203 Exploitation for Client Execution

Persistência

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts

Escalada de privilégios

T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts

Furtividade

T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1684 Social Engineering

Acesso a credenciais

T1110 Brute Force T1528 Steal Application Access Token T1552.001 Credentials In Files

Descoberta

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1069.003 Cloud Groups T1082 System Information Discovery T1083 File and Directory Discovery T1580 Cloud Infrastructure Discovery T1619 Cloud Storage Object Discovery

Movimento lateral

T1072 Software Deployment Tools T1210 Exploitation of Remote Services T1550.001 Application Access Token

Coleta

T1213.003 Code Repositories T1213.006 Databases T1530 Data from Cloud Storage T1560.002 Archive via Library

Comando e controle

T1090.003 Multi-hop Proxy T1105 Ingress Tool Transfer T1219 Remote Access Tools T1573.002 Asymmetric Cryptography

Exfiltração

T1567 Exfiltration Over Web Service

Impacto

T1485 Data Destruction T1491.001 Internal Defacement T1657 Financial Theft

Malwares e ferramentas

TorFerramentaS0183

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.