Home/ Threat Actors/ ShinyHunters

🌐ShinyHunters

🌐 ShinyHunters is a tracked threat actor in the Clankerusecase corpus. ??-aligned. Primary motivation: Unknown. We map 12 detection use cases to this actor across 46 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G1057) ↗

12Use cases

0Articles

46Techniques

0IOCs

About this actor (MITRE)

[ShinyHunters](https://attack.mitre.org/groups/G1057) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. [ShinyHunters](https://attack.mitre.org/groups/G1057) has been associated with the broader collective called The Community, also known as The Com whose members have also included [Scattered Spider](https://atta

Known aliases

ShinyHuntersUNC6240Bling Libra

Top techniques

T1016 · System Network Configuration Discovery T1018 · Remote System Discovery T1036.005 · Match Legitimate Resource Name or Location

All other tracked techniques

T1059.007 · JavaScript T1059.009 · Cloud API T1069.003 · Cloud Groups T1072 · Software Deployment Tools T1078 · Valid Accounts T1078.002 · Domain Accounts T1078.004 · Cloud Accounts T1082 · System Information Discovery T1083 · File and Directory Discovery T1090.003 · Multi-hop Proxy T1105 · Ingress Tool Transfer T1110 · Brute Force T1190 · Exploit Public-Facing Application T1195.001 · Compromise Software Dependencies and Development Tools T1203 · Exploitation for Client Execution T1210 · Exploitation of Remote Services T1213.003 · Code Repositories T1213.006 · Databases T1219 · Remote Access Tools T1485 · Data Destruction T1491.001 · Internal Defacement T1528 · Steal Application Access Token T1530 · Data from Cloud Storage T1550.001 · Application Access Token T1552.001 · Credentials In Files T1560.002 · Archive via Library T1567 · Exfiltration Over Web Service T1573.002 · Asymmetric Cryptography T1580 · Cloud Infrastructure Discovery T1583.001 · Domains T1583.004 · Server T1585.002 · Email Accounts T1587.004 · Exploits T1588.002 · Tool T1588.007 · Artificial Intelligence T1589.001 · Credentials T1593.003 · Code Repositories T1595.002 · Vulnerability Scanning T1598 · Phishing for Information T1598.003 · Spearphishing Link T1619 · Cloud Storage Object Discovery T1657 · Financial Theft T1684 · Social Engineering

Detection use cases (12)

1Password activity from Tor exit node MITRE match 1Password failed sign-in burst MITRE match 1Password impossible-travel sign-in MITRE match AI/LLM Agent Framework Runtime Spawning Shell, Recon, or Egress Child Process MITRE match AI/LLM Framework Web Service Spawns Shell or Network Tool (Agent-Framework Unauthenticated RCE) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Dev/CI Toolchain Credential Read + Egress to Non-Canonical Registry MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Install-Triggered Registry Publish or Git Push (Supply-Chain Worm Self-Propagation) MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match