ShinyHunters — Ransomware Profile
ShinyHunters is a prolific data breach and extortion group since 2020. Breached Ticketmaster (560M records), AT&T (110M via Snowflake), Santander Bank. In 2024 exploited Snowflake misconfigurations to breach 160+ companies. French national sentenced to 3 years in January 2024.Also tracked as
UNC6240
IntelFusions coverage (16)
- Microsoft's plan to move EDR out of the kernel takes shape 2026-10-26 · Vulnerabilities
- Vishing call turned one reset into a 100,000-file theft 2026-10-19 · Cyber Incidents
- ShinyHunters brought a CrowdStrike off-switch to PeopleSoft 2026-10-01 · Ransomware
- ShinyHunters claims FBI staff medical records in breach 2026-09-28 · Cyber Incidents
- ShinyHunters dodges WAF rules to hack unpatched PeopleSoft 2026-09-26 · Vulnerabilities
- Some of August's biggest breach claims were fabricated 2026-09-14 · Cyber Incidents
- ShinyHunters claims 284 million records from McKesson 2026-08-31 · Cyber Incidents
- Drug distribution giant McKesson confirms data theft 2026-08-29 · Cyber Incidents
- Abandoned e-learning platform has 13 flaws and no patch 2026-08-20 · Vulnerabilities
- Extortion crew claims Ernst and Young, RingCentral and Brinks Home 2026-07-29 · Ransomware
- Abbott probes two breaches as extortion gangs claim patient data theft 2026-07-20 · Cyber Incidents
- ShinyHunters leaks data on 2.3 million Moody Bible supporters 2026-07-14 · Cyber Incidents
- Critical Oracle, Kemp, and Linux flaws come under active attack 2026-07-06 · Vulnerabilities
- ShinyHunters claims to hit test gear maker Fluke and distributor Ingram Content 2026-07-02 · Ransomware
- LockBit floods its leak site with 26 victims in two days 2026-06-12 · Ransomware
- ShinyHunters breached universities through an Oracle PeopleSoft zero-day 2026-06-12 · Cyber Incidents
Tools & malware
- Mullvad VPN Tunneling Tool
- Salesforce Data Loader Exfiltration Tool
- ToogleBox Recall Tool
- Tor Tunneling Tool
Recent claimed victims
- WARNING 2026-09-30
- Final statement re PSA 2026-09-24
- Fresenius Medical Care 2026-09-22
- PSA - READ THIS NOW 2026-09-22
- Note to Cl0p-_- 2026-09-20
- Kimberly-Clark 2026-09-13
- Medela.com 2026-09-07
- State of Florida DMV 2026-09-07
- Note to mr. databroker1 NEXUS DL Service 2026-09-04
- Neogen Corporation 2026-08-29
- Elekta AB 2026-08-28
- McKesson Corporation 2026-08-28
- Jack Henry & Associates 2026-08-28
- CyrusOne, LLC. 2026-08-23
- ReliaQuest, LLC 2026-08-23
- BOK Financial 2026-08-22
- NovoCure Limited 2026-08-22
- Logitech/ Streamlabs 2026-08-18
- Metabase 2026-08-14
- Sharecare, Inc. 2026-08-14
- Cook Medical LLC 2026-08-14
- Carhartt, Inc. 2026-08-14
- Baxter International, Inc. 2026-08-14
- Questel SAS 2026-08-02
- Alcon Inc. 2026-08-02
Vendor research
- the original report Sekoia.io
- report renewed mass exploitation Google Threat Intelligence
- Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware Kelley, M., Vaya, C
- Dark Web Profile: ShinyHunters SOCRadar
- ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit Mandiant, Google Threat Intelligence Group
- ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications Büyükkaya, A
- ShinyHunters: Cyber Criminal Group Attacks Learning Management System Federal Bureau of Investigation
- Here’s how to guard your enterprise against ShinyHunters Intel 471
- a summary of the claims and the company's response Malwarebytes
- The Cost of a Call: From Voice Phishing to Data Extortion Google Threat Intelligence
- Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft Google Threat Intelligence
- the original report Google Threat Intelligence
- Threat Actor Profile: ShinyHunters Analyst1
- ShinyHunters: Cloud Data Extortion Group Mandiant
Countries linked to this actor
- Réunion origin