ShinyHunters
- ID
- G1057
- Associated names
- UNC6240, Bling Libra
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”[1][2][3][4][5][6][7][8]
Techniques used (46)
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1059.007 JavaScript
- T1059.009 Cloud API
- T1069.003 Cloud Groups
- T1072 Software Deployment Tools
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1078.004 Cloud Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1090.003 Multi-hop Proxy
- T1105 Ingress Tool Transfer
- T1110 Brute Force
- T1190 Exploit Public-Facing Application
- T1195.001 Compromise Software Dependencies and Development Tools
- T1203 Exploitation for Client Execution
- T1210 Exploitation of Remote Services
- T1213.003 Code Repositories
- T1213.006 Databases
- T1219 Remote Access Tools
- T1485 Data Destruction
- T1491.001 Internal Defacement
- T1528 Steal Application Access Token
- T1530 Data from Cloud Storage
- T1550.001 Application Access Token
- T1552.001 Credentials In Files
- T1560.002 Archive via Library
- T1567 Exfiltration Over Web Service
- T1573.002 Asymmetric Cryptography
- T1580 Cloud Infrastructure Discovery
- T1583.001 Domains
- T1583.004 Server
- T1585.002 Email Accounts
- T1587.004 Exploits
- T1588.002 Tool
- T1588.007 Artificial Intelligence
- T1589.001 Credentials
- T1593.003 Code Repositories
- T1595.002 Vulnerability Scanning
- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1619 Cloud Storage Object Discovery
- T1657 Financial Theft
- T1684 Social Engineering
