ShinyHunters

ShinyHunters is a financially motivated cybercriminal threat actor best known for large-scale data theft, extortion, and intrusion activity targeting cloud and SaaS environments. The group is widely associated with theft-and-extortion operations in which stolen data is used for "pay or leak" coercion, and has also been linked to ransomware-style victim shaming and public leak activity. ShinyHunters is not a nation-state actor; it is generally tracked as part of the cybercrime ecosystem. Known aliases and related tracking names include ShinyHunter, shinyhunters, shiny_hunters, Bling Libra, UNC6040, and UNC6240. Some reporting distinguishes between clusters associated with initial access and follow-on extortion while noting that the operators or affiliates have claimed the ShinyHunters name during victim interactions. Related activity has also overlapped with other tracked clusters in the broader ecosystem. Recent operations have been strongly associated with attacks against Salesforce and other SaaS-connected business applications. Tradecraft includes voice phishing in which operators impersonate IT support personnel to trick users into authorizing malicious OAuth connected applications, often masquerading as legitimate enterprise tools. Once consent is granted, the attackers inherit the victim user's existing privileges, enabling persistent API-based access, CRM data discovery, and bulk exfiltration while blending into normal application traffic. This activity has been notable because it abuses trusted identity and application relationships rather than relying on malware deployment or exploitation of an inherent Salesforce software vulnerability. ShinyHunters-linked activity has also involved compromise of third-party vendors and downstream SaaS integrations. In these cases, attackers obtained OAuth tokens, refresh tokens, or other connection secrets from trusted service providers and then used those trusted integrations to access customer Salesforce environments and extract data. Additional observed tradecraft includes abuse of misconfigured guest access in Salesforce Experience Cloud and Aura endpoints, including chained GraphQL-style requests to retrieve excessive data where guest permissions were overly permissive. The group has targeted organizations across multiple sectors, including retail, education, manufacturing, healthcare, telecommunications, travel, and technology. Victim reporting and public investigations have tied the name to campaigns affecting enterprises, universities, telecom providers, and cloud-connected service platforms. Education and CRM-heavy environments have been especially prominent in recent reporting, with operations focused on high-volume theft of customer, student, employee, and support-case data. Operationally, ShinyHunters is associated with social engineering, credential theft, abuse of legitimate cloud application integrations, persistence through approved applications, large-scale data collection from information repositories, and exfiltration over web services. Publicly described ATT&CK-aligned behaviors include Voice Phishing, Steal Application Access Token, Cloud Application Integration abuse, Data from Information Repositories including CRM platforms, and Exfiltration Over Web Service. The group's methods are designed to evade traditional authentication-focused detections by operating through approved apps, valid sessions, and trusted integrations. ShinyHunters has also been associated with public extortion branding in which victims are pressured with deadlines and threats of data publication if payment is not made. In some incidents, the actor or affiliates have claimed destructive or ransomware-related impact, but the most consistently corroborated pattern is data theft followed by extortion rather than classic encryption-led ransomware operations. Overall, ShinyHunters is a prominent cybercriminal brand associated with opportunistic but high-impact intrusions, especially where identity workflows, OAuth trust relationships, third-party SaaS integrations, and weak cloud configuration controls can be abused to obtain and monetize sensitive data at scale.