Search threats, CVEs… ⌘K
← Back to all threat actors

ShinyHunters

Also known as UNC6240, Bling Libra, SLH, SLSH, Scattered LAPSUS$ Hunters, Rey, Scattered Lapsus$ Hunters, ShinyHunters
Tracked as G1057

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. ShinyHunters has been associated with the broader collective called The Community, also known as The Com whose members have also included Scattered Spider and LAPSUS$. Public reporting has mentioned a variety of names for operations ShinyHunters members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”

How we source and review actor profiles
Sectors
agriculture-and-food-production, business-services, consumer-services, education, energy, financial-services, healthcare, manufacturing, technology, telecommunication
Status
Active

Threat intelligence assessment

At a glance

Facts

  • UAC-0099 is Russia-aligned
  • Flax Typhoon is China-linked
  • ShinyHunters is a notorious cybercrime group
  • Dropping Elephant targets strategically significant sectors
  • Bitter targeted a European embassy in Asia

Activity timeline

Facts

  • Threat actors exploited CVE-2026-21589 within two hours of technical details release
  • P7 DarkSword is distributed via malicious ads in watering hole attacks
  • UAC-0099 refined MATCHBOIL to contact C2 server every two minutes for payload updates
  • Dropping Elephant uses spear-phishing campaigns with malicious LNK attachments
  • Bitter used FIFA World Cup-themed lure in spear-phishing email
  • Attackers hijacked ccTLDs for Ghana, American Samoa, and Sierra Leone to obtain Google certificates
  • GoBalance flaw enabled takeover of Dread darknet forum and other darknet marketplaces

Attribution assessment

Facts

  • Dropping Elephant is also known as Patchwork
  • Bitter is assessed to be operating with interests aligned to India
  • Dropping Elephant is assessed to have India-nexus interests
  • Dark Clark is a Russia-aligned influence operation
  • Bogus Bylines is an Iran-aligned influence operation

Operational playbook

Facts

  • Operates with a division of labor including initial access from social engineers, amplification and recruitment from adjacent actors, and monetization under a shared brand
  • The resilience comes from a modular structure rather than single leadership or cell

Initial access and identity targets

Facts

  • Spear-phishing with malicious LNK attachments
  • Remote Desktop Protocol (RDP)
  • Malicious ads via watering hole attacks
  • Compromised third-party registrar operators
  • Email bearing FIFA World Cup-themed lure from compromised diplomatic mailbox

Capabilities and evasion

Facts

  • P7 DarkSword extracts Keychain data directly on iPhone before exfiltration
  • P7 DarkSword supports on-device keychain and crypto-wallet theft
  • P7 DarkSword facilitates two-way C2 communication
  • MATCHBOIL evolved to run every two minutes and fetch updated payloads
  • Microscan conducts reconnaissance and computer vulnerability scanning
  • FishHub enables exploitation through spear-phishing and payload deployment
  • Malware families embed AI-Analysis Evasion (A3) capabilities with natural-language instructions

Infrastructure patterns

Facts

  • Flax Typhoon positioned itself within critical infrastructure networks including OT systems
  • Integrity Technology develops cyber ranges and received extensive government funding in China
  • Integrity Technology founded in 2010 by Cai Jingjing
  • Attackers modified authoritative DNS records of hijacked ccTLDs

Communication and pressure channels

Facts

  • ShinyHunters uses Telegram for group communications
  • AvisLoader communicates via Fox, an encrypted P2P messaging network

Observed targeting

Facts

  • Dropping Elephant targets government, defense, naval, aerospace/UAV, and academic sectors
  • Dropping Elephant targets Pakistan, Sri Lanka, China, and South Korea
  • Bitter targeted European embassy in Asia
  • Flax Typhoon aims to disrupt critical functions at a future time of their choosing

Named victims

Organizations

  • Atlassian Data Center products users
  • FBIjobs.gov
  • Google
  • Dread darknet forum
  • darknet marketplaces
  • Uranium Finance
  • Dutch Institute for Vulnerability Disclosure (DIVD)
  • European embassy in Asia
  • organizations targeted by Dropping Elephant
  • organizations impacted by ccTLD hijacks

Defender guidance

Facts

  • Patch Atlassian Data Center products urgently
  • Let's Encrypt reducing TLS certificate lifetimes to 64 days starting February 2027
  • Organizations should protect every layer of AI infrastructure stack
  • CISA required federal agencies to patch Zammad flaws by October 5, 2026

Reported detail

Facts

  • Multiple threat actors rapidly exploited newly disclosed vulnerabilities, with Atlassian flaw exploitation occurring within hours of technical details release.
  • ShinyHunters cybercrime group faced multiple FBI arrests; the group announced plans to cease Telegram operations due to law enforcement action.
  • Advanced threat actors including Russia-aligned UAC-0099 and China-linked Flax Typhoon refined malware and positioned themselves in critical infrastructure for future disruption.
  • Unknown attackers hijacked country-code domain registries to obtain unauthorized HTTPS certificates for Google and other organizations.
  • Malware authors adopted AI-Analysis Evasion techniques embedding natural-language instructions to evade automated security analysis.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
Indicator27 indicators cataloged

Types: domain, tool.

First observed
CVECVE-2026-21589 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-86360 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-86361 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-86362 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-93355 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-106382 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-106197 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-106358 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-106347 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-102255 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-105192 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-102406 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-103008 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-102404 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-102413 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-104711 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-104712 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-104713 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-104714 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-91140 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2025-64393 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-58069 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-32740 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

First observed
CVECVE-2026-18397 linked to this actor

⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

The interactive view includes 180 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

ShinyHuntersCanonical Name
UNC6240Canonical Name
Bling LibraAlias
SLHAlias
SLSHAlias
Scattered LAPSUS$ HuntersAlias
UNC6240Alias
ReyAlias
ShinyHuntersAlias
G1057Tracking Id

Loading CVEs, techniques, indicators, malware, victims, and activity...