Summary

ShinyHunters is a financially motivated cybercrime collective known for stealing credentials, accessing enterprise environments, collecting sensitive information, and extorting organizations by threatening to expose stolen data.

The group has used multiple intrusion paths, including phishing, valid account abuse, application access tokens, exploitation of internet-facing applications, remote access tools, and compromised cloud accounts. After gaining access, ShinyHunters has performed internal discovery, moved laterally, accessed cloud storage and enterprise data repositories, staged stolen information, and exfiltrated data for extortion.

Recent activity demonstrates that exploitation of public-facing enterprise applications remains an important part of the group's operations. Four vulnerabilities identified across external reporting provide relevant examples of vulnerabilities associated with ShinyHunters activity, although the strength of attribution differs between the cases.

The most directly attributed example is CVE-2026-35273, which affected Oracle PeopleSoft PeopleTools and was exploited between May 27 and June 9, 2026, before the vulnerability was publicly disclosed.

---

Background of ShinyHunters

ShinyHunters has been active since at least 2019 and has operated under the ShinyCorp persona. The group has targeted organizations across multiple industries and geographic regions, primarily seeking credentials, personally identifiable information, and enterprise data for financial gain. MITRE tracks ShinyHunters as G1057 and lists UNC6240 and Bling Libra as associated groups.

The group's operations have evolved from large-scale credential and data theft toward direct enterprise intrusion and extortion. ShinyHunters has used both social engineering and technical exploitation to obtain access, followed by discovery, lateral movement, data collection, and exfiltration.

The group has also been associated with collaborative activity involving other cybercrime communities. Because multiple actors may use overlapping infrastructure, tooling, aliases, and leaked exploits, attribution of individual incidents requires case-specific evidence.

---

CVEs Identified Across External Sources

The following vulnerabilities have been identified in reporting associated with ShinyHunters-related activity. They should not be treated as equally confirmed examples of exploitation by ShinyHunters.

CVE	Vulnerability	CVSS	EPSS	Impact
CVE-2025-31324	SAP NetWeaver Visual Composer	10.0 Critical	99.51%	Missing authorization controls allowed unauthenticated exploitation of the affected Visual Composer development server. A working exploit was publicly released under a ShinyHunters-associated identity, after which exploitation expanded to other actors.
CVE-2025-61882	Oracle E-Business Suite	9.8 Critical	99.73%	An unauthenticated network vulnerability in Oracle Concurrent Processing could result in compromise and remote code execution. Exploitation was observed in an Oracle EBS campaign, but the available evidence does not establish that ShinyHunters conducted the victim exploitation.
CVE-2021-35587	Oracle Access Manager	9.8 Critical	96.28%	An unauthenticated vulnerability could allow remote compromise of affected Oracle Access Manager deployments. The vulnerability has been linked to a ShinyHunters-associated persona in external reporting, but attribution is less direct than for CVE-2026-35273.
CVE-2026-35273	Oracle PeopleSoft Enterprise PeopleTools	9.8 Critical	95.47%	An unauthenticated HTTP vulnerability could allow remote code execution and takeover of affected PeopleSoft Enterprise PeopleTools installations. Exploitation between May 27 and June 9, 2026, was directly attributed to ShinyHunters-associated activity.

Attribution note: CVE-2025-61882 is included because it appeared in reporting surrounding ShinyHunters and the broader Oracle E-Business Suite exploitation activity. However, available evidence specifically states that the observed earlier exploitation was not attributed to actors associated with UNC6240. Therefore, it should not be presented as a confirmed ShinyHunters exploitation case.

---

ShinyHunters Attack Methodology

ShinyHunters uses a combination of social engineering, credential abuse, cloud access, vulnerability exploitation, and remote administration tools. The following sequence represents a generalized attack lifecycle based on activity documented for the group.

1. Reconnaissance

The attack begins with identifying organizations, exposed infrastructure, credentials, repositories, and publicly available information that can provide a path into the target environment.

ShinyHunters has searched public code repositories for credentials and API keys and has performed vulnerability scanning against victim infrastructure. This allows the attackers to identify exposed services and potentially reusable authentication material before attempting intrusion.

2. Credential Theft and Social Engineering

Stolen credentials remain an important access mechanism.

ShinyHunters has used phishing campaigns and spearphishing links to target corporate users. Social engineering can also be used to convince employees to disclose credentials or approve access requests.

The group has additionally targeted credentials and OAuth application tokens stored in development repositories or exposed through compromised accounts.

3. Initial Access

After identifying an entry point, ShinyHunters can obtain access through several mechanisms:

• Valid domain or cloud accounts
• Stolen application access tokens
• Phishing
• Remote access tools
• Brute-force attacks against edge devices
• Exploitation of public-facing applications
• Exploitation of remote services

Recent exploitation of CVE-2026-35273 demonstrates the use of a vulnerable public-facing enterprise application as an initial access vector.

4. Cloud Discovery and Access

Once cloud credentials or access tokens are obtained, attackers can enumerate cloud infrastructure and identify valuable storage resources.

ShinyHunters has used cloud APIs and tools to enumerate storage buckets, permissions, and objects. Misconfigured or insufficiently protected cloud storage can therefore provide direct access to large quantities of organizational data.

5. Remote Access and Lateral Movement

After establishing an initial foothold, ShinyHunters can expand access across the environment.

The group has abused remote access and software deployment tools to execute commands, deploy agents, and move between systems. Remote service vulnerabilities can also be exploited to facilitate lateral movement.

6. System and File Discovery

The attackers perform discovery to understand the compromised environment and locate systems and files containing useful information.

Observed activity includes identifying hostnames, internal systems, network information, application configuration files, and enterprise application components. This information can help determine where sensitive databases, credentials, and business data are located.

7. Data Collection

The primary objective is to locate information that can be monetized or used as leverage.

ShinyHunters has collected information from cloud storage, code repositories, databases, and enterprise applications. The targeted information can include credentials, personally identifiable information, source code, customer records, and other sensitive business data.

8. Data Staging

Before exfiltration, collected information can be consolidated and compressed.

MITRE documents the use of archive utilities to package collected data before transfer. Staging reduces the number of files that need to be transferred and can make large-scale data movement easier to manage.

9. Data Exfiltration

Staged information is transferred outside the victim environment through available web or cloud-based services.

ShinyHunters has used web services and compromised enterprise application interfaces to move collected information. Stolen data may subsequently be prepared for publication or used as evidence during extortion negotiations.

10. Extortion

The final stage involves using the stolen information as leverage.

ShinyHunters has contacted victims through email, telephone, and text messages and demanded payment while threatening disclosure of stolen information. The group also maintains infrastructure used to publish or advertise stolen data.

MITRE ATT&CK Mapping

The following techniques are currently documented by MITRE ATT&CK for ShinyHunters (G1057).

Technique ID	Technique Name	Tactic
T1583.001	Acquire Infrastructure: Domains	Resource Development
T1583.004	Acquire Infrastructure: Server	Resource Development
T1595.002	Active Scanning: Vulnerability Scanning	Reconnaissance
T1560.002	Archive Collected Data: Archive via Library	Collection
T1110	Brute Force	Credential Access
T1580	Cloud Infrastructure Discovery	Discovery
T1619	Cloud Storage Object Discovery	Discovery
T1059.007	Command and Scripting Interpreter: JavaScript	Execution
T1059.009	Command and Scripting Interpreter: Cloud API	Execution
T1485	Data Destruction	Impact
T1530	Data from Cloud Storage	Collection
T1213.003	Data from Information Repositories: Code Repositories	Collection
T1213.006	Data from Information Repositories: Databases	Collection
T1491.001	Defacement: Internal Defacement	Impact
T1587.004	Develop Capabilities: Exploits	Resource Development
T1573.002	Encrypted Channel: Asymmetric Cryptography	Command and Control
T1585.002	Establish Accounts: Email Accounts	Resource Development
T1567	Exfiltration Over Web Service	Exfiltration
T1190	Exploit Public-Facing Application	Initial Access
T1203	Exploitation for Client Execution	Execution
T1210	Exploitation of Remote Services	Lateral Movement
T1083	File and Directory Discovery	Discovery
T1657	Financial Theft	Impact
T1589.001	Gather Victim Identity Information: Credentials	Reconnaissance
T1105	Ingress Tool Transfer	Command and Control
T1036.005	Masquerading: Match Legitimate Resource Name or Location	Defense Evasion
T1588.002	Obtain Capabilities: Tool	Resource Development
T1588.007	Obtain Capabilities: Artificial Intelligence	Resource Development
T1069.003	Permission Groups Discovery: Cloud Groups	Discovery
T1598	Phishing for Information	Reconnaissance
T1598.003	Phishing for Information: Spearphishing Link	Reconnaissance
T1090.003	Proxy: Multi-hop Proxy	Command and Control
T1219	Remote Access Tools	Command and Control
T1018	Remote System Discovery	Discovery
T1593.003	Search Open Websites/Domains: Code Repositories	Reconnaissance
T1684	Social Engineering	Stealth
T1072	Software Deployment Tools	Execution
T1528	Steal Application Access Token	Credential Access
T1195.001	Supply Chain Compromise: Compromise Software Dependencies and Development Tools	Resource Development
T1082	System Information Discovery	Discovery
T1016	System Network Configuration Discovery	Discovery
T1552.001	Unsecured Credentials: Credentials In Files	Credential Access
T1550.001	Use Alternate Authentication Material: Application Access Token	Defense Evasion
T1078	Valid Accounts	Defense Evasion
T1078.002	Valid Accounts: Domain Accounts	Defense Evasion
T1078.004	Valid Accounts: Cloud Accounts	Defense Evasion

---

Attack Flow

---

Mitigation

Organizations can reduce exposure to ShinyHunters-style attacks by combining vulnerability management, identity protection, cloud security, and strong monitoring controls.

• 1. Patch Internet-Facing Applications: Prioritize remediation of vulnerabilities that allow unauthenticated remote exploitation, particularly in externally accessible enterprise applications.
• 2. Protect Corporate Credentials: Enforce phishing-resistant MFA, disable legacy authentication, and immediately rotate credentials suspected of being compromised.
• 3. Protect Application Access Tokens: Remove exposed tokens from source repositories, apply least privilege, and rotate or revoke tokens associated with compromised accounts.
• 4. Secure Cloud Storage: Prevent public exposure of sensitive storage and use least-privilege permissions with logging enabled for object access.
• 5. Control Remote Access Tools: Allow only approved remote administration tools and investigate unexpected installations, agents, or remote sessions.
• 6. Secure Development Repositories: Scan repositories for exposed credentials and secrets, restrict repository permissions, and protect CI/CD accounts with strong authentication.
• 7. Monitor Data Exfiltration: Monitor for unusual archive creation, bulk database extraction, large cloud downloads, and abnormal outbound data transfers.
• 8. Maintain Incident Response Readiness: Prepare procedures for isolating compromised systems, revoking stolen credentials, preserving evidence, and determining the scope of data exposure.