ShinyHunters is a financially motivated cybercrime and extortion group that emerged in 2019, gaining public notoriety in May 2020 through selling stolen user records on dark web forums. The group operates under a "pay or leak" model, exfiltrating vast amounts of data and threatening to publish or sell it if ransom demands are not met. While having no single confirmed country of origin, ShinyHunters is believed to be a decentralized and internationally distributed collective, with law enforcement actions suggesting European ties through arrested affiliates. The group distinguishes itself by its strategic focus on cloud and software-as-a-service (SaaS) environments, leveraging sophisticated social engineering tactics, particularly voice phishing (vishing), and the abuse of OAuth tokens to bypass traditional authentication methods. ShinyHunters is known for high-volume data breaches, often targeting a single vendor or integration to compromise numerous downstream customers, as seen in their campaigns against Salesforce and Snowflake customers. The group is closely associated with "The Com" cybercrime network and has overlapping membership or collaboration with other groups like Scattered Spider and Lapsus$ under the "Scattered Lapsus$ Hunters" banner, and has also been tracked under aliases such as UNC6040, UNC6240, UNC6661, UNC6671, ShinyCorp, and Sp1d3rhunters.^1,3,2

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

None Found