ShinyHunters is a financially motivated cybercrime and extortion group that emerged in 2019, gaining public notoriety in May 2020 through selling stolen user records on dark web forums. The group operates under a "pay or leak" model, exfiltrating vast amounts of data and threatening to publish or sell it if ransom demands are not met. While having no single confirmed country of origin, ShinyHunters is believed to be a decentralized and internationally distributed collective, with law enforcement actions suggesting European ties through arrested affiliates. The group distinguishes itself by its strategic focus on cloud and software-as-a-service (SaaS) environments, leveraging sophisticated social engineering tactics, particularly voice phishing (vishing), and the abuse of OAuth tokens to bypass traditional authentication methods. ShinyHunters is known for high-volume data breaches, often targeting a single vendor or integration to compromise numerous downstream customers, as seen in their campaigns against Salesforce and Snowflake customers. The group is closely associated with "The Com" cybercrime network and has overlapping membership or collaboration with other groups like Scattered Spider and Lapsus$ under the "Scattered Lapsus$ Hunters" banner, and has also been tracked under aliases such as UNC6040, UNC6240, UNC6661, UNC6671, ShinyCorp, and Sp1d3rhunters.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.