ShinyHunters
Also reported as UNC6240, Bling Libra and Storm-3127.
Reports per quarter
Techniques seen in the last two years
- T1528 4 reports in ATT&CK
- T1078.002 3 reports in ATT&CK
- T1486 3 reports reports only
- T1566.004 3 reports reports only
- T1567.002 3 reports reports only
- T1589.002 3 reports reports only
- T1003.003 2 reports reports only
- T1134 2 reports reports only
- T1190 2 reports in ATT&CK
- T1210 2 reports in ATT&CK
Show all 58 techniques Show fewer
- T1213 2 reports reports only
- T1593 2 reports reports only
- T1003.002 1 report reports only
- T1041 1 report reports only
- T1046 1 report reports only
- T1059.004 1 report reports only
- T1068 1 report reports only
- T1069 1 report reports only
- T1071.001 1 report reports only
- T1072 1 report in ATT&CK
- T1074.002 1 report reports only
- T1078 1 report in ATT&CK
- T1078.004 1 report in ATT&CK
- T1087 1 report reports only
- T1087.002 1 report reports only
- T1090 1 report reports only
- T1102 1 report reports only
- T1110 1 report in ATT&CK
- T1110.004 1 report reports only
- T1111 1 report reports only
- T1114.003 1 report reports only
- T1119 1 report reports only
- T1133 1 report reports only
- T1136.003 1 report reports only
- T1195 1 report reports only
- T1204.001 1 report reports only
- T1219 1 report in ATT&CK
- T1518 1 report reports only
- T1526 1 report reports only
- T1530 1 report in ATT&CK
- T1539 1 report reports only
- T1552.005 1 report reports only
- T1555.003 1 report reports only
- T1555.006 1 report reports only
- T1565 1 report reports only
- T1566 1 report reports only
- T1566.002 1 report reports only
- T1567 1 report in ATT&CK
- T1570 1 report reports only
- T1578.005 1 report reports only
- T1580 1 report in ATT&CK
- T1583.003 1 report reports only
- T1583.006 1 report reports only
- T1589.001 1 report in ATT&CK
- T1598 1 report in ATT&CK
- T1621 1 report reports only
- T1650 1 report reports only
- T1657 1 report in ATT&CK
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2018-13379 KEV ransomware
- CVE-2020-1472 KEV ransomware
- CVE-2021-35464 KEV ransomware
- CVE-2021-35587 KEV
- CVE-2024-1708 KEV ransomware
- CVE-2024-1709 KEV ransomware
- CVE-2024-26169 KEV ransomware
- CVE-2024-27198 KEV ransomware
- CVE-2024-4577 KEV ransomware
- CVE-2025-61882 KEV ransomware
- CVE-2026-35273 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
Show all 75 reports Show fewer
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
-
Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Scattered Spider - Threat Group Cards: A Threat Actor Encyclopedia
-
Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Threat Group Cards: A Threat Actor Encyclopedia
-
Shedding light on the dark web
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shedding light on the dark web
-
Heres how to guard your enterprise against ShinyHunters
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Heres how to guard your enterprise against ShinyHunters
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ShinyHunters Selling Alleged AT&T Database with 70 million SSN and Date of birth; AT&T Denies it originated from their systems
Newest first. Details opens the report in Explore.