ShinyHunters has turned the theft of SaaS and cloud data into an industrial extortion business, using phone calls, stolen tokens and unrotated credentials rather than malware to empty CRM tenants, data warehouses and storage buckets. The name has appeared on data sales since 2020 and on some of the largest data theft campaigns of 2024 to 2026, but it is a brand used by a loose collective, so attribution needs care. This profile sets out its names and the threat clusters that government and vendor researchers tie to it, its targeting, its ATT&CK techniques, the identity and OAuth weaknesses it exploits, its main campaigns and the defences that counter them. Each claim is dated and attributed; claims made by the criminals themselves are labelled as claims. It is written for SaaS administrators, identity teams and security operations.
Key takeaways
- The SaaS tenant is the target, not the endpoint. Salesforce, Snowflake, Okta, Microsoft 365 and AWS storage have all been reached with valid credentials or OAuth authorisations, with no product vulnerability involved in most cases.
- Voice phishing beats push MFA. Callers posing as IT support persuade staff to approve a malicious connected app or hand over SSO credentials and MFA codes, then register their own MFA device.
- Machine credentials extend the blast radius. OAuth tokens, connected apps, AWS access keys and API keys found in stolen data are reused to reach further systems.
- Extortion can arrive months later. Google reports demands with 72 hour deadlines sent long after the theft, plus harassment, swatting threats and leak sites.
- Arrests have not stopped the brand. Members were sentenced in 2024 and arrested in France in 2025, yet ShinyHunters-branded operations continued into 2026.
Who they are (names and aliases)
MITRE ATT&CK added G1057 ShinyHunters in 2026 and describes it as a criminal collective active since at least 2019, operating under the "ShinyCorp" persona, that gathers credentials and personal data for resale or extortion. ATT&CK lists the aliases UNC6240 and Bling Libra and associates the group with The Com, whose members have also included Scattered Spider (G1015) and LAPSUS$ (G1004).
| Name or cluster | Who uses it | What it covers |
|---|---|---|
| ShinyHunters, ShinyCorp | The actors themselves, ATT&CK | Brand on data sales, extortion emails and leak sites |
| UNC6240 | Google Threat Intelligence Group and Mandiant | Extortion activity that consistently claims to be ShinyHunters |
| UNC6040 | Google, FBI | Salesforce vishing and data theft cluster, active since October 2024 per the FBI; Google says extortion by UNC6240 follows its intrusions |
| UNC6661, UNC6671 | Mandiant (January 2026) | Vishing clusters stealing SSO credentials; UNC6240 linked as extortion actor for UNC6661 |
| Bling Libra | Palo Alto Networks Unit 42 | Group behind ShinyHunters extortion of AWS environments (2024) |
| "Scattered LAPSUS$ Hunters", SLSH | The actors, press, EclecticIQ, ATT&CK | Brand for collaboration with Scattered Spider and Lapsus$ associated members from August 2025 |
Overlaps: EclecticIQ assessed in September 2025 that ShinyHunters ran a "Scattered Lapsus$ Hunters" Telegram channel from 8 August 2025 and, with high confidence, that some Scattered Spider members are hired by ShinyHunters for voice phishing, while finding no direct organisational relationship. Google says overlaps with The Com may reflect actors in the same communities rather than one operation. Snowflake: Mandiant's June 2024 report names the campaign actor UNC5537 and does not mention ShinyHunters; the link rests on the ShinyHunters listing of Ticketmaster data described below. See the Scattered Spider Threat Actor Profile.
Targeting and motivation
The motive is money: selling datasets and extorting victims. The US Department of Justice says a ShinyHunters seller offered data from more than 60 companies between April 2020 and July 2021. Since 2024 the emphasis has moved from selling to direct extortion, as Unit 42 noted in August 2024.
- SaaS customer data: Salesforce CRM data from airline, retail, luxury, insurance and technology companies; Google's own corporate Salesforce instance holding small business contact data was hit in June 2025.
- Cloud data platforms and storage: Snowflake customer databases (2024) and AWS S3 buckets with exposed access keys.
- Identity providers: Okta and Microsoft 365 SSO credentials as the route into every connected application.
- Education: the FBI warned on 15 May 2026 that educational institutions are at elevated risk after ShinyHunters claimed an attack that disrupted a learning management system, and Google reported in June 2026 that 68 percent of more than 100 organisations notified in an Oracle PeopleSoft campaign were in higher education.
- Developer and supply chain access: EclecticIQ reports targeting of high privilege engineering accounts and leaked API keys to reach CI/CD pipelines.
Tactics and techniques (MITRE ATT&CK)
Techniques below are those ATT&CK v20 associates with G1057, plus T1621 and T1098.005 for MFA abuse described by Mandiant; all IDs were checked against the ATT&CK v20 dataset.
| Tactic | Technique | Observed use |
|---|---|---|
| Reconnaissance | T1598.004 Spearphishing Voice; T1598.003 Spearphishing Link | Calls posing as IT support; victim-branded SSO phishing pages |
| Reconnaissance | T1593.003 Code Repositories | Searching public and victim repositories for credentials and API keys |
| Resource development | T1588.007 Artificial Intelligence | AI voice services used to script vishing calls, per ATT&CK and EclecticIQ |
| Initial access | T1078.004 Cloud Accounts; T1078.002 Domain Accounts | Valid SSO, Snowflake and cloud accounts |
| Initial access | T1190 Exploit Public-Facing Application | Oracle PeopleSoft CVE-2026-35273 exploited as a zero-day (2026) |
| Credential access | T1110 Brute Force | Against VPN and firewall devices, per EclecticIQ |
| Credential access | T1528 Steal Application Access Token | Stealing OAuth credentials from DevOps staff or repositories |
| Lateral movement | T1550.001 Application Access Token | Using OAuth tokens and connected apps that bypass MFA and password resets |
| Persistence | T1098.005 Device Registration | Registering an attacker device for MFA after vishing |
| Collection | T1213.006 Databases; T1530 Data from Cloud Storage | Bulk export of Salesforce objects; S3 bucket collection |
| Exfiltration | T1567 Exfiltration Over Web Service | API based bulk export from SaaS tenants |
| Command and control | T1219 Remote Access Tools | MeshCentral and ConnectWise agents |
| Impact | T1485 Data Destruction; T1657 Financial Theft | Deleting S3 buckets; extortion demands in bitcoin |
How they abuse identities and credentials
- Connected app consent by phone (2025): Google's June 2025 report describes UNC6040 callers guiding staff to Salesforce's connected app setup page to enter a "connection code", linking an attacker controlled, often modified Data Loader app renamed to fit the pretext, such as "My Ticket Portal". The FBI notes such apps can survive MFA and password resets and were sometimes created in Salesforce trial accounts. See the ShinyHunters Salesforce data theft campaign and the Salesforce Security Guide.
- SSO credentials and MFA device registration (2026): Mandiant reported in January 2026 that callers claiming an MFA settings update sent staff to domains such as companynamesso.com, captured credentials and codes, enrolled their own MFA device, then deleted the "security method enrolled" notification email. See the Vishing and Smishing Guide.
- Infostealer credentials without MFA (2024): in the Snowflake campaign Mandiant found that at least 79.7 percent of accounts used had prior credential exposure, some credentials dated to November 2020, and affected accounts lacked MFA and network allow lists. See the Infostealer Threat Guide.
- Exposed cloud keys: Unit 42 described an AWS access key, found in an exposed file, with AmazonS3FullAccess being used to list and delete buckets. See the Secrets Management Guide.
- OAuth integrations and tokens: Google and the FBI attribute the August 2025 Salesloft Drift token theft to a separate cluster, UNC6395, which searched exported Salesforce data for AWS keys, passwords and Snowflake tokens; The Register reported in October 2025 that the "Scattered LAPSUS$ Hunters" extortion drew on data from these intrusions. See the SaaS and OAuth App Governance Guide.
- Insiders: EclecticIQ reports recruitment of employees to sell access to Okta, Microsoft SSO, Citrix VPN and source code platforms.
Notable incidents
| Date | Campaign | Attribution status |
|---|---|---|
| 2020 to 2021 | Sale of data stolen from 60+ companies through phishing pages and harvested cloud credentials | Confirmed in court: Sebastien Raoult sentenced in Seattle on 9 January 2024 to three years |
| April to June 2024 | Snowflake customer data theft, about 165 organisations notified. See the Snowflake breach | Mandiant: UNC5537. ShinyHunters listed 560 million claimed Ticketmaster records on BreachForums (Dark Reading, June 2024); NCC Group suggested it may have been acting as a proxy. Connor Moucka pleaded guilty in the US case in 2026 |
| 2024 | AWS S3 extortion using an exposed access key | Unit 42: Bling Libra (ShinyHunters) |
| From October 2024 into 2025 | Salesforce vishing and connected app theft, extortion signed ShinyHunters | Google: UNC6040 theft, UNC6240 extortion; FBI FLASH 12 September 2025 |
| 8 to 18 August 2025 | Salesloft Drift OAuth tokens used against Salesforce tenants. See the Salesloft Drift breach | Google: UNC6395, with no link to UNC6040 stated; The Register reported the data was used in later "Scattered LAPSUS$ Hunters" extortion |
| October 2025 | Leak site claiming about one billion Salesforce records from 39 companies; BreachForums seized by US authorities with French support | Claim by the actors; Salesforce said it would not pay and its platform was not compromised (The Register) |
| November 2025 | Gainsight OAuth tokens used against Salesforce customers. See the Gainsight Salesforce breach | Shows the same integration token pattern; see the linked page for attribution |
| January 2026 | SSO vishing against Okta, Microsoft 365, Salesforce, DocuSign and Google Workspace; new SHINYHUNTERS leak site | Mandiant: UNC6661, UNC6671, UNC6240 |
| April to May 2026 | Canvas learning platform attack. See the Canvas Instructure breach | FBI PSA 15 May 2026: claimed by ShinyHunters |
| 27 May to 9 June 2026 | Oracle PeopleSoft zero-day CVE-2026-35273, mostly higher education | Google: UNC6240; CVE added to CISA KEV on 12 June 2026 |
| September 2026 | Claimed access to FBI data. See the ShinyHunters FBI breach claim | Claim, not confirmed |
Arrests: French authorities announced on 25 June 2025 the arrest of four people linked to BreachForums, including a suspect using the ShinyHunters alias, according to Sophos. ShinyHunters-branded activity continued afterwards, which suggests several people use the name.
Detection and defence
| ShinyHunters behaviour | Control | What to monitor |
|---|---|---|
| Malicious connected app authorised by phone | Restrict "Customize Application" and "Manage Connected Apps" to a few admins; allowlist connected apps; require admin approval for new apps | New connected app authorisations, especially Data Loader variants or unfamiliar names |
| Bulk API export | Remove "API Enabled" from profiles and grant it only through permission sets; Transaction Security Policies on large exports | Event Monitoring for large queries, UniqueQuery events and API use from Tor or VPN ranges |
| Stolen SSO credentials and codes | FIDO2 security keys or passkeys; login IP ranges and trusted IPs on profiles and connected app policies | Sign-ins from commercial VPN and Tor; newly registered MFA devices |
| Attacker MFA device registration | Require strong verification for MFA enrolment; block enrolment from unmanaged devices | Deleted MFA enrolment notification emails in mailboxes |
| Infostealer credentials on data platforms | MFA or key pair authentication on every Snowflake user; network policies; rotate exposed credentials | Unexpected client application IDs and logins from new ASNs |
| OAuth tokens in integrations | Least privilege scopes, avoid the "full" scope, "Enforce IP restrictions" on connected apps, short session timeouts | Third-party app activity spikes; secrets stored in CRM records |
| Exposed cloud keys | Secrets scanning, short lived credentials, MFA conditions on DeleteBucket, cross-account backup | CloudTrail ListBuckets and DeleteBucket from unknown sources |
| Extortion and harassment | Incident plan that covers staff and family welfare; do not engage or pay without legal advice | Extortion emails, texts and calls to employees; report to the FBI IC3 or national authority |
Implementation sequence
- Inventory and lock down SaaS integrations: list every connected app and OAuth grant in Salesforce, Microsoft 365, Google Workspace and Snowflake; revoke unused ones and switch to admin-approved apps only. Test by attempting a user-initiated connection in a sandbox.
- Restrict data export: move "API Enabled" and export permissions to named permission sets; enable Transaction Security Policies in alert mode for two weeks, tune thresholds, then block.
- Deploy phishing-resistant MFA: start with administrators, help desk and call centre staff, then all SSO users. Keep a documented fallback process and break-glass accounts.
- Harden help desk and MFA enrolment: no MFA reset or device registration on a phone call alone. See the Account Recovery and Help Desk Security Guide.
- Remove stored secrets: scan CRM records, tickets and repositories for keys and passwords; rotate and vault them.
- Prepare for extortion: rehearse a data extortion scenario including leak site monitoring and staff harassment. Roll back any blocking policy only through an approved exception. See the Data Extortion Without Encryption Guide.
Metrics
- Integration hygiene: number of connected apps not on the allowlist (target zero) and OAuth grants unused for 90 days.
- Export exposure: users holding API or bulk export permissions as a share of all users.
- Phishing-resistant coverage: percentage of SSO users and all administrators on FIDO2 or passkeys.
- Network restriction coverage: percentage of SaaS and data platform accounts behind login IP ranges or network policies.
- Time to revoke: median time from a suspicious connected app alert to revocation of its tokens.
Framework mapping
| Area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Phishing-resistant MFA | IA-2(1), IA-2(2), IA-5 | PR.AA-03 |
| Integration and export permissions | AC-2, AC-6 | PR.AA-05 |
| Vishing awareness for help desk and call centres | AT-2(3) | PR.AT-01 |
| Third-party SaaS and integrations | SA-9, SR-6 | GV.SC-07, DE.CM-06 |
| Logging and detection | AU-6, SI-4 | PR.PS-04, DE.CM-03 |
| Incident handling | IR-4 | RS.MA-01 |
Smaller organisations with one CRM and one identity provider get most value from steps 1 to 3. Large enterprises with hundreds of integrations should add continuous OAuth monitoring and SaaS security posture tooling. See the OAuth Token Exchange and Delegation Guide.
Practitioner checklist
- Restrict who can authorise connected apps and remove any Data Loader variant you did not install.
- Remove "API Enabled" from profiles and grant it only through reviewed permission sets.
- Apply login IP ranges or network policies to Salesforce, Snowflake and other SaaS admin accounts.
- Enforce FIDO2 or passkeys for administrators, help desk and call centre staff first.
- Alert on new MFA device registrations and on deleted MFA notification emails.
- Rotate credentials found in infostealer logs and enforce MFA on every data platform user.
- Scan CRM records, tickets and repositories for AWS keys, passwords and tokens, then rotate.
- Review OAuth scopes for every third-party integration and revoke unused tokens.
- Include harassment and leak site scenarios in the extortion response plan.
Standards and references
- FBI: FLASH, Cyber criminal groups UNC6040 and UNC6395 compromising Salesforce instances for data theft and extortion
- FBI: ShinyHunters, cyber criminal group attacks learning management system
- MITRE ATT&CK: ShinyHunters (G1057)
- Google Threat Intelligence Group: UNC6040 voice phishing and Salesforce data extortion
- Mandiant: Vishing for access, tracking the expansion of ShinyHunters-branded SaaS data theft
- Mandiant: UNC5537 targets Snowflake customer instances for data theft and extortion
- US Department of Justice: Member of notorious international hacking crew sentenced to prison
- Palo Alto Networks Unit 42: ShinyHunters (Bling Libra) extortion in AWS environments
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Scattered Spider Threat Actor Profile · Salesforce Security Guide · Snowflake Security Guide · SaaS and OAuth App Governance Guide