IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE3 IOCs

ShinyHunters: Decentralized Extortion Targets Cloud SaaS at Scale

SB
Secure Blink
Published September 4, 2025Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYScattered SpiderINFRASTRUCTUREmy-ticket-portal.comlogin-salesforce.comdashboard-salesforce.…CAPABILITYMETA StealerVICTIMunknown
Adversary(1)
Infrastructure(3)
Capability(1)
Victim

Indicators of Compromise

Indicators of Compromise3

TypeIndicatorConfidenceScoreFirst Seen
Domainmy-ticket-portal.com
anonymizationexploitintel-blog
High
58
Oct 9, 26
Domainlogin-salesforce.com
anonymizationexploitintel-blog
High
71
Aug 3, 26
Domaindashboard-salesforce.com
anonymizationexploitintel-blog
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph3 total IOCs
Domain
Domain3Actors1Malware1REPORTShinyHunters: DecentralizeScattered SpiderMETA Stealer
scroll to zoom · drag to pan · click IOC to open