Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
shiba Ransomware Group
Ransomware group profile
Description
Shiba is a newly emerged threat group focused on software supply chain attacks, primarily targeting developer platforms. They exploit naming loopholes in the Visual Studio Code Marketplace to distribute malicious extensions, facilitating financial extortion through ransomware. Their operations began in late 2024 and have continued into mid-2025, showcasing sophisticated tactics to mislead developers.
Key insights
- •The group achieves initial access by publishing malicious extensions on the Visual Studio Code Marketplace.
- •Shiba utilizes downloader extensions that execute custom commands to retrieve additional payloads via PowerShell.
- •Their ransomware variant targets specific user directories, encrypting files and demanding cryptocurrency payments.
- •Shiba specifically targets software developers and technical users who rely on public code repositories.
Threat Level & Status Breakdown
For shiba · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for shiba in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for shiba
- 196.251.107.109
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for shiba
T1036
Masquerading
T1562
Impair Defenses
T1059.001
PowerShell
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021
Remote Services
T1080
Taint Shared Content
T1195.002
T1195.002
T1040
T1040
T1078
Valid Accounts
T1547
Boot or Logon Autostart Execution
Victims(5)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Oneonta City School District | — | Claimed | 1 day ago | |
| maltest | Algeria | Claimed | 17 days ago | |
| Morgan White Group | — | Claimed | 21 days ago | |
| Friendly Senior Living | — | Claimed | about 1 month ago | |
| IT Foods Industries | — | Claimed | about 1 month ago |
Affected countries(3)
Countries where this group has been reported to target or leak victims.