Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
shinyhunters Ransomware Group
Ransomware group profile
112Victims
United StatesSource country
120Impact score
Also Known As
UNC6040
Scattered Lapsus$ Hunters (SLH)
ShinyCorp
Description
ShinyHunters is a financially motivated cybercriminal group that specializes in large-scale data breaches and extortion. They primarily operate using a 'pay or leak' model, threatening to expose sensitive information unless ransoms are paid. Initially targeting a variety of industries, the group has evolved to focus on SaaS platforms and cloud environments.
Key insights
- •Employs sophisticated vishing techniques to gain initial access.
- •Targets Software-as-a-Service (SaaS) platforms and cloud environments.
- •Utilizes OAuth token exploitation and misconfigured applications for data exfiltration.
- •Operates under a 'pay or leak' model to extort victims.
- •Associated with other cybercriminal entities like Scattered Spider and Lapsus$.
Threat Level & Status Breakdown
For shinyhunters · Based on incidents in selected period
4.8threat level
Aggressiveness5/ 10
Lethality2.6/ 10
Criticality7.1/ 10
Status Breakdown
Data Leaked52.7%59
Negotiating2.7%3
Claimed44.6%50
First seenJan 2026
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 27, 2026
Recent activity
Monthly attack count for shinyhunters in the selected period
112Total attacks
21peak in Apr
11.2avg / month
↓ 1 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for shinyhunters
- 2915b3f8b703eb744fc54c81f4a9c67f
- 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
- 7bdbd180c081fa63ca94f9c22c457376
- a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91
- b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32
- b97812a2e6be54e725defbab88357fa2
- eada05f4bfd4876c57c24cd4b41f7a40ea97274c
- 9db8f7378e2df01c842cfcb617e64475
- 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
- 38de5b216c33833af710e88f7f64fc98
- cfa1997682e4ed41bc691ba848d845abbe0b75ec97e640c2b015b4d1624a108a
- 415898f14843d4a6537cf8f43d328eaf
- fc75a3800d8c2fa49b27b632dc9d7fb611b65201
- c844d02c91d5e6dc293de80085ad2f69b5c44bc46ec9fdaa4e3efbda062c871c
- d67a475f72ca65fd1ac5fd3be2f1cce2db78ba074f54dc4c4738d374d0eb19c7
- 29baab2551064fa30fb18955ccc8f332bd68ddd4
- 3a6e2c775c9c1060c54a9a94e80d923a
- e67e7b8e0fb6baff4f25bb05dd5a5e21
- b10129c175c007148dd4f5aff4d7fb61eb3e4b0ed4897fea6b33e90555f2b845
- e84270afa3030b48dc9e0c53a35c65aa
- df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403
- 4a34bbad85312ef34b60818a47f7b5bb8e9a7e26
- 61e046145ee5cf45aeb033cd71e8b07c
- 228c316455d5ed69232adcbe9acd033092f200014cfa7ed40d6c382f07b19b82
- 8f31f69f88a75d5faab4f94cfc2ec8a649fe1a24
- 43907e54cf3d1258f695d1112759b5457576481072cc76a679b8477cfeb3db87
- beadd181d0dbbbe36e0e311c5211a5dd
- 716cb58d66e5a59b53c90d427d17c5cc53a68f80
- dca4102fba483bf0060427e0d583a1f61d079bf0754db4d61ff2969cc1bc3474
- 1ccf8baf11427fae273ffed587b41c857fa2d8f3d3c6c0ddaa1fe4835f665eba
- d6af1c9f5ce407e53ec73c8e7187ed804fb4f80cf8dbd6722fc69e15e135db2e
- abe531e9f1e642c47260fac40dc41f59
- bdb33bbb4ea11884b15f67e5c974136e6294aa87459cdc276ac2eea85b1deaa3
- 384e8f3d300205546fb8c9b9224011b3b3cb71adc994180ff55e1e6416f65715
- 766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777
- 1406e538fc441e89ce3d1747017f97a5
- cc51ba31b585d56959d2296bef849db2ed0d37a1
- e4c44d0f462fce02b2c31555b12c022cdd6eae6492fd3a122e32e105fc5a54f8
- 451a42db9c514514ab71218033967554507b59a60ee1fc3d88cbeb39eec99f20
- 1d5920f4b44b27a802bd77c4f0536f5a
- d4c9d9027326271a89ce51fcaf328ed673f17be33469ff979e8ab8dd501e664f
- baea954b95731c68ae6e45bd1e252eb4560cdc45
- 818d0e9047f538fa85283d3343bd7d75e5bfc49f
- aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878
- 8e8f463c37ea7133194731bfe4490e6713dd0133f30fe08a6d069d10fa7db2c6
- 4db090498a57b85411417160747ffd8d4875f98b3ca2b83736a68900b7304d2b
- e8ad966042f179c415c605750488c9df353e4d2e
- 49874b7a63b6a46e3ec426a713d86b2a
- 3bf53cddf7eb98d9cb94f9aa9f36c211a464e2c1b278f091d6026003050281de
- 88bd49b1bd9c2bde78bc4e394c993035e0fde3ea
- b8c046a7c3a28653662140bb2eaad32d
- ada4e228e982a7e309bb6a3308e4872d
- 9be2686e1304526a588c7f66f7bae1f5a47fc6f6
- 60f0d614ee1cfcfd237f6705a33765c3
- d6432b42f7a52976277bb00b29e761b9
- 6c45d2e6b7dd630e226f421c7d8ce723
- faa1177593b4e9c3632783eb35ca4d0c71fea778ed093f479a2c9f49c42dd0a4
- 43449e9ffdee9f0797da2228188a8c642868da0a
- 8dc32643ad886472aca642d293d752e76516d5ca
- b1cebd305c6aa27048a3673e70f8e1604735b2c06c83452d2935c330b5a3eb58
- 025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a
- e45b18c93d187aac5c4486f57483bc87580e15def82a312bfb377ff16eb96b22
- 48cc6671cdf4aec9ebb25ec428dc47eb09f39dc063de1ae0b24a788a346b13d1
- 232e46f901d460af1d8a76c51d999f44
- 863f8e761905985d4cba870b9aec44982cceb6209c05e72707522fd96e2d4e18
- 82e7ba597784cd12d283b998d54e74c7abe7778f
- 9319c2f41e9ec22cfd53afdd6693cf81
- 27f9183b9694b9ea1e71283dd084570f5e57bac1a3b64988f7667a76617a8a7a
- 0810b4be454682ac5511783bb26cdda11dd96a1c
- 0cd3df20559504130571e116dda8cb18
- 42a08d1063980328bf1a1c5652c21a79e8b06d6abcac1881a0e8afa391b86c81
- 81f874e57dac9804e05834f47d5f1a5189f9c5e0
- 616a15883f34627757fe19b12324ed8f0583b739
- 65ab49119c845801f29a57e8aa177146b2ffbd289d4278109b146f933380f951
- d4ac4d684aca924c9d532c245c016c2a
- 5cdfb23517d671d3b2c0535b23d80dbc8b053288e881b4f5eb2f1221f1e7a7fc
- 09a92d46171ab4e1ad66e2b3e55d852b136d8a48
- 41444d7018601b599beac0c60ed1bf83
- 38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55
- 419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86
- 1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f
- 65cba741fe30fa4799fb9002ea8de6d96042a59159dd7c3419c766af24c835e6
- 1f9801b37ebd20a337d6460688e21e67
- 7681b586f2161b8eea6c7716d9fdc67ac4328278
- 2f952ae310c0dc9e175496cd5def478da91a017d0567e676e314f7832b362d92
- 1eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c
- ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07
- 736a6b312fe80efea9bc2e482629be06
- 9887bc4eed59173d94f5340ef7c09e8ea68cd824
- ae76461aaaeb03b2906a0721e569effb
- 0af93800a1bb97c87bf151c6056c1ac7bf8eaff5
- a0bae057995600011b410fbd78e13cf01c15ee834e74c2d0283ef36a40a43e43
- 02af802fa1c1940102d6e31a5b7df9ed
- 9b1745a5c565287689f191763b7f46f13166d964
- 1f31ad8a9733e56f285f565db6c1b30a41ae46393f2d5ed63a3c62b2227a2b43
- 8a174aa70a4396547045aef6c69eb0259bae1706880f4375af71085eeb537059
- 701d51b7be8b034c860bf97847bd59a87dca8481c4625328813746964995b626
- cd986db1ba57f4943d9a3f2a5aea0e59
- f4473fb21cd83bcd02829a253e8c29616460d54a
- c2fc69a4552608612fb7d991b063564584eec0fd4259599e6c868457a5e4cb81
- 668f932433a24bbae89d60b24eee4a24808fc741f62c5a3043bb7c9152342f40
- ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c
- 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96
- d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f
- 87c75c0df3e1c32e64d4c9ea129fcff9
- 1c4761fa03b4d5b61cd95f1dcc81ce326e7a6d9b
- c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f
- 52fda5c1b9704544f32ee98d9060e689
- 76842bcd75b4429e2c92636274ab0395d91c441c6aea9b76fe8a051659b0c1fc
- 51d39aa39478beeac94f2d12f682ecce
- ebcf977806f68af3147e0b78b55f6aed
- cc19e502e4201cc974c753b96429027925224f53
- 68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309
- b7af1868d3c5838c30d7d90521c7a721
- f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc
- 25011c7fb14b15e78f8a2a54606d37f7b753578a
- 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35
- f174c19902523dcf005fa044b6598403a5e5c0a5982398d1bc0dcc5ec1cd351b
- d20a3c928761fe00ac522eeb474612b5804cd9108453ea8591106d5d4428428e
- 82b37a92589dfd4d67ca87eb9e52ac8e682e8e60d2211f59074cd5ccc693013b
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for shinyhunters
CVE-2026-85706
CVE-2026-80521
CVE-2026-48842
CVE-2026-42608
CVE-2026-35273
CVE-2025-61884
CVE-2025-61882
CVE-2025-55234
CVE-2025-54918
CVE-2025-50107
CVE-2025-50105
CVE-2025-50090
CVE-2025-50071
CVE-2025-50062
CVE-2025-30746
CVE-2025-30745
CVE-2025-30744
CVE-2025-30743
CVE-2025-30739
CVE-2024-50623
CVE-2024-21287
CVE-2023-34362
CVE-2021-44228
CVE-2021-35587
Collection
T1213
Data from Information Repositories
Defense Evasion
T1550.001
Application Access Token
Victims(112)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| DexCom, Inc. | — | Claimed | 26 days ago | |
| O'Reilly Automotive | — | Claimed | 26 days ago | |
| WARNING | — | Negotiating | 28 days ago | |
| Final statement re PSA | — | Claimed | about 1 month ago | |
| PRESS RELEASE RE PSA | United States | Data Leaked | about 1 month ago | |
| Fresenius Medical Care | Germany | Claimed | about 1 month ago | |
| PSA - READ THIS NOW | United States | Claimed | about 1 month ago | |
| Note to Cl0p-_- | — | Claimed | about 1 month ago | |
| Kimberly-Clark | United States | Data Leaked | about 2 months ago | |
| State of Florida DMV | United States | Claimed | about 2 months ago | |
| Medela | Switzerland | Data Leaked | about 2 months ago | |
| Note to mr. databroker1 NEXUS DL Service | — | Claimed | about 2 months ago | |
| Neogen Corporation | United States | Data Leaked | about 2 months ago | |
| McKesson Corporation | United States | Data Leaked | 2 months ago | |
| Elekta AB | Sweden | Data Leaked | 2 months ago | |
| CyrusOne, LLC. | United States | Data Leaked | 2 months ago | |
| ReliaQuest, LLC | United States | Claimed | 2 months ago | |
| NovoCure Limited | Israel | Data Leaked | 2 months ago | |
| BOK Financial | United States | Data Leaked | 2 months ago | |
| Brinks Home | — | Claimed | 2 months ago |
Page 1 of 6
Affected countries(53)
Countries where this group has been reported to target or leak victims.
🇦🇲Armenia🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇪Belgium🇧🇷Brazil🇨🇦Canada🇨🇭Switzerland🇨🇱Chile🇨🇳China🇨🇴Colombia🇨🇷Costa Rica🇩🇪Germany🇩🇰Denmark🇪🇬Egypt🇪🇸Spain🇫🇷France🇬🇧United Kingdom🇭🇰Hong Kong🇮🇩Indonesia🇮🇪Ireland🇮🇱Israel🇮🇳India🇮🇶Iraq🇮🇹Italy🇯🇵Japan🇰🇭CambodiaKorea, Republic of🇱🇺Luxembourg🇲🇦MoroccoMacedonia, the Former Yugoslav Republic of🇲🇽Mexico🇲🇾Malaysia🇳🇬Nigeria🇳🇱Netherlands🇳🇿New Zealand🇵🇪Peru🇵🇭Philippines🇵🇰Pakistan🇶🇦QatarRussian Federation🇸🇪Sweden🇸🇬Singapore🇸🇳Senegal🇸🇴Somalia🇸🇻El SalvadorSyrian Arab Republic🇹🇷Turkey🇺🇸United States🇺🇾Uruguay🇺🇿Uzbekistan🇻🇳Vietnam🇿🇦South Africa