Detect, Respond, Protect
See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.
Threat Actor Profile
ShinyHunters
ShinyHunters is a financially motivated cybercrime and extortion operation that has been active since at least 2019. The group is best known for large-scale data theft, SaaS-focused intrusions, and pay-or-leak extortion. Operating with no confirmed (or overt) nation-state affiliation, the group has established itself as one of the most prolific data theft and extortion gangs in the world, targeting SaaS platforms, cloud environments, and enterprise identity providers through sophisticated social engineering, credential theft, and large-scale data exfiltration — followed by ransom demands under a ruthless "pay or leak" model.
Threat Actor Profile
ShinyHunters
Country of Origin
ShinyHunters does not have a confirmed country of origin. The group is believed to be decentralized and internationally distributed. Known arrested affiliates include a French national (Sébastien Raoult, arrested in Morocco in 2022 and extradited to the U.S.) and at least four additional individuals arrested in France in June 2025, suggesting European ties. However, researchers widely assess the broader group to be a loose, multinational collective with members across multiple countries. No single nation-state has been formally attributed as the group's base of operations.
Leadership
No confirmed public ringleader has been identified. Public reporting has associated the name `shinycorp` with ShinyHunters branding, but real-world leadership attribution remains unconfirmed. The aliases `Hollow`, `Noct`, and `Depressed` are better treated as personas tied to arrests or affiliated activity, not confirmed group leadership.
Members
ShinyHunters is better described as a loose criminal ecosystem than a rigidly structured organization. Huntress reporting describes ShinyHunters, Scattered Spider, and Lapsus$ as converging into the broader SLSH/ShinySp1d3r threat ecosystem, while Google tracks related activity under multiple distinct clusters depending on campaign and role — UNC6240, UNC6661, UNC6671, UNC6395, and UNC6040 among them. That suggests overlap and collaboration, but not a single neatly bounded membership list. Exact membership count is unknown, and the ShinyHunters name is best understood as a brand used by a fluid network of criminal affiliates rather than a fixed roster of individuals.
ShinyHunters TTPs
Tactics
ShinyHunters is primarily motivated by financial gain through large-scale data theft and extortion. The group's overarching tactical goals are:
- Obtain unauthorized access to cloud-hosted enterprise environments, particularly SaaS platforms and identity providers.
- Exfiltrate sensitive personal, financial, and proprietary data at massive scale.
- Extort victim organizations with a "pay or leak" ultimatum — if ransom is unpaid, stolen data is listed on dark web marketplaces or the group's own data leak site (DLS).
- Target high-value sectors including technology, finance, education, luxury retail, telecommunications, and critical infrastructure.
- Escalate pressure on victims through DDoS attacks, defacement, harassment of personnel, and public extortion posts.
Techniques
ShinyHunters relies on a mix of social engineering, identity abuse, and SaaS-focused data theft techniques:
- Voice phishing (vishing) to obtain SSO credentials and MFA codes from employees impersonating IT staff.
- Victim-branded credential harvesting sites that mimic internal SSO, support, or identity portals.
- MFA persistence and defense evasion, including registering attacker-controlled MFA devices and, in some cases, deleting enrollment notifications using ToogleBox Recall.
- OAuth and refresh-token abuse involving third-party SaaS integrations such as Drift and Gainsight to access downstream Salesforce environments. ShinyHunters has also reportedly abused stolen Anodot authentication tokens and used those to exfiltrate corporate data from large databases such as Google BigQuery, in 2026 incidents involving extortion attempts against Snowflake, Rockstar Games and Canvas.
- SaaS data theft from platforms such as Microsoft 365, SharePoint, Salesforce, Slack, and Experience Cloud deployments.
- Extortion via email, Tox, Limewire-hosted proof samples, and a ShinyHunters-branded data leak site, with some campaigns also involving harassment or DDoS pressure.
Procedures
ShinyHunters follows a repeatable pattern across recent campaigns:
- Initial access through vishing: operators call employees, pose as IT staff, direct them to a victim-branded phishing site, capture SSO credentials and MFA codes, then enroll their own MFA device.
- SaaS expansion after compromise: once inside, operators opportunistically access the cloud apps available through the compromised session and search for sensitive terms such as `poc`, `confidential`, `internal`, `proposal`, `salesforce`, and `vpn`.
- Salesforce vishing activity in 2025: public reporting tied ShinyHunters-branded operations to Salesforce-focused voice-phishing and extortion activity tracked as UNC6040 and UNC6240.
- Drift/Salesloft token abuse in August 2025: stolen OAuth tokens were reportedly used to access roughly 760 downstream Salesforce customer organizations.
- Gainsight token abuse in November 2025: follow-on activity affected more than 200 potentially impacted Salesforce instances, with Salesforce revoking related OAuth access during the response.
- January 2026 vishing campaigns: GTIG tracked related activity as UNC6661 and UNC6671, including credential theft, SharePoint and OneDrive data access, and ToogleBox Recall authorization in at least some Okta-linked cases.
- Anodot compromise in 2026: Threat actors who self-identified as ShinyHunters compromised and stole authentication tokens in April 2026 from Anodot, which characterizes itself as an AI-enhanced business analytics service. ShinyHunters appear to have repeatedly abused those stolen tokens to compromise databases from at least 13 large corporate customers of Anodot, such as Snowflake, Rockstar Games, and Canvas Instructure throughout April and May 2026.
- Extortion: follow-on demands were linked to UNC6240, with BTC payment instructions, 72-hour deadlines, Limewire samples, Tox negotiation, and DLS postings.
Want to Shut Down Threats Before They Start?
Notable Cyberattacks by ShinyHunters
Snowflake Customer Campaign (2024)
In mid-2024, ShinyHunters exploited stolen contractor credentials — not a vulnerability in Snowflake's platform itself — to access cloud data belonging to Snowflake customers. This campaign resulted in the theft and sale of data from Ticketmaster (560M records), Santander Bank (30M records), AT\&T (109M call records — AT\&T paid a $370,000 ransom to delete the data), Neiman Marcus (31M records), and dozens of other organizations. The group used a distinctive tool signature called "RapeFlake" during this operation.
Salesloft/Drift Salesforce Campaign — Largest SaaS Breach in History (Aug–Sep 2025)
ShinyHunters used the TruffleHog open-source security tool to scan source code repositories, discovering OAuth tokens for the Salesloft Drift email platform. Using those tokens, the group accessed approximately 760 Salesforce customer organizations between August 8–18, 2025, exfiltrating roughly 1.5 billion records across Account, Contact, Case, Opportunity, and User data tables. Confirmed victims included Cloudflare, Workiva, Zscaler, Tenable, CyberArk, Elastic, BeyondTrust, Proofpoint, JFrog, Rubrik, Cato Networks, and Palo Alto Networks. Google's Threat Intelligence team tracked this activity as UNC6395 and confirmed awareness of over 700 potentially impacted organizations.
Gainsight Salesforce Campaign (Nov 2025)
In a near-identical follow-up, ShinyHunters stole OAuth tokens from Gainsight's Salesforce integration and accessed approximately 285 Salesforce instances (200+ confirmed by Google). Victims included Atlassian, DocuSign, F5, GitLab, Malwarebytes, SonicWall, Thomson Reuters, and Verizon. Salesforce revoked all associated OAuth tokens and temporarily removed related AppExchange applications during the incident.
Okta SSO / Enterprise Vishing Campaign (Jan 2026)
Operating as UNC6661 and UNC6671, ShinyHunters impersonated IT support staff to trick employees at targeted organizations into entering Okta SSO credentials and MFA codes on custom victim-branded phishing portals. Post-access, attackers exfiltrated data from SharePoint, OneDrive, Salesforce, and Slack. In some incidents, the ToogleBox Recall Gmail add-on was silently authorized to delete MFA enrollment notification emails. Confirmed victims include Wynn Resorts, Odido, Panera Bread, Betterment, Grubhub, Harvard University, Princeton University, and University of Pennsylvania.
Salesforce Aura Exploitation Campaign (Mar 2026)
In March 2026, Salesforce issued a security advisory warning of a "known threat group" exploiting misconfigurations in Salesforce Experience Cloud (Aura). ShinyHunters claimed responsibility on their DLS, warning approximately 400 victim companies — including Snowflake, Okta, LastPass, and Salesforce itself — to pay or face data leaks. The group used a modified version of Google's AuraInspector Chrome extension alongside a custom-developed scanning tool. The user-agent string "RapeForce" was observed, mirroring the earlier Snowflake campaign's "RapeFlake" signature.
Instructure/Canvas Breach (Apr–May 2026)
ShinyHunters exploited previously-stolen credential tokens from Anodot to gain access to Instructure's Free-for-Teacher environment — related to support ticket handling — and steal 275 million records (3.65TB of data) from Canvas, one of the world's most widely used learning management systems used by more than 9,000 institutions. After a second wave of unauthorized access on May 7, 2026 defaced Canvas login portals at approximately 330 institutions with extortion messages, Instructure reached a ransom agreement with the group by May 12, 2026 to prevent data leakage. The company confirmed no passwords or course content were compromised.
ShinyHunters Law Enforcement
Despite the group's extensive criminal activity, law enforcement actions have been limited in scope and have not significantly disrupted operations:
- Sébastien Raoult (France, 2022–2024): A French national was arrested in Morocco in May 2022 and extradited to the United States. In January 2024, Raoult was sentenced to three years in prison and ordered to pay $5 million in restitution for his role in wire fraud conspiracy and aggravated identity theft. U.S. prosecutors noted he had worked with the group for over two years but was not a major figure within the organization.
- Matthew D. Lane (U.S., 2025): A 19-year-old Massachusetts student was charged in May 2025 with hacking and extorting an education technology provider (widely reported as PowerSchool), using stolen contractor credentials to exfiltrate data on tens of millions of students and demand a $2.85 million Bitcoin ransom. Lane pleaded guilty on June 6, 2025.
- French Arrests (June 2025): French authorities announced the coordinated arrest of four individuals associated with ShinyHunters in multiple French regions. The aliases targeted included "ShinyHunters," "Hollow," "Noct," and "Depressed." Researchers and the group itself indicated those arrested were affiliates, not the core leadership, as the group continued operations uninterrupted.
- FBI, Indonesian Police, Indian Police: Multiple agencies opened investigations following the Tokopedia breach (2020) and subsequent U.S.-based complaints from companies including Minted. Dave.com and BigBasket also coordinated with local law enforcement following their respective breaches.
- UK National Cyber Security Centre (NCSC/GCHQ): Monitoring the group's activities following the Legal Aid Agency breach and Jaguar Land Rover cyberattack in 2025.
- The group remains active and operational as of May 2026, with law enforcement largely unable to neutralize its decentralized leadership structure.
How to Defend Against ShinyHunters
1
Deploy phishing-resistant MFA: Replace push-based and SMS authentication with FIDO2 security keys or passkeys. These methods are resistant to the real-time social engineering and adversary-in-the-middle attacks ShinyHunters routinely employs. Google and Okta both explicitly recommend this step in response to these campaigns.
2
Enforce conditional access policies: Block logins from anonymized IPs (Mullvad, Oxylabs, 9Proxy, etc.), enforce device compliance checks, and require trusted network conditions for SSO access.
3
Monitor for new MFA device enrollments: Alert on any new device being registered against user accounts, especially if done outside of IT change windows or from unusual geolocations.
4
Audit OAuth application grants regularly: Review and revoke unnecessary OAuth applications connected to your identity provider and SaaS platforms. Immediately investigate any unexpected authorization events, especially for tools like ToogleBox Recall.
5
Limit SaaS-to-SaaS integration permissions: Apply least privilege to all OAuth integrations. Third-party SaaS integrations (e.g., analytics, CRM, email tools) should have read-only access where possible and should be reviewed quarterly.
6
Conduct security awareness training: Employees should be trained to verify the identity of any caller claiming to be IT support before taking any action. Establish a clear callback procedure using verified contact numbers from internal directories.
7
Hunt for behavioral indicators: Monitor SIEM/XDR for bulk SharePoint/OneDrive downloads, PowerShell-based file access, Salesforce Data Loader activity, high-volume document access events, and suspicious SharePoint keyword searches ("poc," "confidential," "vpn," "salesforce").
8
Monitor email deletion events: Alert on the deletion of MFA-related emails from Exchange/Gmail (e.g., emails with subjects matching "new MFA device," "security method enrolled," "factor activated").
9
Integrate threat intelligence feeds: Subscribe to Google Security Operations rule packs (Okta, Cloud Hacktool, O365 rule packs) for curated detections aligned to ShinyHunters TTPs.
10
Deploy dark web monitoring: Monitor for your organization's data appearing on paste sites, ShinyHunters' data leak site, or hacker forums where the group sells and auctions stolen data.
- Managed EDR & 24/7 AI-centric SOC: Huntress's always-on security operations center actively monitors for suspicious behavior including lateral movement, mass file access, anomalous authentication events, and persistence mechanisms — catching ShinyHunters post-access activity before data can be exfiltrated.
- Identity Threat Detection: Huntress's managed identity protection surfaces unauthorized MFA device enrollments, suspicious OAuth grants, and risky Okta/Azure AD activity — the exact behaviors ShinyHunters uses to maintain persistence after initial compromise.
- Security Awareness Training: Huntress delivers engaging, behavior-changing anti-phishing and social engineering training designed to reduce the likelihood of employees falling for ShinyHunters' vishing playbook.
- Incident Response: If your organization is compromised, Huntress's expert team provides hands-on incident response, containment, and remediation support to minimize the impact of a breach.
References
