Threat Actor Profile

ShinyHunters

ShinyHunters is a financially motivated cybercrime and extortion operation that has been active since at least 2019. The group is best known for large-scale data theft, SaaS-focused intrusions, and pay-or-leak extortion. Operating with no confirmed (or overt) nation-state affiliation, the group has established itself as one of the most prolific data theft and extortion gangs in the world, targeting SaaS platforms, cloud environments, and enterprise identity providers through sophisticated social engineering, credential theft, and large-scale data exfiltration — followed by ransom demands under a ruthless "pay or leak" model.

Threat Actor Profile

ShinyHunters

Country of Origin

ShinyHunters does not have a confirmed country of origin. The group is believed to be decentralized and internationally distributed. Known arrested affiliates include a French national (Sébastien Raoult, arrested in Morocco in 2022 and extradited to the U.S.) and at least four additional individuals arrested in France in June 2025, suggesting European ties. However, researchers widely assess the broader group to be a loose, multinational collective with members across multiple countries. No single nation-state has been formally attributed as the group's base of operations.

The September 2026 arrest of a Dutch national in the Netherlands adds to the pattern of European ties. However, a reported detention in Jordan on September 29 of a suspected member who uses the alias "Rey" (Saif al-Din Khader) points beyond Europe. His nationality has not been publicly reported, so the arrest shows where he was taken into custody rather than where he is from. Taken together, the arrests reinforce researchers' assessment that the broader group is a loose, multinational collective with no single base of operations.

Leadership

No single leader has been publicly confirmed, and the group's decentralized structure makes attribution difficult. On September 29, 2026, FBI Director Kash Patel announced the arrest of one of the "alleged leaders" of ShinyHunters, made by Dutch police on September 15 with FBI support. The suspect is a 24-year-old man from Amsterdam, and a Rotterdam court has ordered him held in pretrial detention for 90 days. Dutch authorities have not publicly named him. ShinyHunters said in a statement that the suspect has "no association" with the group.

The word "alleged" matters here: the FBI's language describes the suspect as one of the leaders, not the leader, which fits the group's loose, multi-cluster structure.

Members

ShinyHunters is better described as a loose criminal ecosystem than a rigidly structured organization. Huntress reporting describes ShinyHunters, Scattered Spider, and Lapsus$ as converging into the broader SLSH/ShinySp1d3r threat ecosystem, while Google tracks related activity under multiple distinct clusters depending on campaign and role — UNC6240, UNC6661, UNC6671, UNC6395, and UNC6040 among them. That suggests overlap and collaboration, but not a single neatly bounded membership list. Exact membership count is unknown, and the ShinyHunters name is best understood as a brand used by a fluid network of criminal affiliates rather than a fixed roster of individuals.

ShinyHunters TTPs

Tactics

ShinyHunters is primarily motivated by financial gain through large-scale data theft and extortion. The group's overarching tactical goals are:

Obtain unauthorized access to cloud-hosted enterprise environments, particularly SaaS platforms and identity providers.
Exfiltrate sensitive personal, financial, and proprietary data at massive scale.
Extort victim organizations with a "pay or leak" ultimatum — if ransom is unpaid, stolen data is listed on dark web marketplaces or the group's own data leak site (DLS).
Target high-value sectors including technology, finance, education, luxury retail, telecommunications, and critical infrastructure.
Escalate pressure on victims through DDoS attacks, defacement, harassment of personnel, and public extortion posts.

Techniques

ShinyHunters relies on a mix of social engineering, identity abuse, and SaaS-focused data theft techniques:

Voice phishing (vishing) to obtain SSO credentials and MFA codes from employees impersonating IT staff.
Victim-branded credential harvesting sites that mimic internal SSO, support, or identity portals.
MFA persistence and defense evasion, including registering attacker-controlled MFA devices and, in some cases, deleting enrollment notifications using ToogleBox Recall.
OAuth and refresh-token abuse involving third-party SaaS integrations such as Drift and Gainsight to access downstream Salesforce environments. ShinyHunters has also reportedly abused stolen Anodot authentication tokens and used those to exfiltrate corporate data from large databases such as Google BigQuery, in 2026 incidents involving extortion attempts against Snowflake, Rockstar Games and Canvas.
SaaS data theft from platforms such as Microsoft 365, SharePoint, Salesforce, Slack, and Experience Cloud deployments.
Extortion via email, Tox, Limewire-hosted proof samples, and a ShinyHunters-branded data leak site, with some campaigns also involving harassment or DDoS pressure.

Procedures

ShinyHunters follows a repeatable pattern across recent campaigns:

Initial access through vishing: operators call employees, pose as IT staff, direct them to a victim-branded phishing site, capture SSO credentials and MFA codes, then enroll their own MFA device.
SaaS expansion after compromise: once inside, operators opportunistically access the cloud apps available through the compromised session and search for sensitive terms such as `poc`, `confidential`, `internal`, `proposal`, `salesforce`, and `vpn`.
Salesforce vishing activity in 2025: public reporting tied ShinyHunters-branded operations to Salesforce-focused voice-phishing and extortion activity tracked as UNC6040 and UNC6240.
Drift/Salesloft token abuse in August 2025: stolen OAuth tokens were reportedly used to access roughly 760 downstream Salesforce customer organizations.
Gainsight token abuse in November 2025: follow-on activity affected more than 200 potentially impacted Salesforce instances, with Salesforce revoking related OAuth access during the response.
January 2026 vishing campaigns: GTIG tracked related activity as UNC6661 and UNC6671, including credential theft, SharePoint and OneDrive data access, and ToogleBox Recall authorization in at least some Okta-linked cases.
Anodot compromise in 2026: Threat actors who self-identified as ShinyHunters compromised and stole authentication tokens in April 2026 from Anodot, which characterizes itself as an AI-enhanced business analytics service. ShinyHunters appear to have repeatedly abused those stolen tokens to compromise databases from at least 13 large corporate customers of Anodot, such as Snowflake, Rockstar Games, and Canvas Instructure, throughout April and May 2026.
Extortion: follow-on demands were linked to UNC6240, with BTC payment instructions, 72-hour deadlines, Limewire samples, Tox negotiation, and DLS postings.

Want to Shut Down Threats Before They Start?

Notable Cyberattacks by ShinyHunters

Snowflake Customer Campaign (2024)

In mid-2024, ShinyHunters exploited stolen contractor credentials — not a vulnerability in Snowflake's platform itself — to access cloud data belonging to Snowflake customers. This campaign resulted in the theft and sale of data from Ticketmaster (560M records), Santander Bank (30M records), AT&T (109M call records — AT&T paid a $370,000 ransom to delete the data), Neiman Marcus (31M records), and dozens of other organizations. The group used a distinctive tool signature called "RapeFlake" during this operation.

Salesloft/Drift Salesforce Campaign — Largest SaaS Breach in History (Aug–Sep 2025)

ShinyHunters used the TruffleHog open-source security tool to scan source code repositories, discovering OAuth tokens for the Salesloft Drift email platform. Using those tokens, the group accessed approximately 760 Salesforce customer organizations between August 8–18, 2025, exfiltrating roughly 1.5 billion records across Account, Contact, Case, Opportunity, and User data tables. Confirmed victims included Cloudflare, Workiva, Zscaler, Tenable, CyberArk, Elastic, BeyondTrust, Proofpoint, JFrog, Rubrik, Cato Networks, and Palo Alto Networks. Google's Threat Intelligence team tracked this activity as UNC6395 and confirmed awareness of over 700 potentially impacted organizations.

Gainsight Salesforce Campaign (Nov 2025)

In a near-identical follow-up, ShinyHunters stole OAuth tokens from Gainsight's Salesforce integration and accessed approximately 285 Salesforce instances (200+ confirmed by Google). Victims included Atlassian, DocuSign, F5, GitLab, Malwarebytes, SonicWall, Thomson Reuters, and Verizon. Salesforce revoked all associated OAuth tokens and temporarily removed related AppExchange applications during the incident.

Okta SSO / Enterprise Vishing Campaign (Jan 2026)

Operating as UNC6661 and UNC6671, ShinyHunters impersonated IT support staff to trick employees at targeted organizations into entering Okta SSO credentials and MFA codes on custom victim-branded phishing portals. Post-access, attackers exfiltrated data from SharePoint, OneDrive, Salesforce, and Slack. In some incidents, the ToogleBox Recall Gmail add-on was silently authorized to delete MFA enrollment notification emails. Confirmed victims include Wynn Resorts, Odido, Panera Bread, Betterment, Grubhub, Harvard University, Princeton University, and University of Pennsylvania.

Salesforce Aura Exploitation Campaign (Mar 2026)

In March 2026, Salesforce issued a security advisory warning of a "known threat group" exploiting misconfigurations in Salesforce Experience Cloud (Aura). ShinyHunters claimed responsibility on their DLS, warning approximately 400 victim companies — including Snowflake, Okta, LastPass, and Salesforce itself — to pay or face data leaks. The group used a modified version of Google's AuraInspector Chrome extension alongside a custom-developed scanning tool. The user-agent string "RapeForce" was observed, mirroring the earlier Snowflake campaign's "RapeFlake" signature.

Instructure/Canvas Breach (Apr–May 2026)

ShinyHunters exploited previously-stolen credential tokens from Anodot to gain access to Instructure's Free-for-Teacher environment — related to support ticket handling — and steal 275 million records (3.65TB of data) from Canvas, one of the world's most widely used learning management systems used by more than 9,000 institutions. After a second wave of unauthorized access on May 7, 2026 defaced Canvas login portals at approximately 330 institutions with extortion messages, Instructure reached a ransom agreement with the group by May 12, 2026 to prevent data leakage. The company confirmed no passwords or course content were compromised.

FBI Jobs Portal Claim (Sep 2026)

In September 2026, ShinyHunters claimed it defaced the FBI's jobs website and stole two to three terabytes of data related to FBI and Justice Department personnel and applicants, saying it exploited a new vulnerability in Oracle PeopleSoft. The group demanded that the FBI retract a public service announcement about the group, and set a September 29 deadline. After the arrest was announced, the group said it was no longer setting a deadline and that "this was not a threat." The claim was first reported on September 22, after the arrested suspect was already in custody, which is one reason the arrest has not been publicly tied to this incident. The FBI said it was investigating the claim. These details come from the group's own statements and press reporting, and have not been independently confirmed.

ShinyHunters Law Enforcement

Despite the group's extensive criminal activity, law enforcement actions have been limited in scope and have not significantly disrupted operations:

Edward Dubrovsky, 54 (Toronto, Canada, October 9th, 2026): On October 9, 2026 Director Patel announced the FBI had arrested another "suspected co-conspirator" earlier that week, without naming him. Court records name him as Edward Dubrovsky, age 54, a cybersecurity founder and investor based in Toronto. A former managing director at the incident response firm Cypfer, Dubrovsky wrote a book on negotiating with cyber extortionists. He's charged with conspiracy to threaten to impair the confidentiality of information with intent to extort money, and with interference with commerce by threats.
Saif al-Din Khader (Jordan, September 2026): Reuters reported on October 3 that Khader, a suspected ShinyHunters member who uses the alias "Rey," was detained in Jordan on September 29 and is reportedly cooperating with the FBI to identify other members of the group. Journalist Brian Krebs previously described Khader as the technical operator and public face of Scattered LAPSUS$ Hunters, and Khader confirmed his identity to Krebs in 2025. The FBI declined to comment on specific arrests but confirmed on October 5 that it and its partners have arrested multiple subjects in the investigation. Meanwhile, ShinyHunters did not respond to The Register's questions about his alleged involvement.
Dutch National Police and FBI (September 2026): Dutch police arrested Pepijn van der Stap on September 15 on suspicion of being a ShinyHunters member. FBI Cyber Division Assistant Director Brett Leatherman said the group has allegedly breached more than 140 organizations since last year and taken at least $70 million in extortion payments. Investigators seized several data-storage devices and are examining them, and authorities have said further arrests remain possible. In a video statement, Leatherman directly addressed the remaining members, telling them the public is not aware of everything investigators know.
Sébastien Raoult (France, 2022–2024): A French national was arrested in Morocco in May 2022 and extradited to the United States. In January 2024, Raoult was sentenced to three years in prison and ordered to pay $5 million in restitution for his role in wire fraud conspiracy and aggravated identity theft. U.S. prosecutors noted he had worked with the group for over two years but was not a major figure within the organization.
Matthew D. Lane (U.S., 2025): A 19-year-old Massachusetts student was charged in May 2025 with hacking and extorting an education technology provider (widely reported as PowerSchool), using stolen contractor credentials to exfiltrate data on tens of millions of students and demand a $2.85 million Bitcoin ransom. Lane pleaded guilty on June 6, 2025.
French arrests (June 2025): French authorities announced the coordinated arrest of four individuals associated with ShinyHunters in multiple French regions. The aliases targeted included "ShinyHunters," "Hollow," "Noct," and "Depressed." Researchers and the group itself indicated those arrested were affiliates, not the core leadership, as the group continued operations uninterrupted.
FBI, Indonesian Police, Indian Police: Multiple agencies opened investigations following the Tokopedia breach (2020) and subsequent U.S.-based complaints from companies including Minted. Dave.com and BigBasket also coordinated with local law enforcement following their respective breaches.
UK National Cyber Security Centre (NCSC/GCHQ): Monitoring the group's activities following the Legal Aid Agency breach and Jaguar Land Rover cyberattack in 2025.
The group's decentralized structure has so far limited the impact of individual arrests. In response to the September 2026 arrest, ShinyHunters publicly denied that the suspect was affiliated with the group. Whether this arrest meaningfully disrupts operations remains to be seen, and defenders should assume the group's tradecraft remains active.

How to Defend Against ShinyHunters

Deploy phishing-resistant MFA: Replace push-based and SMS authentication with FIDO2 security keys or passkeys. These methods are resistant to the real-time social engineering and adversary-in-the-middle attacks ShinyHunters routinely employs. Google and Okta both explicitly recommend this step in response to these campaigns.

Enforce conditional access policies: Block logins from anonymized IPs (Mullvad, Oxylabs, 9Proxy, etc.), enforce device compliance checks, and require trusted network conditions for SSO access.

Monitor for new MFA device enrollments: Alert on any new device being registered against user accounts, especially if done outside of IT change windows or from unusual geolocations.

Audit OAuth application grants regularly: Review and revoke unnecessary OAuth applications connected to your identity provider and SaaS platforms. Immediately investigate any unexpected authorization events, especially for tools like ToogleBox Recall.

Limit SaaS-to-SaaS integration permissions: Apply least privilege to all OAuth integrations. Third-party SaaS integrations (e.g., analytics, CRM, email tools) should have read-only access where possible and should be reviewed quarterly.

Conduct security awareness training: Employees should be trained to verify the identity of any caller claiming to be IT support before taking any action. Establish a clear callback procedure using verified contact numbers from internal directories.

Detection & Response

Hunt for behavioral indicators: Monitor SIEM/XDR for bulk SharePoint/OneDrive downloads, PowerShell-based file access, Salesforce Data Loader activity, high-volume document access events, and suspicious SharePoint keyword searches ("poc," "confidential," "vpn," "salesforce").
Monitor email deletion events: Alert on the deletion of MFA-related emails from Exchange/Gmail (e.g., emails with subjects matching "new MFA device," "security method enrolled," "factor activated").
Integrate threat intelligence feeds: Subscribe to Google Security Operations rule packs (Okta, Cloud Hacktool, O365 rule packs) for curated detections aligned to ShinyHunters TTPs.
Deploy dark web monitoring: Monitor for your organization's data appearing on paste sites, ShinyHunters' data leak site, or hacker forums where the group sells and auctions stolen data.

Try Huntress for Free

References

Detect, Respond, Protect

See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.

Try Huntress for Free