ShinyHunters

Summary

Financially motivated data-theft extortion group. Google Threat Intelligence Group (GTIG) tracks the extortion operation as UNC6240: it steals data and threatens to publish it on a leak site unless paid. In 2025 UNC6240 extorted victims of the Salesforce voice-phishing data theft carried out by the separate cluster UNC6040, claiming to be ShinyHunters in every contact; in Jan 2026 GTIG tracked ShinyHunters-branded SaaS extortion that followed SSO/MFA vishing by UNC6661. In 2026 GTIG attributes intrusions to UNC6240 itself: exploitation of Oracle PeopleSoft Environment Management Hub (CVE-2026-35273) as a zero-day between 27 May and 9 Jun 2026 against more than 100 organisations, mostly universities, followed in Sep 2026 by a renewed mass-exploitation wave that bypasses WAF rules and reaches government, healthcare, IT, transport and agriculture. It installs MeshAgent/MeshCentral for persistence after web-shell placement. The ShinyHunters name is also co-opted by other crews (GTIG notes potential impersonation; UNC6671 used it once), so a ShinyHunters claim alone is not attribution.

Attribution

Financially motivated; no state link

Criminal or hacktivist group; no state sponsorship established.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Cybercriminal collective
• Google Threat Intelligence Group (Research, 2026-06-11)
  Tracks it as UNC6240, an extortion group

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 10

Malware and tools 1

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• Lookalike cloud and SSO domains, e.g. azurenetfiles[.]net; trial Okta tenants (MITRE ATT&CK, 2026)
• Python staging servers on port 8888; IT-themed MeshAgent domain winmanage-me.network (MITRE ATT&CK, 2026; Google GTIG, 2026)

Reporting and advisories 6

• Microsoft Threat Intelligence
  Defending SaaS-based applications against ShinyHunters OAuth abuse
• Google Threat Intelligence Group
  Extortion of Salesforce vishing data-theft victims (intrusions by UNC6040)
• Google Threat Intelligence Group
  ShinyHunters-branded SaaS data-theft extortion after SSO/MFA vishing (with UNC6661)
• Google Threat Intelligence Group
  Oracle PeopleSoft PSEMHUB zero-day (CVE-2026-35273) — higher education
• Google Threat Intelligence Group
  Renewed PeopleSoft mass exploitation — WAF-bypass variant of CVE-2026-35273
• MITRE ATT&CK
  ShinyHunters (G1057) group profile