ShinyHunters (Bling Libra)
Data-theft and extortion crew behind the 2025 Salesforce vishing wave, the Canvas school hack and a 2026 PeopleSoft zero-day campaign; active since at least 2019.
- Active
- 2019 to October 2026
- Origin
- Not attributed to a state; international cybercrime collective (members charged or arrested in the US, France and the Netherlands)
- Type
- Cybercrime
- Affiliates
- ShinyCorp persona; Mandiant/GTIG UNC6240 (extortion), with intrusion clusters UNC6040, UNC6661 and UNC6671; self-styled Scattered LAPSUS$ Hunters alliance with Scattered Spider and LAPSUS$ members (reported); The Com
- Regions targeted
- United States, Europe (France), multinational companies worldwide, higher education institutions
- MITRE ATT&CK
- G1057
What each vendor calls it
- Google / Mandiant
- UNC6240
- Palo Alto Unit 42
- Bling Libra
Profile
ShinyHunters is a financially motivated cybercrime collective that steals large databases and then sells them or uses them to extort the companies they came from. MITRE ATT&CK dates its activity to at least 2019; Intel 471 and Palo Alto Networks Unit 42 put its public emergence in 2020, and Intel 471 notes the name borrows from the hobby of hunting rare “shiny” Pokémon. It operates under a “ShinyCorp” persona. Unit 42 tracks the group behind the brand as Bling Libra, and Mandiant and Google Threat Intelligence Group (GTIG) use UNC6240 for the extortion activity that carries the ShinyHunters name. No government has tied it to a state. In January 2024 a French member, Sebastien Raoult, was sentenced in Seattle to three years in US prison and ordered to pay about $5 million after pleading guilty to wire fraud conspiracy and aggravated identity theft; the US Justice Department said the crew hit more than 60 companies worldwide.
The early playbook was quiet and repeatable. According to Intel 471, the group phished Microsoft 365 users, went after developers and GitHub accounts, and mined source code for cloud keys and OAuth credentials that let it reach databases hosted in the cloud, then dumped the data and sold it on RaidForums and similar markets. Claimed victims from 2020 and 2021 include Microsoft’s GitHub account, Tokopedia, Pixlr and Bonobos. It also claimed 70 million AT&T records, a claim AT&T denied.
In 2024 the group changed its business model. Unit 42 described a case in which Bling Libra found an exposed AWS access key, waited almost a month, deleted several S3 buckets, created mocking buckets named after its contact address, and emailed the victim that it had “shifted to extortion to make more money.” That marked a shift away from simple data resale and toward pressure on the victim itself.
The 2025 Salesforce campaign made the name famous. GTIG reported that operators it tracks as UNC6040 phoned employees while posing as IT support and talked them into authorizing a modified Salesforce Data Loader app (T1566.004 (Phishing: Spearphishing Voice)), then pulled whole tables of customer data. Extortion, which GTIG labels UNC6240, sometimes followed months later and always claimed to be ShinyHunters. Google disclosed that one of its own Salesforce instances was hit in June 2025, and the FBI issued a FLASH alert in September. GTIG later tied the November 2025 abuse of Gainsight OAuth tokens to ShinyHunters. The FBI’s FLASH also covered UNC6395, the cluster behind the August 2025 Salesloft Drift token theft, but Google’s own write-up of that incident does not link it to ShinyHunters, so treat that connection as unconfirmed.
The relationship with other English-speaking crime crews is where the reporting gets messy. MITRE places ShinyHunters in “The Com,” the loose online community whose members have included Scattered Spider and LAPSUS$, and notes that joint operations have run under the “Scattered LAPSUS$ Hunters” name. EclecticIQ found no direct structural link to Scattered Spider but assessed with high confidence that ShinyHunters hired some Scattered Spider members for voice phishing, and that one persona is active in both groups. The Record described Scattered LAPSUS$ Hunters in October 2025 as a self-styled alliance that includes ShinyHunters and Lapsus$. ShinyHunters itself has denied ties to both Scattered Spider and The Com, according to The Hacker News. GTIG deliberately keeps its clusters separate to allow for shifting partnerships and impersonation, which is a sensible way to read any “ShinyHunters did it” headline.
2026 brought more targets and more aggression. In January Mandiant reported new vishing clusters (UNC6661 and UNC6671) that steered staff to look-alike SSO pages, captured MFA codes, registered their own devices and raided Microsoft 365, Salesforce, Google Workspace and other SaaS apps, with UNC6240 handling extortion, DDoS and text messages to employees. In May the group hit the Canvas learning platform, defaced school login pages, and drew an FBI public service announcement warning of threatening calls to victims’ relatives and swatting. In June Mandiant documented the group exploiting a PeopleSoft zero-day, CVE-2026-35273, with 68% of the more than 100 notified organizations in higher education. That move from social engineering to exploiting a public-facing application is the most notable tactical change in its history.
Arrests have not stopped the brand. French police detained four suspects in June 2025, one using the handle ShinyHunters, yet the Salesforce extortion campaign continued and widened. In September and October 2026, after the group claimed a breach of the FBI’s jobs portal, suspects were arrested in the Netherlands and reportedly in Jordan, and a ransomware negotiator was arrested in the US on sealed federal charges that reporting connects to the investigation. FBI Director Kash Patel called that person a suspected ShinyHunters co-conspirator. According to SecurityAffairs, the FBI says the group extorted more than $70 million in 2026.
Events
| Date | Target | Narrative | Source | Our coverage |
|---|---|---|---|---|
| 2026-09 to 2026-10 | Suspected members and associates (law enforcement action) | A suspected member is arrested in the Netherlands on Sept. 15 and another reportedly in Jordan on Sept. 28. On Oct. 8 a Canadian ransomware negotiator is arrested in Pennsylvania on sealed federal extortion conspiracy charges; FBI Director Kash Patel describes an arrest of “another suspected co-conspirator” of ShinyHunters. The FBI says the group has extorted more than $70 million this year. | SecurityAffairs | |
| 2026-09 | FBI jobs portal and related services (US government) | The group claims about 2 TB of data on FBI employees and job applicants and defaces FBIJobs.gov; it says it used a new PeopleSoft zero-day. The FBI confirmed it was investigating; SecurityAffairs reports the FBI later blamed a contractor’s failure to patch PeopleSoft. The scope of the data has not been confirmed. | The Hacker News, SecurityAffairs | |
| 2026-05-27 to 2026-06-09 | More than 100 organizations, mostly US, 68% in higher education | Zero-day exploitation of CVE-2026-35273 in PeopleSoft Environment Management Hub (T1190 (Exploit Public-Facing Application)). Operators install MeshCentral agents disguised as Azure services, spray SSH credentials with a “fanout” script (T1021.004 (Remote Services: SSH)), drop a “you’ve been hacked” marker file, compress data with zstd and exfiltrate it; some victims’ data appears on the group’s leak site. | Mandiant / GTIG | |
| 2026-05-15 | US schools and students | FBI public service announcement: the group claimed an attack on an online learning management system that interrupted classes, and backs extortion with threatening calls and texts to victims and relatives, and in some cases swatting. Claims of compromising photos or videos often prove false. | FBI IC3 | |
| 2026-05 | Instructure Canvas learning platform and schools that use it | After Instructure disclosed a breach, the group defaces Canvas login pages at schools with an extortion message (T1491.001 (Defacement: Internal Defacement)). Instructure says the attacker exploited an issue with its Free-For-Teacher accounts and took Canvas offline. The group claims data from almost 9,000 schools, which has not been confirmed. | TechCrunch | |
| 2026-01 | Organizations using Okta-protected SSO, Microsoft 365, Salesforce and Google Workspace | Vishing clusters UNC6661 and UNC6671 pose as IT staff, send employees to victim-branded SSO phishing sites, capture MFA codes and enroll their own device (T1098.005 (Account Manipulation: Device Registration)), then bulk-download SaaS data and delete notification emails. UNC6240 sends ShinyHunters-branded extortion with 72-hour deadlines, texts employees, launches DDoS attacks (T1498 (Network Denial of Service)) and opens a new leak site. Compromised mailboxes are also used to phish cryptocurrency-company contacts. | Mandiant | |
| 2025-11 | Salesforce customers using Gainsight apps | Salesforce revokes tokens for Gainsight-published apps after unusual activity. GTIG attributes the theft of third-party OAuth tokens (T1550.001 (Use Alternate Authentication Material: Application Access Token)) to ShinyHunters and compares it to the Salesloft Drift campaign. Gainsight said three organizations were known to be compromised at the time. | SecurityWeek | |
| 2025-11 | Harvard University Alumni Affairs and Development systems (donors, alumni, parents, some faculty, staff and students) | Harvard discovers an intrusion into its fundraising systems on Nov. 18, 2025. ShinyHunters claims it and says it took more than 1 million records, then leaks an archive in February 2026 after Harvard refuses to pay; Harvard has not attributed the attack or said how the attackers got in. In November 2026 Have I Been Pwned adds 851,000 unique email addresses with names, birth dates, phone numbers and addresses; Harvard says no Social Security numbers, passwords or payment data were in the systems. | BleepingComputer | Our story |
| 2025-10 | 39 Salesforce customers and Salesforce itself | Under the Scattered LAPSUS$ Hunters banner, the group threatens to leak about 1 billion records it claims were stolen from Salesforce customers unless Salesforce pays. The FBI and French police seize the BreachForums domain used as the extortion portal. Salesforce refuses to pay; Google was the only listed company to confirm data theft at the time. | The Record | |
| 2025-09 | Organizations’ Salesforce instances | FBI FLASH warns of UNC6040 vishing (since October 2024) and UNC6395 OAuth token abuse, notes that some UNC6040 victims got extortion emails from “the ShinyHunters group,” and publishes indicators. | FBI | |
| 2025-08 | Cosmetics company; organizations with Okta, Microsoft SSO, Citrix VPN or GitHub access | A short-lived “Scattered Lapsus$ Hunters” Telegram channel leaks API keys tied to a cosmetics company (Aug. 8); a later channel recruits paid insiders with SSO, VPN and code-repository access (Aug. 31). | EclecticIQ | |
| 2025-06 | Google corporate Salesforce instance | Google discloses that UNC6040 briefly accessed a Salesforce instance holding small and medium business contact details, largely basic and public business information, before access was cut off. | GTIG | |
| 2025-06 | Suspected members (law enforcement action) | French cybercrime police detain four suspects, one using the handle ShinyHunters, in a BreachForums-linked case; Le Parisien reports they are accused over breaches at Boulanger, SFR, France Travail and the French Football Federation. | The Record | |
| 2024-10 to 2025 | English-speaking branches of multinational companies | UNC6040 callers pose as IT support and walk staff through authorizing a modified Salesforce Data Loader on the connected-app page, then exfiltrate tables and move on to Okta and Microsoft 365. UNC6240 later demands bitcoin within 72 hours while claiming to be ShinyHunters. | GTIG, FBI | |
| 2025 | Investment banking, luxury retail, travel, US payment processing and e-commerce companies; an airline | Reused Okta login phishing pages target staff in these sectors. In the Salesforce campaign, ShinyCorp offers an airline’s stolen customer, flight and chat data for up to $1 million per company. | EclecticIQ | |
| Reported 2025-09 | Financial institutions and manufacturers | EclecticIQ reports exploitation of the Oracle Access Manager flaw CVE-2021-35587, followed by database extraction, and says it notified the victims. | EclecticIQ | |
| 2024 | Organization running AWS (not named) | Bling Libra uses an AWS key found in an exposed file (T1552.001 (Unsecured Credentials: Credentials In Files)), browses S3 with S3 Browser, deletes buckets with WinSCP (T1485 (Data Destruction)) and sends a one-week extortion demand. | Unit 42 | |
| 2024-01 | French member (court action) | Sebastien Raoult is sentenced in the Western District of Washington to three years in prison and about $5 million in restitution for his part in ShinyHunters intrusions at more than 60 companies. | US Justice Department, The Record | |
| 2020 to 2021 | Technology, retail and media companies worldwide (Microsoft’s GitHub account, Pixlr, Bonobos, Tokopedia) | Phishing pages and stolen credentials give access to code repositories and cloud-hosted databases; stolen data is sold on RaidForums and other markets. A claim of 70 million AT&T records was denied by AT&T. | Intel 471, Unit 42 | |
| 2019 | Not disclosed | Earliest activity MITRE ATT&CK attributes to the group. | MITRE ATT&CK |
Target vectors risk profile
| Cloud/identity | Technology/SaaS | Ransomware/extortion | Education/research | Software supply chain | Retail/POS | Finance | Government | Crypto/DeFi | Transportation/logistics | Manufacturing | Telecom | Espionage |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| High | High | High | High | Medium | Medium | Medium | Medium | Medium | Medium | Low | Low | N/A |
Malware and tools
| Name | What it does | Public detection | Hunt Leads | Reports |
|---|---|---|---|---|
| Modified Salesforce Data Loader | Legitimate bulk-export app, renamed (for example “My Ticket Portal”) and authorized by tricked staff as a connected app to pull Salesforce data | Indicators in the FBI FLASH; hardening and logging guidance in GTIG’s report | GTIG | |
| Custom Python export scripts | Replaced Data Loader in later intrusions to query and exfiltrate Salesforce data | None published | GTIG | |
| Okta phishing panel | Look-alike SSO login pages, often victim-branded, used during calls to capture passwords and MFA codes | Domain patterns and hunting queries in Mandiant’s report; domains added to Chrome Safe Browsing | Mandiant, EclecticIQ | |
| MeshCentral | Open-source remote management agent, renamed to look like Azure tooling, used for command and control on PeopleSoft hosts (T1219 (Remote Access Tools)) | Google SecOps rules (Mandiant Frontline Threats pack) described in the report | Mandiant / GTIG | |
| “fanout” propagation script | Shell script that parses internal PeopleSoft hostnames and sprays SSH credentials with sshpass to spread | Google SecOps rules described in the report | Mandiant / GTIG | |
| S3 Browser, WinSCP | Legitimate file tools used to enumerate, copy and delete AWS S3 buckets | User-agent and CloudTrail hunting guidance in Unit 42’s report | Unit 42 | |
| ShinySp1d3r | Ransomware-as-a-service offering, with VMware ESXi encryption, that EclecticIQ reported was still in development in September 2025 | None published | EclecticIQ |
Reports
Vulnerabilities exploited
| Vulnerability | CVSS | Severity | Publisher | Platform | CISA KEV |
|---|---|---|---|---|---|
| CVE-2026-35273 | 9.8 (Oracle, CNA; no NVD score) | Critical | Oracle | PeopleSoft Enterprise PeopleTools (Environment Management Hub) | Yes |
| CVE-2021-35587 | 7.5 (CVSS v2; NVD has no v3.1 score) | High | Oracle | Oracle Access Manager (Fusion Middleware) | Yes |
If you’re in their sights
Do this now
- Move staff, and especially admins and help desk agents, to phishing-resistant MFA (security keys or passkeys), and require a call-back or in-person check before anyone resets a password or enrolls a new MFA device. The group’s main way in is a convincing phone call from “IT.”
- Lock down Salesforce and other SaaS apps: restrict who can authorize connected apps and who has API and bulk-export rights, allowlist approved apps, and alert on large exports and logins from VPN or Tor addresses.
- Inventory every third-party OAuth integration, revoke the ones you don’t need, and rotate tokens and keys after any vendor incident. Keep cloud keys and passwords out of code repositories and support tickets, where this group has found them.
- Patch Oracle PeopleSoft and Oracle Access Manager now, and block internet access to PeopleSoft’s Environment Management Hub endpoints. Watch for unexpected MeshCentral agents and outbound SMB from those servers.
- Plan for the pressure campaign, not just the breach: alert on new MFA devices and deleted security-notification emails, warn staff that extortionists may text or call them and their families, and don’t pay.
Compiled from Mandiant and Google Threat Intelligence Group, FBI advisories, Palo Alto Networks Unit 42, EclecticIQ, Intel 471, the US Justice Department, MITRE ATT&CK, The Record, TechCrunch, SecurityWeek, SecurityAffairs and The Hacker News, plus ThreatRoundup reporting. Last reviewed November 3, 2026.
ATT&CK techniques (46)
Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.
Reconnaissance 5
Resource Development 6
Initial Access 5
Execution 4
Persistence 3
Privilege Escalation 3
Stealth 5
Credential Access 3
Discovery 7
Lateral Movement 3
Collection 4
Command and Control 4
Exfiltration 1
Software MITRE links to this group (1)
ThreatRoundup coverage
1 of these story has Hunt Leads: detection-ready leads for threat hunters.