Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Hunt / shinyhunters

ShinyHunters

G1057 ShinyHunters

22victims, 90d
Sep 24last post
14reports about them
36/42techniques with a rule
12indicators

Who they hit

  • Healthcare8
  • Technology5
  • Unclassified3
  • Finance2
  • Manufacturing1
  • Government1
  • US13
  • ??4
  • CH2
  • DE1
  • SE1
  • IL1
PostedVictimCountrySector
2026-09-24Final statement re PSA??Unclassified
2026-09-22Fresenius Medical CareDEHealthcare
2026-09-22PSA - READ THIS NOW??Unclassified
2026-09-17Qi****??Unclassified
2026-09-13Kimberly-ClarkUSManufacturing
2026-09-07State of Florida DMVUSGovernment
2026-09-07Medela.comCHHealthcare
2026-08-29Neogen CorporationUSAgriculture & food
2026-08-28McKesson CorporationUSHealthcare
2026-08-28Elekta ABSEHealthcare
2026-08-28Jack Henry & AssociatesUSFinance
2026-08-23CyrusOne, LLC.USTechnology

Latest 12 of 22, from ransomware.live. These are the group's claims.

Confirmed elsewhere

Victims of ShinyHunters that a second, independent source also named inside two weeks. How convergence works.

Reports about them

Also named in passing in 19 more: Malwarebytes Labs, ReliaQuest, Flare, Check Point Research, Sophos X-Ops, Cisco Talos, Flare, Recorded Future Insikt, Sekoia TDR, AhnLab ASEC, AhnLab ASEC, AhnLab ASEC, AhnLab ASEC, GuidePoint GRIT, AhnLab ASEC, Check Point Research, Google Threat Intelligence, Huntress, Huntress. Those don't feed the techniques or indicators below.

What they exploit

CVEProductKEVEPSS
CVE-2024-34102Adobe Commerce and Magento Open Sourceyes1.000
CVE-2026-109618PHP Group PHPyes1.000
CVE-2026-109619PHP Group PHPyes1.000
CVE-2026-35273Oracle PeopleSoft Enterprise PeopleToolsyes, ransomware use0.967

What they do

55 techniques, in kill-chain order. 6 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.

IDTechniqueSourceSigmaHQStatus
T1589.001 Credentials mitre ~2 their side
T1593.003 Code Repositories mitre 2 their side
T1595.002 Vulnerability Scanning mitre report 1 their side
T1596.003 Digital Certificates report their side
T1596.005 Scan Databases report their side
T1598 Phishing for Information mitre report ~1 their side
T1598.003 Spearphishing Link mitre their side
T1583.001 Domains mitre their side
T1583.004 Server mitre their side
T1585.002 Email Accounts mitre their side
T1587.004 Exploits mitre ~6 their side
T1588.002 Tool mitre 9 their side
T1588.007 Artificial Intelligence mitre ~2 their side
T1078 Valid Accounts mitre 55 SigmaHQ
T1078.002 Domain Accounts mitre 5 SigmaHQ
T1078.004 Cloud Accounts mitre 40 SigmaHQ
T1190 Exploit Public-Facing Application mitre report 147 thrunt
T1195.001 Compromise Software Dependencies and Development Tools mitre 2 SigmaHQ
T1566 Phishing report 14 SigmaHQ
T1059.003 Windows Command Shell report 46 SigmaHQ
T1059.004 Unix Shell report 18 SigmaHQ
T1059.007 JavaScript mitre 29 SigmaHQ
T1059.009 Cloud API mitre 3 SigmaHQ
T1072 Software Deployment Tools mitre 4 SigmaHQ
T1203 Exploitation for Client Execution mitre 35 SigmaHQ
T1505.003 Web Shell report 34 thrunt
T1110 Brute Force mitre 25 SigmaHQ
T1528 Steal Application Access Token mitre 14 SigmaHQ
T1552.001 Credentials In Files mitre report 24 SigmaHQ
T1016 System Network Configuration Discovery mitre report 11 SigmaHQ
T1018 Remote System Discovery mitre 17 SigmaHQ
T1069.003 Cloud Groups mitre 1 SigmaHQ
T1082 System Information Discovery mitre report 33 SigmaHQ
T1083 File and Directory Discovery mitre 24 SigmaHQ
T1580 Cloud Infrastructure Discovery mitre 1 SigmaHQ
T1619 Cloud Storage Object Discovery mitre 1 SigmaHQ
T1210 Exploitation of Remote Services mitre 15 SigmaHQ
T1550.001 Application Access Token mitre 4 SigmaHQ
T1213.003 Code Repositories mitre 5 SigmaHQ
T1213.006 Databases mitre ~7 close only
T1530 Data from Cloud Storage mitre nothing
T1560.002 Archive via Library mitre ~4 close only
T1090 Proxy report 22 SigmaHQ
T1090.003 Multi-hop Proxy mitre 3 SigmaHQ
T1105 Ingress Tool Transfer mitre 87 thrunt
T1219 Remote Access Tools mitre report 6 thrunt
T1573.002 Asymmetric Cryptography mitre ~6 close only
T1048 Exfiltration Over Alternative Protocol report 12 SigmaHQ
T1567 Exfiltration Over Web Service mitre 12 SigmaHQ
T1485 Data Destruction mitre 20 SigmaHQ
T1491.001 Internal Defacement mitre 4 SigmaHQ
T1657 Financial Theft mitre nothing
T1027 Obfuscated Files or Information report 94 SigmaHQ
T1036.005 Match Legitimate Resource Name or Location mitre 21 thrunt
T1684 Social Engineering mitre nothing

SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.

Rules to deploy

Written for ShinyHunters, from the reports above.

Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1204-004-clickfix-run-dialog-execution.

Sweep

8 sha256, 3 ipv4, 1 domain. iocs.csv · package.json · 2 lookalike domains that name a target are held back.

TypeValueFrom
domainwinmanage-me.networkGoogle Threat Intelligence
ipv4104.219.234.138Google Threat Intelligence
ipv4162.219.30.165Google Threat Intelligence
ipv45.199.162.157Google Threat Intelligence
sha2562bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7Google Threat Intelligence
sha2563ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3Google Threat Intelligence
sha256419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86Google Threat Intelligence
sha25648b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494Google Threat Intelligence
sha256a4e525d8825c1bac6dd934ef2c008b5fb9988289190b5b98d854799e07e207e4Sekoia TDR
sha256ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07Google Threat Intelligence
sha256d5efdf6f35e9c6edcad5fbec707e6c88570c9d8796bf089c29303d591b94e384Sekoia TDR
sha256fa210f015399de16bf7cb1e05856d179dfaabb1ecc9bb5fd277f94972a3bdc43Sekoia TDR