{
  "slug": "shinyhunters",
  "group": "shinyhunters",
  "name": "ShinyHunters",
  "note": null,
  "attck": [
    {
      "id": "G1057",
      "name": "ShinyHunters",
      "kind": "intrusion-set",
      "url": "https://attack.mitre.org/groups/G1057"
    }
  ],
  "activity": {
    "postings": 22,
    "first": "2026-08-14",
    "last": "2026-09-24",
    "countries": {
      "??": 4,
      "DE": 1,
      "US": 13,
      "CH": 2,
      "SE": 1,
      "IL": 1
    },
    "sectors": {
      "unknown": 3,
      "healthcare": 8,
      "manufacturing": 1,
      "government": 1,
      "agriculture": 1,
      "finance": 2,
      "technology": 5,
      "consumer": 1
    },
    "recent": [
      {
        "date": "2026-09-24",
        "name": "Final statement re PSA",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/RmluYWwgc3RhdGVtZW50IHJlIFBTQUBzaGlueWh1bnRlcnM="
      },
      {
        "date": "2026-09-22",
        "name": "Fresenius Medical Care",
        "country": "DE",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/RnJlc2VuaXVzIE1lZGljYWwgQ2FyZUBzaGlueWh1bnRlcnM="
      },
      {
        "date": "2026-09-22",
        "name": "PSA - READ THIS NOW",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/UFNBIC0gUkVBRCBUSElTIE5PV0BzaGlueWh1bnRlcnM="
      },
      {
        "date": "2026-09-17",
        "name": "Qi****",
        "country": "??",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/UWkqKioqQHNoaW55aHVudGVycw=="
      },
      {
        "date": "2026-09-13",
        "name": "Kimberly-Clark",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/S2ltYmVybHktQ2xhcmtAc2hpbnlodW50ZXJz"
      },
      {
        "date": "2026-09-07",
        "name": "State of Florida DMV",
        "country": "US",
        "sectors": [
          "government"
        ],
        "url": "https://www.ransomware.live/id/U3RhdGUgb2YgRmxvcmlkYSBETVZAc2hpbnlodW50ZXJz"
      },
      {
        "date": "2026-09-07",
        "name": "Medela.com",
        "country": "CH",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/TWVkZWxhLmNvbUBzaGlueWh1bnRlcnM="
      },
      {
        "date": "2026-08-29",
        "name": "Neogen Corporation",
        "country": "US",
        "sectors": [
          "agriculture"
        ],
        "url": "https://www.ransomware.live/id/TmVvZ2VuIENvcnBvcmF0aW9uQHNoaW55aHVudGVycw=="
      },
      {
        "date": "2026-08-28",
        "name": "McKesson Corporation",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/TWNLZXNzb24gQ29ycG9yYXRpb25Ac2hpbnlodW50ZXJz"
      },
      {
        "date": "2026-08-28",
        "name": "Elekta AB",
        "country": "SE",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/RWxla3RhIEFCQHNoaW55aHVudGVycw=="
      },
      {
        "date": "2026-08-28",
        "name": "Jack Henry & Associates",
        "country": "US",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/SmFjayBIZW5yeSAmIEFzc29jaWF0ZXNAc2hpbnlodW50ZXJz"
      },
      {
        "date": "2026-08-23",
        "name": "CyrusOne, LLC.",
        "country": "US",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/Q3lydXNPbmUsIExMQy5Ac2hpbnlodW50ZXJz"
      }
    ]
  },
  "convergences": [
    {
      "name": "NovoCure Ltd",
      "flagged": "2026-09-02",
      "classes": [
        "filing",
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "McKesson Corporation",
      "flagged": "2026-08-29",
      "classes": [
        "filing",
        "leak",
        "litigation",
        "press",
        "report"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Metabase",
      "flagged": "2026-08-15",
      "classes": [
        "leak",
        "report"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "RingCentral, Inc.",
      "flagged": "2026-07-30",
      "classes": [
        "leak",
        "litigation",
        "report"
      ],
      "curated": false,
      "hand_picked": true
    },
    {
      "name": "Ernst & Young LLP",
      "flagged": "2026-07-28",
      "classes": [
        "leak",
        "litigation",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    },
    {
      "name": "Fluke Corporation",
      "flagged": "2026-07-11",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/",
      "publisher": "Unit 42",
      "published": "2026-11-06",
      "title": "Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight",
      "publisher": "Flare",
      "published": "2026-11-04",
      "title": "Aftermath of the September ShinyHunters Arrests: Battle Over the Brand Name",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.malwarebytes.com/blog/data-breaches/2026/10/hackers-steal-and-publish-data-on-41000-homeland-security-workers",
      "publisher": "Malwarebytes Labs",
      "published": "2026-10-30",
      "title": "Hackers steal and publish data on 41,000 Homeland Security workers",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/",
      "publisher": "Unit 42",
      "published": "2026-10-28",
      "title": "Unwrapping Retail Peak Season Cyber Threats",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://reliaquest.com/blog/threat-spotlight-residential-proxies-mask-social-engineering-attacks/",
      "publisher": "ReliaQuest",
      "published": "2026-10-28",
      "title": "Residential Proxies Mask Social-Engineering Attacks",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flare.io/learn/resources/blog/ai-cybercrime-economics-ransomware-extortion",
      "publisher": "Flare",
      "published": "2026-10-26",
      "title": "Who Pays When AI Makes Cybercrime Cheaper? Inside the New Economics of Ransomware and Extortion",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://research.checkpoint.com/2026/26th-october-threat-intelligence-report/",
      "publisher": "Check Point Research",
      "published": "2026-10-26",
      "title": "26th October – Threat Intelligence Report",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flare.io/learn/resources/blog/the-com-ecosystem-actors-attribution",
      "publisher": "Flare",
      "published": "2026-10-20",
      "title": "Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sophos.com/en-us/blog/graph-reconnaissance-and-servicenow-user-enumeration-in-a-modern-identity-intrusion",
      "publisher": "Sophos X-Ops",
      "published": "2026-10-19",
      "title": "Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/",
      "publisher": "Cisco Talos",
      "published": "2026-10-15",
      "title": "The Q3 Vulnerability Pulse: Discovery ≠ Exploitation",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flare.io/learn/resources/blog/identity-exposure-management-ai-attacks",
      "publisher": "Flare",
      "published": "2026-10-13",
      "title": "Navigating the Waves of AI-Powered Identity Attacks: Lessons From One Year of Identity Exposure Management",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.recordedfuture.com/blog/september-2026-cve-landscape",
      "publisher": "Recorded Future Insikt",
      "published": "2026-10-13",
      "title": "September 2026 CVE Landscape",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.sekoia.com/blog/with-sekoia-intelligence-we-gave-you-half-the-picture-heres-the-other-half",
      "publisher": "Sekoia TDR",
      "published": "2026-10-12",
      "title": "Introducing Sekoia Digital Risk: Track Identity-Led Breaches",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95764/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Dark Web Breach Incident Trend Report",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95770/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Dark Web Threat Actor Trend Report",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95949/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "September 2026 Threat Trend Report on Ransomware",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/96155/",
      "publisher": "AhnLab ASEC",
      "published": "2026-10-11",
      "title": "Security Issues in the Korean & Global Financial Sector in September 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.guidepointsecurity.com/blog/ransomware-insights-q3-2026/",
      "publisher": "GuidePoint GRIT",
      "published": "2026-10-08",
      "title": "GRIT Q3 2026 Ransomware and Cyber Threat Insights Report: Top Takeaways",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://asec.ahnlab.com/en/95669/",
      "publisher": "AhnLab ASEC",
      "published": "2026-09-30",
      "title": "Ransom & Dark Web Issues Week 1, October 2026",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/",
      "publisher": "Google Threat Intelligence",
      "published": "2026-09-25",
      "title": "ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters",
      "publisher": "Sekoia TDR",
      "published": "2026-09-24",
      "title": "Gotta Breach 'Em All! The Journey Of ShinyHunters",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.halcyon.ai/blog/halcyon-in-the-news-cynthia-kaiser-shinyhunters-fbi-breach",
      "publisher": "Halcyon",
      "published": "2026-09-24",
      "title": "Halcyon in the News: Cynthia Kaiser on the ShinyHunters Breach of the FBI",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://research.checkpoint.com/2026/14th-september-threat-intelligence-report/",
      "publisher": "Check Point Research",
      "published": "2026-09-14",
      "title": "14th September – Threat Intelligence Report",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://flare.io/learn/resources/blog/shinyhunters-claims-impersonation-campaign",
      "publisher": "Flare",
      "published": "2026-09-10",
      "title": "ShinyHunters Claims Impersonation Campaign: 61 Domains Found",
      "origin": "manual",
      "primary": true
    },
    {
      "url": "https://www.miragesecurity.ai/blog/shinyhunters-vishing-playbook",
      "publisher": "MirageSec",
      "published": "2026-09-10",
      "title": "Inside the ShinyHunters vishing playbook: two captured Okta clones and a passkey bypass",
      "origin": "manual",
      "primary": true
    },
    {
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai/",
      "publisher": "Google Threat Intelligence",
      "published": "2026-09-08",
      "title": "GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://health-isac.org/urgent-threat-alert-shinyhunters-vishing-campaigns-and-domain-impersonation/",
      "publisher": "Health-ISAC",
      "published": "2026-09-03",
      "title": "Urgent Threat Alert: ShinyHunters Vishing Campaigns and Domain Impersonation",
      "origin": "manual",
      "primary": true
    },
    {
      "url": "https://mind.io/blog/mckesson-breach-sensitive-unstructured-data-risk",
      "publisher": "Mind",
      "published": "2026-09-01",
      "title": "McKesson breach: the risk of sensitive unstructured data",
      "origin": "manual",
      "primary": true
    },
    {
      "url": "https://www.bleepingcomputer.com/news/security/reliaquest-confirms-failed-data-theft-attack-after-shinyhunters-breach/",
      "publisher": "BleepingComputer",
      "published": "2026-08-24",
      "title": "ReliaQuest confirms failed data-theft attack after ShinyHunters breach",
      "origin": "manual",
      "primary": true
    },
    {
      "url": "https://www.theregister.com/cyber-crime/2026/08/24/shinyhunters-and-reliaquest-trade-blows-over-claimed-breach/5291702",
      "publisher": "The Register",
      "published": "2026-08-24",
      "title": "ShinyHunters and ReliaQuest trade blows over claimed breach",
      "origin": "manual",
      "primary": true
    },
    {
      "url": "https://www.huntress.com/blog/black-hat-def-con-standouts",
      "publisher": "Huntress",
      "published": "2026-08-14",
      "title": "10 Hacker Summer Camp Standouts at Black Hat and DEF CON",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.huntress.com/blog/why-is-education-under-attack",
      "publisher": "Huntress",
      "published": "2026-08-13",
      "title": "Education Under Attack: The Pattern Behind Recent University Breaches",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.bridewell.com/insights/blogs/detail/vishing-call-to-a-shared-com-ecosystem",
      "publisher": "Bridewell",
      "published": "2026-07-29",
      "title": "From a Vishing Call to a Shared Shared Com Ecosystem Kit | BCON Collective by Bridewell",
      "origin": "manual",
      "primary": true
    }
  ],
  "techniques": [
    {
      "id": "T1016",
      "name": "System Network Configuration Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 11,
      "related": 0
    },
    {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 0
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 94,
      "related": 32
    },
    {
      "id": "T1036.005",
      "name": "Match Legitimate Resource Name or Location",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1557-recaptcha-skinned-turnstile-gate"
      ],
      "community": 21,
      "related": 40
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 12,
      "related": 10
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 94
    },
    {
      "id": "T1059.004",
      "name": "Unix Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 18,
      "related": 94
    },
    {
      "id": "T1059.007",
      "name": "JavaScript",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 29,
      "related": 94
    },
    {
      "id": "T1059.009",
      "name": "Cloud API",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 3,
      "related": 94
    },
    {
      "id": "T1069.003",
      "name": "Cloud Groups",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 3
    },
    {
      "id": "T1072",
      "name": "Software Deployment Tools",
      "tactics": [
        "execution",
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 0
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 55,
      "related": 54
    },
    {
      "id": "T1078.002",
      "name": "Domain Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 55
    },
    {
      "id": "T1078.004",
      "name": "Cloud Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 40,
      "related": 55
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 33,
      "related": 0
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 0
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 22,
      "related": 12
    },
    {
      "id": "T1090.003",
      "name": "Multi-hop Proxy",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 3,
      "related": 22
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1204-004-clickfix-run-dialog-execution"
      ],
      "community": 87,
      "related": 0
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "tactics": [
        "credential-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 25,
      "related": 4
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [
        "t1190-peoplesoft-psemhub-encoded-path-exploitation"
      ],
      "community": 147,
      "related": 0
    },
    {
      "id": "T1195.001",
      "name": "Compromise Software Dependencies and Development Tools",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 2,
      "related": 1
    },
    {
      "id": "T1203",
      "name": "Exploitation for Client Execution",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 35,
      "related": 0
    },
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 15,
      "related": 0
    },
    {
      "id": "T1213.003",
      "name": "Code Repositories",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 7
    },
    {
      "id": "T1213.006",
      "name": "Databases",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 7
    },
    {
      "id": "T1219",
      "name": "Remote Access Tools",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [
        "t1505-003-peoplesoft-psemhub-webshell-drop"
      ],
      "community": 6,
      "related": 46
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1491.001",
      "name": "Internal Defacement",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 0
    },
    {
      "id": "T1505.003",
      "name": "Web Shell",
      "tactics": [
        "persistence"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [
        "t1505-003-peoplesoft-psemhub-webshell-drop"
      ],
      "community": 34,
      "related": 1
    },
    {
      "id": "T1528",
      "name": "Steal Application Access Token",
      "tactics": [
        "credential-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 0
    },
    {
      "id": "T1530",
      "name": "Data from Cloud Storage",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1550.001",
      "name": "Application Access Token",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 4,
      "related": 4
    },
    {
      "id": "T1552.001",
      "name": "Credentials In Files",
      "tactics": [
        "credential-access"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 13
    },
    {
      "id": "T1560.002",
      "name": "Archive via Library",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 4
    },
    {
      "id": "T1566",
      "name": "Phishing",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "report"
      ],
      "structural": false,
      "own": [],
      "community": 14,
      "related": 28
    },
    {
      "id": "T1567",
      "name": "Exfiltration Over Web Service",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 12,
      "related": 16
    },
    {
      "id": "T1573.002",
      "name": "Asymmetric Cryptography",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 6
    },
    {
      "id": "T1580",
      "name": "Cloud Infrastructure Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 0
    },
    {
      "id": "T1583.001",
      "name": "Domains",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [
        "t1583-001-claims-registration-conjunction"
      ],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1583.004",
      "name": "Server",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1585.002",
      "name": "Email Accounts",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1587.004",
      "name": "Exploits",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 6
    },
    {
      "id": "T1588.002",
      "name": "Tool",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 9,
      "related": 2
    },
    {
      "id": "T1588.007",
      "name": "Artificial Intelligence",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 2
    },
    {
      "id": "T1589.001",
      "name": "Credentials",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 2
    },
    {
      "id": "T1593.003",
      "name": "Code Repositories",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 2,
      "related": 0
    },
    {
      "id": "T1595.002",
      "name": "Vulnerability Scanning",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 1,
      "related": 3
    },
    {
      "id": "T1596.003",
      "name": "Digital Certificates",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1596.005",
      "name": "Scan Databases",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1598",
      "name": "Phishing for Information",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "attck",
        "report"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 1
    },
    {
      "id": "T1598.003",
      "name": "Spearphishing Link",
      "tactics": [
        "reconnaissance"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1619",
      "name": "Cloud Storage Object Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 1,
      "related": 0
    },
    {
      "id": "T1657",
      "name": "Financial Theft",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1684",
      "name": "Social Engineering",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    }
  ],
  "cves": [
    {
      "id": "CVE-2024-34102",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.99994,
      "vendor": "Adobe",
      "product": "Commerce and Magento Open Source"
    },
    {
      "id": "CVE-2026-109618",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.99999,
      "vendor": "PHP Group",
      "product": "PHP"
    },
    {
      "id": "CVE-2026-109619",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.99999,
      "vendor": "PHP Group",
      "product": "PHP"
    },
    {
      "id": "CVE-2026-35273",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.96678,
      "vendor": "Oracle",
      "product": "PeopleSoft Enterprise PeopleTools"
    }
  ],
  "indicators": {
    "list": [
      {
        "type": "domain",
        "value": "winmanage-me.network",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "ipv4",
        "value": "104.219.234.138",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "ipv4",
        "value": "162.219.30.165",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "ipv4",
        "value": "5.199.162.157",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "sha256",
        "value": "2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "sha256",
        "value": "3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "sha256",
        "value": "419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "sha256",
        "value": "48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "sha256",
        "value": "a4e525d8825c1bac6dd934ef2c008b5fb9988289190b5b98d854799e07e207e4",
        "source": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters"
      },
      {
        "type": "sha256",
        "value": "ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07",
        "source": "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/"
      },
      {
        "type": "sha256",
        "value": "d5efdf6f35e9c6edcad5fbec707e6c88570c9d8796bf089c29303d591b94e384",
        "source": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters"
      },
      {
        "type": "sha256",
        "value": "fa210f015399de16bf7cb1e05856d179dfaabb1ecc9bb5fd277f94972a3bdc43",
        "source": "https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters"
      }
    ],
    "withheld": 2
  },
  "rules": [
    "t1059-peoplesoft-psemhub-payload-execution",
    "t1098-005-hypervisor-mfa-device-enrollment",
    "t1190-peoplesoft-psemhub-encoded-path-exploitation",
    "t1557-non-okta-host-oktaverify-svg",
    "t1505-003-peoplesoft-psemhub-webshell-drop",
    "t1583-001-claims-registration-conjunction",
    "t1557-recaptcha-skinned-turnstile-gate",
    "t1557-aitm-cross-asn-session-mfa",
    "t1557-claims-kit-single-letter-c2-xenc"
  ],
  "coverage": {
    "techniques": 55,
    "defendable": 42,
    "covered": 36,
    "uncovered": [
      "T1213.006",
      "T1530",
      "T1560.002",
      "T1573.002",
      "T1657",
      "T1684"
    ]
  }
}