shinyhunters
Activity analysis
HackerFeeds has tracked 163 victims claimed by shinyhunters since April 2024, most recently in September 2026 — ranking #48 of 332 groups (0.5% of all tracked ransomware victims). It posted 25 victims in the last 90 days, down 29% on the previous 90 days (35). Its most-targeted sector is Technology (30 victims), followed by Consumer Services (26). The United States accounts for 112 victims (76% of those with a known location); 15 victims did not disclose a location.
Victims per year
- 20246
- 202545
- 2026112
Top sectors
- Technology30
- Consumer Services26
- Financial Services22
- Education15
- Healthcare13
- Business Services12
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
MITRE ATT&CK TTPs
Initial Access
Defense Evasion
T1550.001Use Alternate Authentication Material: Application Access Token
Use of malicious "Connected" OAuth applications to maintain persistent access to Salesforce and Microsoft 365 environments without needing passwords.
Collection
T1213Data from Information Repositories
Frequent targets include Confluence, Jira, and SharePoint to collect internal documentation and plaintext credentials.
Exfiltration
T1567Exfiltration Over Web Service
Use of legitimate cloud tools and native APIs to "drain" data from CRMs (Salesforce) directly to C2 servers.
Impact
T1486Data Encrypted for Impact
Reconnaissance
T1598.002Phishing for Information: Spearphishing Attachment
Recent victims
No victims tracked yet.