ShinyHunters
Also known as Shinyhunters, UNC6240, Bling Libra, Scattered Lapsus$ Hunters, Rey, Saif al-Din Khader, Umbreon, ScatteredLapsussHunters, SLSH, UNC6040, UNC6395, GRUB1
Reports
168
First seen
Oct 15, 2025
Last seen
Oct 13, 2026
Motivation
Financial, Notoriety, Geopolitical
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
×1×96
United States×96
United Kingdom×4
Netherlands×2
European Union×2
Ukraine×2
Australia×1
France×1
Sweden×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1190 Exploit Public-Facing Application ×68T1005 Data from Local System ×63T1566 Phishing ×46T1041 Exfiltration Over C2 Channel ×44T1078 Valid Accounts ×42T1486 Data Encrypted for Impact ×30T1567 Exfiltration Over Web Service ×24T1110 Brute Force ×22T1195 Supply Chain Compromise ×18T1087 Account Discovery ×13T1598 Phishing for Information ×13T1555 Credentials from Password Stores ×11
Indicators
cve ×450domain ×164ip_v4 ×99hash_sha256 ×41hash_md5 ×35filename ×19hash_sha1 ×7url ×2bitcoin_address ×1email ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2026-35273 (exploited)CVE-2026-82078 (exploited)CVE-2025-61882 (exploited)CVE-2026-0300 (exploited)CVE-2026-81578 (exploited)CVE-2026-50751 (exploited)CVE-2026-42608 (exploited)CVE-2026-60004 (exploited)CVE-2026-34909 (exploited)CVE-2026-34908 (exploited)CVE-2026-35616 (exploited)CVE-2026-41091 (exploited)CVE-2026-42897 (exploited)CVE-2026-46817 (exploited)CVE-2026-34910 (exploited)CVE-2026-20230 (exploited)CVE-2021-44228 (exploited)CVE-2026-28318 (exploited)CVE-2026-33824 (exploited)CVE-2026-11645 (exploited)
Recent reports
Critical