ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Tácticas y técnicas observadas del actor, mapeadas a MITRE ATT&CK (clic para ver la ficha oficial). Útil para priorizar detecciones.
Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
shinyhunters ransomware
*/
rule shinyhunters_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.shinyhunters"
description = "Detects shinyhunters ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "shinyhunters" ascii nocase
$name2 = "SHINYHUNTERS" ascii
$onion = "shinyhunters.onion" ascii nocase
condition:
any of them
}
Good afternoon, We have no further comments to make regarding our PSA statement we released the other day. Our organisation is highly confident we have achieved our goal and our intentions we repeatedly made clear to journalists and in our public statements. There is 5 days remaining still. We have no comment yet regarding what we will do if the victim entity does not comply with our kind request . Nonetheless, we got what we wanted and we have a business to run and operate as usual. We will not be responding to any press inquiries about this and we will not be sharing updates about other datasets we have that we did not yet disclose to the public. We reiterate and want to assiduously emphasise we are NOT extorting the victim in question, this is NOT financially motivated and this is NOT a ransom. Thank you for your time and attention to this matter. This is now old news. Regards, SH | Updated: 24 Sep 2026
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| Final statement re PSA | Not Found | — | 24 sept 2026 | |
| Fresenius Medical Care | DE | Healthcare | — | 22 sept 2026 |
| PSA - READ THIS NOW | Not Found | — | 22 sept 2026 | |
| Note to Cl0p-_- | Not Found | — | 20 sept 2026 | |
| Qi**** | Not Found | — | 17 sept 2026 | |
| Kimberly-Clark | US | Manufacturing | — | 13 sept 2026 |
| State of Florida DMV | US | Government & Defense | — | 7 sept 2026 |
| Medela.com | CH | Healthcare | — | 7 sept 2026 |
| Neogen Corporation | US | Agriculture and Food Production | — | 29 ago 2026 |
| McKesson Corporation | US | Healthcare | — | 28 ago 2026 |
| Elekta AB | SE | Healthcare | — | 28 ago 2026 |
| Jack Henry & Associates | US | Financial Services | — | 28 ago 2026 |
| CyrusOne, LLC. | US | Technology | — | 23 ago 2026 |
| ReliaQuest, LLC | US | Technology | — | 23 ago 2026 |
| NovoCure Limited | IL | Healthcare | — | 22 ago 2026 |
| BOK Financial | US | Financial Services | — | 22 ago 2026 |
| Cyrus****** | Technology | — | 20 ago 2026 | |
| Logitech/ Streamlabs | CH | Technology | — | 18 ago 2026 |
| Metabase | US | Technology | — | 14 ago 2026 |
| Sharecare, Inc. | US | Healthcare | — | 14 ago 2026 |
| Carhartt, Inc. | US | Retail & E-Commerce | — | 14 ago 2026 |
| Baxter International, Inc. | US | Healthcare | — | 14 ago 2026 |
| Ali** ********** | Technology | — | 9 ago 2026 | |
| Lumenis Ltd. | IL | Technology | — | 2 ago 2026 |
| Questel SAS | FR | — | 2 ago 2026 | |
| Alcon Inc. | CH | Healthcare | — | 2 ago 2026 |
| RingCentral, Inc. | US | Technology | — | 27 jul 2026 |
| Ernst & Young | US | Professional Services | — | 27 jul 2026 |
| Abbott owned Exact Sciences Corporation | US | Healthcare | — | 15 jul 2026 |
| Fluke Corporation | US | Manufacturing | — | 1 jul 2026 |
| Ingram Content Group, Inc. | US | Business Services | — | 1 jul 2026 |
| Adapt****** | Not Found | — | 24 jun 2026 | |
| icsecurity.com | US | Technology | — | 18 jun 2026 |
| Amazon owned OneMedical.com | US | Healthcare | — | 18 jun 2026 |
| NAIC.org | US | Business Services | — | 18 jun 2026 |
| Ralph Lauren | US | Consumer Services | — | 16 jun 2026 |
| icc.edu | US | Education | — | 15 jun 2026 |
| moody.edu | US | Education | — | 15 jun 2026 |
| hccs.edu | US | Education | — | 15 jun 2026 |
| kodak.com | US | Manufacturing | — | 15 jun 2026 |
| Deep Well Services | Energy | — | 15 jun 2026 | |
| Sysco Corporation | US | Agriculture and Food Production | — | 15 jun 2026 |
| coe.int | FR | Not Found | — | 14 jun 2026 |
| Madison Square Garden Sports Corp. | US | Consumer Services | — | 12 jun 2026 |
| JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group | US | Consumer Services | — | 12 jun 2026 |
| American Tower Corporation | US | Telecommunication | — | 12 jun 2026 |
| Zayo.com & Allstream.com | US | Telecommunication | — | 12 jun 2026 |
| Nexstar.tv | US | Technology | — | 11 jun 2026 |
| Ralph Lauren Corporation | US | Consumer Services | — | 11 jun 2026 |
| Notice | Not Found | — | 11 jun 2026 | |
| nottingham.ac.uk | GB | Education | — | 9 jun 2026 |
| DentaQuest, LLC. | US | Healthcare | — | 30 may 2026 |
| BCD Travel | NL | Business Services | — | 29 may 2026 |
| DentaQuest, LLC | US | Healthcare | — | 28 may 2026 |
| Adelante Soluciones Financieras (Addi.com) | CO | Financial Services | — | 5 may 2026 |
| Aeroméxico | MX | Transportation | — | 3 oct 2025 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
You have exactly two days to contact us to prevent publication of all your data containing sensitive information. Deadline: Sep 25, 2026 | Updated: 23 Sep 2026
Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI, During Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended. We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to "disrupt" our operations, an effort that ultimately proved unsuccessful. For us to properly address and correct these unfounded allegations, we were compelled to adopt a forceful and assertive posture to ensure our response was fully acknowledged. This PSA today does just that. Our PSA today works to address these allegations and correct them. We have compromised the FBI. We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job. Whether it be a Special Agent or any other role within your agency. The following FBI services were compromised: Criminal Justice (CJ), HR, Medlink, and more. We are willing to allow you a time of 1 week to correct or simply REMOVE the 2026 Quarter 2 FLASH report on us that includes several FALSE allegations: - "Threat actors often use their real or exaggerated claims of access to sensitive or personal information to prompt payment from victims. " - "To exert pressure on victims[1], SH actors commonly use harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting" - " Threat actors may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist." We wish to state unequivocally our threats and claims are very real. Not exaggerated and never a bluff. This PSA today is living evidence of that. We wish to state unequivocally we have NEVER conducted swatting attacks against corporate victims personnel nor have we ever texted victims personnel family members any threats. We wish to state unequivocally we have NEVER claimed to have sensitive or compromising information, including embarrassing photographs and videos of victims. WE ARE NOT SEXTORTIONISTS . Finally, we wish to STATE UNEQUIVOCALLY we are NOT apart of "The Com". We have NEVER been apart of "The Com". "The Com" is a propaganda started by the Information Security Industry which has brainwashed past FBI and DOJ officials into formalising this nonsense. As a big believer and supporter of the U.S. Constitution - we are exercising the First Amendment and actively combating disinformation. This is not a ransom, coercion, or extortion. Your federal policies do not apply here. This PSA is NOT financially motivated. We recognise that certain statements within your FLASH report appear to stem from biased public reporting by certain journalists who have previously and intentionally propagated false narratives about our organisation in an attempt to "disrupt" our operations and hinder clients trust in our organisation hoping nobody pays us. Should those certain journalists and you know very well who you are, continue these unwarranted attacks and defamatory statements, we will be forced to respond in a civil manner with a commensurate and forceful defence of our reputation. As any human being would do. We welcome any and all journalists to inquire us at shinygroup@onionmail.com to hear our side of the story. Make the right decision, don't be the next headline. Thank you for your attention to this matter. -SH | Updated: 23 Sep 2026
IF YOU WANT TO SAVE YOUR BRAND AND NOT DIE BY MY HANDS: Email us from your official email at shinygroup@onionmail.com and lets see how rich you really are. 2.333% of my networth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron. Kindly excuse our unprofessionalism. | Updated: 19 Sep 2026
Processing publication of this company unless they start negotiating appropriately. Deadline: 18 Sep 2026 | Updated: 17 Sep 2026 | Warning: FINAL WARNING
This is a final warning to reach out by 16 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 13 Sep 2026 | Warning: FINAL WARNING