ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
shinyhunters ransomware
*/
rule shinyhunters_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.shinyhunters"
description = "Detects shinyhunters ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "shinyhunters" ascii nocase
$name2 = "SHINYHUNTERS" ascii
$onion = "shinyhunters.onion" ascii nocase
condition:
any of them
}
Hundreds of millions of records/rows of data was compromised containing very sensitive information spanning from PII to PHI. We urge you to reach out. Read our emails. We will provide a substanial discount. Failure to engage with us will result in the full publication of data taken from you and we very much intend to carry that out if you do not engage with us. This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 29 Aug 2026 | Warning: FINAL WARNING
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| McKesson Corporation | US | Healthcare | — | 28 ago 2026 |
| Elekta AB | SE | Healthcare | — | 28 ago 2026 |
| Jack Henry & Associates | US | Financial Services | — | 28 ago 2026 |
| CyrusOne, LLC. | US | Technology | — | 23 ago 2026 |
| ReliaQuest, LLC | US | Technology | — | 23 ago 2026 |
| NovoCure Limited | IL | Healthcare | — | 22 ago 2026 |
| BOK Financial | US | Financial Services | — | 22 ago 2026 |
| Cyrus****** | Technology | — | 20 ago 2026 | |
| Logitech/ Streamlabs | CH | Technology | — | 18 ago 2026 |
| Metabase | US | Technology | — | 14 ago 2026 |
| Sharecare, Inc. | US | Healthcare | — | 14 ago 2026 |
| Carhartt, Inc. | US | Retail & E-Commerce | — | 14 ago 2026 |
| Baxter International, Inc. | US | Healthcare | — | 14 ago 2026 |
| Ali** ********** | Technology | — | 9 ago 2026 | |
| Lumenis Ltd. | IL | Technology | — | 2 ago 2026 |
| Questel SAS | FR | — | 2 ago 2026 | |
| Alcon Inc. | CH | Healthcare | — | 2 ago 2026 |
| RingCentral, Inc. | US | Technology | — | 27 jul 2026 |
| Ernst & Young | US | Professional Services | — | 27 jul 2026 |
| Abbott owned Exact Sciences Corporation | US | Healthcare | — | 15 jul 2026 |
| Fluke Corporation | US | Manufacturing | — | 1 jul 2026 |
| Ingram Content Group, Inc. | US | Business Services | — | 1 jul 2026 |
| Adapt****** | Not Found | — | 24 jun 2026 | |
| icsecurity.com | US | Technology | — | 18 jun 2026 |
| Amazon owned OneMedical.com | US | Healthcare | — | 18 jun 2026 |
| NAIC.org | US | Business Services | — | 18 jun 2026 |
| Ralph Lauren | US | Consumer Services | — | 16 jun 2026 |
| icc.edu | US | Education | — | 15 jun 2026 |
| moody.edu | US | Education | — | 15 jun 2026 |
| hccs.edu | US | Education | — | 15 jun 2026 |
| kodak.com | US | Manufacturing | — | 15 jun 2026 |
| Deep Well Services | Energy | — | 15 jun 2026 | |
| Sysco Corporation | US | Agriculture and Food Production | — | 15 jun 2026 |
| coe.int | FR | Not Found | — | 14 jun 2026 |
| Madison Square Garden Sports Corp. | US | Consumer Services | — | 12 jun 2026 |
| JCPenney & several other subsdiaries under Catalyst Brands & Authentic Brands Group | US | Consumer Services | — | 12 jun 2026 |
| American Tower Corporation | US | Telecommunication | — | 12 jun 2026 |
| Zayo.com & Allstream.com | US | Telecommunication | — | 12 jun 2026 |
| Nexstar.tv | US | Technology | — | 11 jun 2026 |
| Ralph Lauren Corporation | US | Consumer Services | — | 11 jun 2026 |
| Notice | Not Found | — | 11 jun 2026 | |
| nottingham.ac.uk | GB | Education | — | 9 jun 2026 |
| DentaQuest, LLC. | US | Healthcare | — | 30 may 2026 |
| BCD Travel | NL | Business Services | — | 29 may 2026 |
| DentaQuest, LLC | US | Healthcare | — | 28 may 2026 |
| Adelante Soluciones Financieras (Addi.com) | CO | Financial Services | — | 5 may 2026 |
| Aeroméxico | MX | Transportation | — | 3 oct 2025 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 29 Aug 2026 | Warning: FINAL WARNING
This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 29 Aug 2026 | Warning: FINAL WARNING
Update 23 Aug : We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 million Salesforce records along with: Sharepoint: (369.6 GB Compressed / 645 GB Uncompressed) 288,729 Files, 60,513 Folders - More than 182,000 rows of Customer data Extracted from the "Contacts" Salesforce Object. - Over 8,300 Rows of Employee PII (Full Name, Email, Job Title, Phone Number, ect.) - Thousands of executed contracts, MSAs, NDAs, amendments, leases, and SOWs - Extensive physical key inventory logs, verification photos, and contractor Green Badge audits - Large collection of data center drawings, floor plans, electrical one-line diagrams, security system drawings, and site schematics - Full CERM (Critical Environment Reliability Management) process library - Physical and information security policy suite plus governance materials - Regional security scorecards, KPI workbooks, GAM sheets, and signed performance packages - Credential and access-control artifacts (including PasswordList.xlsx, Okta SSC Access lists, active badge reports, and multiple Data Center Access Control forms) This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 23 Aug 2026 | Warning: FINAL WARNING PAY OR LEAK
This time the post is about you , not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being provided "as is" for informational purposes only. We do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this post. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favour by us. | Updated: 23 Aug 2026
This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 22 Aug 2026 | Warning: FINAL WARNING PAY OR LEAK