Unit42KelleyVaya_BlingLibra_Aug2024

ShinyHunters has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as `ListBuckets`, `CreateBucket` and `DeleteBucket`.

ShinyHunters has executed API calls to enumerate permissions for compromised AWS accounts.

ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments. Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.

ShinyHunters has executed the `DeleteBucket` API call to delete buckets.

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.

ShinyHunters has established multiple email accounts, such as shinycorp@tutonota[.]com, for use in extortion activities.

ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints. ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations. ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.

ShinyHunters has collected credentials containing PII, ultimately selling the information on their DLS.

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to access S3 objects.

ShinyHunters has called or sent text messages or emails to employees of victim organizations to demand payment in Bitcoin within 72 hours. Email addresses used in extortion activities include shinycorp@tuta[.]com, shinygroup@tuta[.]com, shinycorp@tutanota[.]com, and shinygroup@onionmail[.]com.