SOCRadar_ShinyHunters_Mar2024

ShinyHunters has abused software deployment tools for lateral movement.

ShinyHunters has used valid domain accounts to gain initial access or to escalate privileges within environments.

ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments. Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.

ShinyHunters has exploited vulnerabilities in remote services for lateral movement.

ShinyHunters has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository. Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.

ShinyHunters has collected data from insecure cloud buckets.

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.

ShinyHunters has searched through target companies’ GitHub repositories for login credentials or API keys.

ShinyHunters has searched through victim companies’ GitHub repositories for vulnerabilities.

ShinyHunters has used spearphishing emails with malicious links to gain initial access and credentials.

ShinyHunters has called or sent text messages or emails to employees of victim organizations to demand payment in Bitcoin within 72 hours. Email addresses used in extortion activities include shinycorp@tuta[.]com, shinygroup@tuta[.]com, shinycorp@tutanota[.]com, and shinygroup@onionmail[.]com.