Threat Group Profile
shinyhunters
● Active — last 30 days
Victim claims
52
First seen
Nov 2023
Last activity
01 Jul 2026
Tracked since
Oct 2025
Group overview
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Preferred targets
Education · 10
Business Services · 9
Consumer Services · 7
Financial Services · 6
Technology · 4
Healthcare · 4
Most targeted countries
US · 41
FR · 1
GB · 1
NL · 1
CO · 1
SG · 1
Tactics & techniques (MITRE ATT&CK)
Initial Access
Unsecured Credentials: Private Keys
Phishing: Spearphishing Voice (Vishing)
Defense Evasion
Use Alternate Authentication Material: Application Access Token
Collection
Data from Information Repositories
Exfiltration
Exfiltration Over Web Service
Impact
Data Encrypted for Impact
Reconnaissance
Phishing for Information: Spearphishing Attachment
