(ZeroFOX) ShinyHunters is taking a page out of the book of Gnosticplayers, the breach data broker who in 2018-2019 pilfered billions of records from dozens of companies and sold them online. Due to the verification of the Tokopedia breach by multiple researchers and the company itself, ZeroFOX Alpha Team has HIGH confidence that these new breaches are legitimate, and will most likely be available on other breach marketplaces at lower prices in the near future. It is likely that this actor will continue to breach companies and post their content for sale. These tactics proved both successful and profitable for gnosticplayers, and it is likely they will continue to appeal to other breach brokers for these reasons. Around July 2025, ShinyHunters teamed up or merged with Subgroup: Scattered Spider. They share their Telegram channel also with Lapsus$, so they may all work together now – see the DataBreaches.net references in the Information section below.
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) suffered a cybersecurity incident, confirmed by the agency itself, and attributed to the Qilin ransomware group. While the incident didn't impact the agency's…
This week’s ThreatsDay bulletin highlights a diverse range of cyber threats, including a 296,000-device IoT botnet, social engineering attacks targeting security teams, and a growing number of credential-stealing malware…
This week’s cybersecurity news is dominated by data breaches, ransomware attacks, and widespread data exposures. ShinyHunters is targeting Logitech and Streamlabs, while RingCentral has experienced a massive 1.6 million…
The ShinyHunters group is aggressively targeting numerous companies, including Logitech and Streamlabs, using a coordinated extortion campaign. They claim to have compromised vast amounts of sensitive data – including pe…
Approximately 1.6 million RingCentral accounts have been exposed after a ShinyHunters extortion attack. Attackers gained access to sensitive data, including customer information, and are now demanding ransom for its retu…
A data breach at RingCentral has potentially exposed the personal information of 1.6 million individuals, including email addresses, names, and phone numbers. The breach was orchestrated by the ShinyHunters extortion gro…
Nearly 14,000 Trezor customers were affected by a data breach stemming from a vulnerability exploited by the ShinyHunters group within ShipMonk’s systems. The breach exposed customer data including names, addresses, emai…
UNC6671, a data extortion group linked to ShinyHunters and potentially SLH, is leveraging sophisticated vishing tactics to steal SaaS data from organizations across multiple sectors. They impersonate IT help desks, direc…
Brinks Home disclosed a data breach, with the extortion group ShinyHunters claiming to have stolen over 41GB of data from the company's Salesforce instance. The attackers have now publicly released the stolen information…
ShinyHunters, a known threat actor, has exploited vulnerabilities in Joomla extensions to compromise websites, highlighting a persistent risk for open-source CMS platforms. This incident underscores the ongoing need for…
Device code phishing, a rapidly growing threat exploiting the OAuth 2.0 device authorization grant, has evolved from a niche technique to a widespread criminal and nation-state tactic in a matter of months. Attackers are…
This week’s ‘ThreatsDay’ bulletin highlights a diverse range of security threats, including AI-powered hacking campaigns, ransomware attacks targeting Russia, and vulnerabilities in various software systems. Notably, a C…
