ShinyHunters

Active

3 briefings · first covered 4/29/2026 · last covered 6/28/2026

Exploitable Vulnerabilities, Prioritized

Sorted by CISA KEV status and EPSS exploit probability, same signals as the dashboard.

CVE-2026-35273OracleCriticalCISA KEV · due 2026-06-15EPSS 92.3%

Indicators of Compromise

Artifact	Type
azurenetfiles.net	C2 domain (impersonates Azure NetApp Files, WSS port 443)
142.11.200.186/29	Staging IP range (MeshCentral management server)
176.120.22.24	Data exfiltration destination (DLS mirror, SSH)
meshagent64-azure-ops.exe	MeshCentral agent: Windows x64 (signed, Azure-branded)
meshagent64-v2.exe	MeshCentral agent: Windows x64 variant
meshagent32-azure-ops.exe	MeshCentral agent: Windows x86
meshagent (Linux)	MeshCentral agent: Linux (PeopleSoft app tier)
README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT	Defacement and extortion marker in WebLogic/Process Scheduler dirs
<companyname>sso[.]com / my<companyname>sso[.]com	Domain pattern
<companyname>okta[.]com / <companyname>internal[.]com	Domain pattern
ToogleBox Recall (Google Workspace OAuth)	Application indicator
24.242.93[.]122	IP
149.50.97[.]144	IP
142.127.171[.]133	IP
23.234.100[.]107	IP
ToogleBox Recall OAuth authorization in Google Workspace logs	Application indicator
191.96.207.179	IP Address
196.251.83.162	IP Address
163.5.210.210	IP Address
94.156.167.237	IP Address
bless-invite.com	Phishing Domain
get-carrot-zoom.com	Phishing Domain
modernatx-zoom.com	Phishing Domain
recurly-zoom.com	Phishing Domain
Bulk Salesforce API calls from single session, /s/sfsites/aura endpoint	Cloud Behavior
Okta new MFA enrollment outside business hours	Identity Behavior

Subscribe to unlock this actor's full IOC list

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Attribution & Known Techniques

Matched to shinyhunters in MISP's open threat-intelligence galaxy (ransomware cluster).

No technique-level data in the matched source for this actor.

Coverage Timeline

6/28/2026 · KNOW YOUR ENEMY

ShinyHunters Breaches 100 Organizations Using Oracle PeopleSoft Zero-Day

ShinyHunters exploited a CVSS 9.8 Oracle PeopleSoft zero-day to compromise 100+ organizations before Oracle knew the flaw existed.

5/27/2026 · ACTIVE CAMPAIGN

ShinyHunters Vishing: 40 Million Records Stolen From Charter and 400 Organizations

ShinyHunters vishing SaaS extortion campaign confirmed Charter breach: 40M records stolen. Get TTPs, IOCs, and defensive steps now.

4/29/2026 · ACTIVE CAMPAIGN

ShinyHunters Hit Medtronic and ADT: 14.5M Records Stolen via AI Vishing and Salesforce

ShinyHunters stole 14.5M records from Medtronic and ADT this week using AI vishing to bypass MFA then pivoting through Salesforce. Here's how to protect your org now.

Not yet tracked for this actor

CrowdStrike Falcon / SentinelOne Deep Visibility-specific query syntax — hunting queries above (if any) are Microsoft Defender/Sentinel KQL
File transfer and exfiltration services used
Hunting queries — no FalconFriday rule matched this actor's known techniques