Shinyhunters Ransomware

Who Shinyhunters is

ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.

Recorded activity

Disclosures attributed to Shinyhunters in this database run from October 2025 to August 2026, totalling 154 victims — 0.7% of everything tracked here. Shinyhunters has listed victims in 17 countries in this database, most often United States, followed by France and Germany. The sectors appearing most in its listings are Technology, Consumer Services, Financial Services.

How Shinyhunters is documented to operate

MITRE ATT&CK techniques attributed to Shinyhunters across its recorded activity. They describe the group overall, not any single incident.

Vulnerabilities Shinyhunters is recorded exploiting

• CVE-2025-61882 — Oracle E-Business Suite (EBS) (CRITICAL 9.8) · CISA KEV (patch due 27 Oct 2025)
• CVE-2026-20045 — Cisco Unified Communications (HIGH 8.2) · CISA KEV (patch due 11 Feb 2026)

2 of these 2 are in the CISA Known Exploited Vulnerabilities catalog, 1 of them recorded by CISA as used in ransomware campaigns. CVEs attributed to Shinyhunters in threat intelligence reporting. Patching these does not by itself rule the group out, and their presence here is not evidence of how any single organisation was reached.

Indicators of compromise

• [email protected]

Showing a sample of 1 EMAIL on file. Hashes and network indicators published for Shinyhunters. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
shinyhunters ransomware
*/

rule shinyhunters_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.shinyhunters"
        description = "Detects shinyhunters ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "shinyhunters" ascii nocase
        $name2 = "SHINYHUNTERS" ascii
        $onion  = "shinyhunters.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Shinyhunters, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.