G1057 · ATT&CK 20.0 group
ShinyHunters
Aliases: Bling Libra, ShinyHunters, UNC6240
[ShinyHunters](https://attack.mitre.org/groups/G1057) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. [ShinyHunters](https://attack.mitre.org/groups/G1057) has been associated with the broader collective called The Community, also known as The Com whose members have also included [Scattered Spider](https://attack.mitre.org/groups/G1015) and [LAPSUS$](https://attack.mitre.org/groups/G1004). Public reporting has mentioned a variety of names for operations [ShinyHunters](https://attack.mitre.org/groups/G1057) members have reportedly conducted with members of other groups, including “Scattered Lapsus Hunters,” “Scattered Lapsus Shiny Hunters,” and “SLSH.”(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)(Citation: SOCRadar_ShinyHunters_Mar2024)(Citation: Unit42KelleyVaya_BlingLibra_Aug2024)(Citation: Intel471_SH_Aug2021)(Citation: FBI_SHLMS_May2026)(Citation: Google_SHOracle_Jun2026)(Citation: Mandiant_SHDataTheft_Jan2026)(Citation: Google Salesforce JUN 2025)
Aliases: Bling Libra, ShinyHunters, UNC6240
ATT&CK techniques
T1016T1018T1036.005T1059.007T1059.009T1069.003T1072T1078T1078.002T1078.004T1082T1083T1090.003T1105T1110T1190T1195.001T1203T1210T1213.003T1213.006T1219T1485T1491.001T1528T1530T1550.001T1552.001T1560.002T1567T1573.002T1580T1583.001T1583.004T1585.002T1587.004T1588.002T1588.007T1589.001T1593.003T1595.002T1598T1598.003T1619T1657T1684
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Tor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.007 JavaScript simulation — Exact active technique ID
- T1059.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.009 Cloud API simulation — Exact active technique ID
- T1059.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.003 Cloud Groups simulation — Exact active technique ID
- T1069.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1072 Software Deployment Tools simulation — Exact active technique ID
- T1072 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.002 Domain Accounts simulation — Exact active technique ID
- T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.003 Multi-hop Proxy simulation — Exact active technique ID
- T1090.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1195.001 Compromise Software Dependencies and Development Tools simulation — Exact active technique ID
- T1195.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1210 Exploitation of Remote Services simulation — Exact active technique ID
- T1210 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.003 Code Repositories simulation — Exact active technique ID
- T1213.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.006 Databases simulation — Exact active technique ID
- T1213.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1219 Remote Access Tools simulation — Exact active technique ID
- T1219 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1485 Data Destruction simulation — Exact active technique ID
- T1485 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1491.001 Internal Defacement simulation — Exact active technique ID
- T1491.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1528 Steal Application Access Token simulation — Exact active technique ID
- T1528 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1530 Data from Cloud Storage simulation — Exact active technique ID
- T1530 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1550.001 Application Access Token simulation — Exact active technique ID
- T1550.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.001 Credentials In Files simulation — Exact active technique ID
- T1552.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.002 Archive via Library simulation — Exact active technique ID
- T1560.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567 Exfiltration Over Web Service simulation — Exact active technique ID
- T1567 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.002 Asymmetric Cryptography simulation — Exact active technique ID
- T1573.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1580 Cloud Infrastructure Discovery simulation — Exact active technique ID
- T1580 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.004 Server simulation — Exact active technique ID
- T1583.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.002 Email Accounts simulation — Exact active technique ID
- T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.004 Exploits simulation — Exact active technique ID
- T1587.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.007 Artificial Intelligence simulation — Exact active technique ID
- T1588.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.001 Credentials simulation — Exact active technique ID
- T1589.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1593.003 Code Repositories simulation — Exact active technique ID
- T1593.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.002 Vulnerability Scanning simulation — Exact active technique ID
- T1595.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598 Phishing for Information simulation — Exact active technique ID
- T1598 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1598.003 Spearphishing Link simulation — Exact active technique ID
- T1598.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1619 Cloud Storage Object Discovery simulation — Exact active technique ID
- T1619 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1657 Financial Theft simulation — Exact active technique ID
- T1657 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684 Social Engineering simulation — Exact active technique ID
- T1684 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-nameCloud, DevSecOps, product, and control-as-code governance
Governance, Risk & Compliance (GRC) · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-nameCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-name
Vulnerability Research & Exploit Development · explicit-idMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-nameCloud, DevSecOps, product, and control-as-code governance
Governance, Risk & Compliance (GRC) · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameReadiness, mandate, governance, and communications
Digital Forensics & Incident Response (DFIR) · explicit-nameCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-name