GTG-50014
GTG-50014 is a threat actor group, tracked by Brandefense. It targets the Technology, and Defense and Aerospace sectors. It uses 4 MITRE ATT&CK techniques.
- Techniques
- 4
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About GTG-50014.
Financially motivated cluster made up of several operators, assessed as suspected ShinyHunters affiliates. One French-speaking operator ran a distributed credential harvesting pipeline across ten cloud workers that downloaded 1.8 million Android application packages and searched them for hardcoded secrets. Another affiliate breached a SaaS provider and extracted data belonging to roughly 200 downstream customer organisations; the same intrusion produced more than 2,100 Azure AD (Entra ID) token sets spanning over 40 tenants in about 34 hours. Operators used AI service keys stolen from victim environments both as loot and as attack infrastructure. Case code from Anthropic's September 2026 misuse report.
Last updated Sep 15, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.