Shinyhunters
Shinyhunters is a ransomware group with a financial motive, tracked by Brandefense. It targets 14 sectors, including Government and Technology, in 16 countries, including the United States and the United Kingdom. It uses 150 MITRE ATT&CK techniques and exploits 19 known CVEs.
- shinyhunters Team
- UNC6240
- Bling Libra
- UNC6661
- ScatteredLAPSUSHunters
- Techniques
- 150
- Exploited CVEs
- 19
- First seen
- Oct 3, 2025
- Last seen
- Sep 7, 2026
- Record updated
Who They Target.
About Shinyhunters.
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
Last updated Sep 29, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.