Actor
ShinyHunters OAuth Abuse Targeting SaaS Applications
6 TTPsShinyHunters, and related threat actor Storm-3138, conducted campaigns between mid-2025 and mid-2026 by employing voice phishing, supply chain compromise, and misconfigured guest access to abuse trusted OAuth relationships in SaaS applications like Salesforce, leading to unauthorized access, data exfiltration, and persistence.
ShinyHunters Ransomware Group Claims icsecurity.com Victim, Exfiltrates 2.7M Records
2 rules 7 TTPs 2 CVEs 13 IOCsThe financially motivated ShinyHunters ransomware group, operating its shinysp1d3r RaaS, has claimed icsecurity.com as a new victim, compromising over 2.7 million records via credential stuffing and exploitation of cloud services like Snowflake, with the intent to extort through data leakage.
Social Engineering Attacks Targeting Enterprise SaaS Environments
2 rules 4 TTPs 1 IOCFinancially motivated threat actors are using social engineering techniques like vishing and credential harvesting to compromise enterprise SaaS environments, leading to data exfiltration and extortion.
ShinyHunters Targeting Experience Cloud
2 rules 4 TTPs 1 IOCThe ShinyHunters group is conducting a campaign targeting Adobe Experience Cloud, potentially leading to data breaches and unauthorized access to customer data.