Attack Chain

1. Initial Access via Credential Stuffing: ShinyHunters obtains valid credentials (often from prior breaches or infostealer data) and attempts to log into target cloud services (e.g., Snowflake, Salesforce, or other SaaS applications) that may lack robust multi-factor authentication, gaining initial unauthorized access.
2. Exploitation of Vulnerabilities: Attackers may exploit known vulnerabilities, such as CVE-2025-61882 in Oracle E-Business Suite or CVE-2026-20045 in Cisco Unified Communications, to achieve privileged access, establish persistence, or further compromise network infrastructure.
3. Lateral Movement and Credential Access: Once inside, the group leverages alternate authentication material (e.g., application access tokens) and unsecured credentials to move laterally within cloud environments or connected systems, expanding their footprint and access to sensitive data sources.
4. Data Collection from Repositories: ShinyHunters identifies and aggregates sensitive data from various information repositories, including cloud databases (e.g., Google BigQuery), cloud storage, and customer relationship management (CRM) systems (e.g., Salesforce), focusing on PII, financial information, and corporate intellectual property.
5. Data Exfiltration Over Web Service: The aggregated data is exfiltrated from the compromised environment, typically disguised as legitimate traffic over web services, to attacker-controlled infrastructure, often hosted on dark web (.onion) domains.
6. Extortion and Data Leakage: Following successful data exfiltration, the group issues a ransom demand, threatening to publicly leak the stolen data on their dark web data leak sites if the victim fails to pay by a specified deadline, as seen with icsecurity.com.

Impact

The compromise of icsecurity.com resulted in the theft of over 2.7 million records and other internal corporate data from a US-based technology company. ShinyHunters has a history of targeting 128 victims globally, primarily in the US (94 victims), across sectors including technology (22 victims), consumer services, financial services, and education. If the extortion demands are not met, the group typically publishes the stolen data on its dedicated dark web data leak sites, leading to significant reputational damage, regulatory fines, competitive disadvantage, and potential legal action from affected individuals whose PII has been exposed.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious login attempts and C2 communications.
• Implement multi-factor authentication (MFA) for all user accounts, especially for cloud services like Snowflake and Salesforce, to mitigate credential stuffing attacks.
• Patch CVE-2025-61882 on all Oracle E-Business Suite (EBS) installations immediately.
• Patch CVE-2026-20045 on all Cisco Unified Communications systems immediately.
• Enable comprehensive logging for web servers, DNS queries, and network connections to allow for detection of suspicious activity like credential stuffing and C2 communication.
• Block the C2 domains and URLs listed in the IOC table at your network perimeter, DNS resolver, and proxy servers.