/// ACCESS GRANTED /// ShinyHunters TTP

/// CORE METADATA

PRIMARY ROLE: Mass Data Broker and Extortion Group

STATUS: ACTIVE / HIGH THREAT

MOTIVATION: Financial

TARGETS: Cloud Platforms (Snowflake, Salesforce), E-commerce, Tech

USERNAMES: ShinyHunters, Scattered Lapsus$ Hunters

/// DATASET: MOST POPULAR BREACHES & SALES LOG (3 records)

[Salesforce Customers (39+ orgs)] Late 2025 | Data: Massive data theft (1.5 billion records claimed) via malicious OAuth app connections.. Context: Used Vishing (voice phishing) social engineering attack..

[AT&T (Snowflake)] April 2024 | Data: 109 million customer phone records and PII (2022 data).. Context: Breach occurred via compromised credential access to AT&T’s Snowflake environment..

[Oracle Cloud] 2025 | Data: 6 million records compromised (claimed).. Context: Indicates continued focus on cloud exploitation..

/// TTP MAPPING: MITRE ATT&CK FRAMEWORK

Tactic	MITRE ID	Technique Description	Defense Focus
[Initial Access]	T1078.003	Valid Accounts: Purchased or brute-forced credentials used to log into cloud data warehouse instances (Snowflake).	MFA on Cloud Dashboards, IP Whitelisting
[Exfiltration]	T1537	Transfer Data to Cloud: Used standard cloud APIs (like AWS CLI) to download massive databases from misconfigured or compromised cloud storage.	CSPM, Egress Traffic Monitoring of Cloud APIs
[Initial Access]	T1566.002	Spearphishing Link (Vishing): Uses voice phishing to trick employees into granting malicious OAuth app access (Salesforce).	Social Engineering Training, Strict Third-Party OAuth Access Controls

/// WEAPONIZATION: KEY TOOLS & ARTIFACTS

OAuth Apps [Initial Access/Persistence (Malicious)] AWS CLI [Cloud Data Download] Custom Extortion Site [Communication/Extortion Platform]