Intel471_SH_Aug2021

ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments. Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.

ShinyHunters has exploited vulnerabilities in the target company’s GitHub repository source code to enable more complex follow-on third-party or supply chain attacks.

ShinyHunters has gathered information from and has searched for vulnerabilities in the target company’s GitHub repository source code.

ShinyHunters has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository. Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.

ShinyHunters has used stolen OAuth keys to access cloud infrastructure and to bypass two-factor authentication.

ShinyHunters has gathered PII from database infrastructure.

ShinyHunters has collected credentials containing PII, ultimately selling the information on their DLS.

ShinyHunters has sent phishing emails to Microsoft Office 365 corporate users in order to steal credentials.

ShinyHunters has called or sent text messages or emails to employees of victim organizations to demand payment in Bitcoin within 72 hours. Email addresses used in extortion activities include shinycorp@tuta[.]com, shinygroup@tuta[.]com, shinycorp@tutanota[.]com, and shinygroup@onionmail[.]com.