ShinyHunters

Tactics, Techniques & Procedures (TTPs)

• Vishing: phone-based social engineering to compromise identity provider accounts (Microsoft Entra, Okta)
• Snowflake customer credential stuffing — exploiting accounts lacking MFA on cloud data warehouse instances
• Large-scale database exfiltration from SaaS environments integrated with compromised identity providers
• Single-extortion model: data publication threat without ransomware encryption
• Underground forum data sales (BreachForums, Telegram channels)
• Simultaneous targeting of multiple organisations sharing common infrastructure (Snowflake campaign, 165+ victims)

Known Targets

Analyst Notes

ShinyHunters rose to prominence through an unprecedented sequence of large-scale data breaches in 2020–2024, primarily targeting cloud-hosted data. The defining campaign was the 2024 Snowflake credential operation: by obtaining login credentials from infostealer logs and applying them against Snowflake instances without MFA enforcement, the group breached over 165 organisations simultaneously — including Ticketmaster (560M records) and Santander (30M records). Sébastien Raoult (French national) was sentenced to three years in US federal prison in May 2024; other members remain at large. The 2026 Charter Communications vishing breach demonstrates continued operational adaptation — shifting from cloud credential stuffing to identity-platform social engineering as MFA adoption increases. Consistent follow-through on publication threats means extortion demands carry credible deterrent weight.

Also Known As

MITRE ATT&CK Techniques