shinyhunters

Tactics and techniques attributed to SHINYHUNTERS by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

• TA0001Initial Access
  • T1552.004Unsecured Credentials: Private Keys

    Scanning GitHub/Bitbucket repositories for exposed API keys and OAuth tokens (Secret Hunting).

  • T1566.003Phishing: Spearphishing Voice (Vishing)

    Voice calls to helpdesk pretending to be employees to obtain password reset or MFA bypass.

• TA0005Defense Evasion
  • T1550.001Use Alternate Authentication Material: Application Access Token

    Use of malicious "Connected" OAuth applications to maintain persistent access to Salesforce and Microsoft 365 environments without needing passwords.

• TA0009Collection
  • T1213Data from Information Repositories

    Frequent targets include Confluence, Jira, and SharePoint to collect internal documentation and plaintext credentials.

• TA0010Exfiltration
  • T1567Exfiltration Over Web Service

    Use of legitimate cloud tools and native APIs to "drain" data from CRMs (Salesforce) directly to C2 servers.

• TA0040Impact
  • T1486Data Encrypted for Impact
• TA0043Reconnaissance
  • T1598.002Phishing for Information: Spearphishing Attachment