Ransomware Intelligence / Groups / shinyhunters
Ransomware group
shinyhunters
ShinyHunters is a financially motivated data-theft and extortion group active since 2020, responsible for high-profile breaches including Ticketmaster (via Snowflake) and PowerSchool; by 2025 they launched a RaaS offering called "shinysp1d3r," and in August 2025 French authorities arrested four members.
- 0claims, 7 days
- 0claims, 30 days
- 40claims, 90 days
- 2026-04-01first seen
- 2026-10-02last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
In the news
Recent stories in the security press that name shinyhunters, newest first.
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
- Smashing Security podcast #488: How a ransomware negotiator ended up arrested at his own conference
- Net Closes Around ShinyHunters with Another FBI Arrest
- Canadian cybersecurity executive arrested in federal extortion case
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Sectors claimed, last 90 days
- Healthcare 14
- Unclassified 10
- Technology 7
- Manufacturing 5
- Critical infrastructure 1
- Financial services 1
- Government 1
- Retail 1
Countries claimed, last 90 days
- United States 23
- Unknown 9
- Switzerland 3
- Israel 2
- Germany 1
- France 1
- Sweden 1
Vulnerabilities shinyhunters exploits
CVEs attributed to shinyhunters by Ransomware.live, most severe first. Patch these first if this group is in your threat model.
| CVE | Vendor / product | CVSS | CISA KEV |
|---|---|---|---|
| CVE-2026-35273 | Oracle Oracle PeopleSoft (PeopleTools) | 9.8 Critical | Listed 2026-06-12, ransomware use |
| CVE-2025-61882 | Oracle Oracle E-Business Suite (EBS) | 9.8 Critical | Listed 2025-10-06, ransomware use |
| CVE-2026-20045 | Cisco Cisco Unified Communications | 8.2 High | Listed 2026-01-21 |
70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →
Newest vulnerabilities used by any ransomware group (CISA KEV)
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Tactics and techniques
MITRE ATT&CK techniques reported for shinyhunters by Ransomware.live, in attack order.
- Reconnaissance
- Initial Access
- Defense Evasion
- Collection
- Exfiltration
- Impact
Track shinyhunters in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 14 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology