Threat Intelligence / Actor / ShinyHunters

ShinyHunters

Nation: France · 3 tracked threat(s) · Categories: DATA_BREACH, THREAT_INTEL, CAMPAIGN

Also known as: Sp1d3rHunters, Scattered LAPSUS$ Hunters, ShinyCorp, Hollywood Hunters, UNC6040, UNC6395, UNC6240, UNC6661, UNC6671, Scattered Spider, LAPSUS$, SLSH

Tracked threats

ShinyHunters Mass Defacement of Canvas LMS — Instructure Re-Breach Extortion Campaign Affecting ~330 Educational Institutions (May 2026) — HIGH
ShinyHunters Extortion Campaign - Evolved Vishing and SSO Credential Theft — HIGH
ShinyHunters SSO Vishing Campaign - Cloud Data Theft via Social Engineering — CRITICAL

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence