# ShinyHunters SSO Vishing Campaign - Cloud Data Theft via Social Engineering

> ShinyHunters (UNC6040/UNC6395/UNC6240) is a prolific English-speaking cybercriminal group operating as part of the 'Scattered LAPSUS$ Hunters' (SLSH) — an amalgamation of ShinyHunters, Scattered Spider, and LAPSUS$. In May 2025, SLSH launched a massive voice phishing (vishing) campaign targeting SSO/MFA to trick victims into connecting malicious apps to their Salesforce portals, siphoning over ONE BILLION records from Salesforce customers. The group operates an extortion website threatening to publish stolen data from 36+ Fortune 500 companies including Toyota, FedEx, Disney/Hulu, and UPS unless ransoms are paid. SLSH also breached Salesloft (AI chatbot maker) stealing authentication tokens for hundreds of cloud services (Snowflake, AWS, Azure, Slack, Google Workspace, OpenAI), breached Red Hat's GitLab server (28,000+ repositories with client secrets), breached Discord user data, and disclosed a zero-day in Oracle E-Business Suite (CVE-2025-61882, pre-auth RCE exploited by Clop). The group launched its own ransomware-as-a-service (ShinySp1d3r, derived from Hellcat ransomware modified with AI) and actively recruits corporate insiders via Telegram. Key operator 'Rey' identified as Saif Al-Din Khader, 15-year-old in Amman, Jordan — previously admin of BreachForums and Hellcat ransomware. Multiple SLSH members arrested: Noah Michael Urban (20, Florida) sentenced 10 years; Thalha Jubair (19, UK) charged for MGM/Caesars/M&S attacks; Tyler Robert Buchanan (23, Scotland) extradited controlling $26M stolen. Law enforcement seized BreachForums domains (FBI, Oct 2025). The group epitomizes 'Advanced Persistent Teenagers' — young, English-speaking cybercriminals causing billions in damage via social engineering, not technical exploitation. Absorbs TL-2026-0030, TL-2026-0045, TL-2026-0054.

- **Published:** 2026-02-02T19:04:00Z
- **Last reviewed:** 2026-02-02T19:04:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0013
- **ID:** TL-2026-0013
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 23 · **IOCs:** 108 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-61882

## Description

ShinyHunters and the Scattered LAPSUS$ Hunters represent the evolution of cybercrime from technical exploitation to SOCIAL ENGINEERING AT SCALE. This is not a sophisticated APT using zero-days — it's teenagers using phone calls, vishing, SIM swapping, and insider recruitment to breach the world's largest corporations.

**The Group — Scattered LAPSUS$ Hunters (SLSH):**

SLSH is an amalgamation of three cybercriminal groups operating from 'the Com' — a mostly English-language cybercriminal community spanning Telegram and Discord servers:

1. **ShinyHunters** (Google: UNC6040) — Data theft and extortion specialists. Responsible for the Salesforce vishing campaign, BreachForums administration, and mass data breaches since 2020.
2. **Scattered Spider** (Google: UNC3944, Microsoft: Octo Tempest) — Social engineering experts targeting corporate helpdesks. Known for MGM Resorts, Caesars Entertainment, and dozens of other breaches via SIM swapping and MFA fatigue.
3. **LAPSUS$** — The original 'Advanced Persistent Teenagers' group that breached Microsoft, Nvidia, Samsung, Uber, and Okta in 2021-2022.

Members overlap significantly and operate across shared Telegram/Discord channels on the Com.

**The Salesforce Vishing Campaign (May 2025):**

The flagship SLSH operation of 2025:
- Voice phishing (vishing) calls to employees at target companies
- Social engineering targets into connecting malicious OAuth apps to their organization's Salesforce portal
- Siphoned over 1 BILLION records from Salesforce customer instances
- Google Threat Intelligence Group (GTIG) warned in June 2025
- Google itself was impacted — their own corporate Salesforce instance was compromised
- 36+ Fortune 500 companies had data stolen: Toyota, FedEx, Disney/Hulu, UPS, and more
- Data leak website launched October 2025: 'Scattered LAPSUS$ Hunters' blog threatening publication
- Group demanded Salesforce pay a single ransom to protect ALL customers: 'If we come to a resolution all individual extortions against your customers will be withdrawn'
- Salesforce refused: 'Salesforce will not engage, negotiate with, or pay any extortion demand'

**The Salesloft Breach (August 2025):**

A separate but connected SLSH operation (tracked as UNC6395):
- Compromised Salesloft, an AI chatbot maker used by many corporations to convert customer interactions into Salesforce leads
- Stole authentication tokens for hundreds of cloud services integrated with Salesloft
- Affected services: Snowflake, Amazon AWS, Microsoft Azure, Slack, Google Workspace, Docker, OpenAI
- Google warned the breach 'goes far beyond Salesforce data'
- Hundreds more organizations affected beyond the initial Salesforce campaign

**Red Hat GitLab Breach (September 2025):**

- Compromised Red Hat's consulting GitLab server
- Stole 28,000+ Git code repositories
- 5,000+ Customer Engagement Reports (CERs) containing client secrets
- Exposed: Artifactory tokens, Git tokens, Azure credentials, Docker credentials, client infrastructure details, audit reports
- Red Hat disclosed October 2, 2025

**Discord Breach (September 2025):**

- Compromised third-party customer service provider used by Discord
- Stole usernames, emails, IP addresses, last 4 digits of payment cards, government ID images from age verification
- Discord began notifying affected users

**Oracle Zero-Day (CVE-2025-61882):**

- SLSH's extortion blog disclosed a critical zero-day in Oracle E-Business Suite
- Unauthenticated remote code execution
- Initially exploited in August 2025 by Clop ransomware
- Oracle issued emergency patch
- SLSH published exploitation scripts on their blog before it was taken down

**ShinySp1d3r Ransomware-as-a-Service:**

- SLSH launched its own RaaS in November 2025
- Derived from Hellcat ransomware source code, modified with AI tools
- Released by Rey (Saif Al-Din Khader)
- Previously used other groups' encryptors: ALPHV/BlackCat, Qilin, RansomHub, DragonForce

**Corporate Insider Recruitment:**

- SLSH actively recruits insiders via Telegram: employees at large companies who share internal access for a share of ransom payment
- CrowdStrike fired an employee for allegedly sharing screenshots of internal systems with the group
- Insider recruitment = bypassing ALL technical security controls

**Key Operator — Rey / Saif Al-Din Khader:**

- Real name: Saif Al-Din Khader, 15 years old, Amman, Jordan
- Admin of SLSH Telegram channel, BreachForums, and Hellcat ransomware site
- Previously operated as 'Hikki-Chan' and 'o5tdev' on cybercrime forums
- Part of Cyb3r Drag0nz Team (pro-Palestinian hacktivist group)
- Identified via infostealer data from his own infected family PC
- Father is Royal Jordanian Airlines pilot; Irish heritage (mother's maiden name Ginty)
- Claimed to be cooperating with European law enforcement since June 2025

**Law Enforcement Actions:**

- Noah Michael Urban, 20, Florida — sentenced 10 years, $13M restitution (Aug 2025)
- Thalha Jubair, 19, UK — charged for MGM/Caesars/M&S/Harrods/Co-op attacks, LAPSUS$ member
- Tyler Robert Buchanan, 23, Scotland — extradited from Spain, controlled $26M stolen
- BreachForums domains seized by FBI (October 5, 2025)
- Operation Endgame targeting cybercrime services

**Absorbs Duplicates:**
- TL-2026-0030: ShinyHunters data breach operations
- TL-2026-0045: Scattered Spider social engineering TTPs
- TL-2026-0054: LAPSUS$/vishing campaign analysis

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1594 Search Victim-Owned Websites
- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1596 Search Open Technical Databases
- T1597 Search Closed Sources
- T1566 Phishing
- T1598 Phishing for Information
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1684.001 Impersonation
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1556 Modify Authentication Process
- T1219 Remote Access Tools
- T1484 Domain or Tenant Policy Modification
- T1685 Disable or Modify Tools
- T1550 Use Alternate Authentication Material
- T1606 Forge Web Credentials
- T1621 Multi-Factor Authentication Request Generation
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1580 Cloud Infrastructure Discovery
- T1538 Cloud Service Dashboard
- T1087 Account Discovery
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1056 Input Capture
- T1114 Email Collection
- T1119 Automated Collection
- T1074 Data Staged
- T1082 System Information Discovery
- T1588 Obtain Capabilities
- T1557 Adversary-in-the-Middle

## Sources

- [KrebsOnSecurity — ShinyHunters Corporate Extortion Spree](https://krebsonsecurity.com/2025/10/shinyhunters-wage-broad-corporate-extortion-spree/)
- [KrebsOnSecurity — Meet Rey (SLSH Admin)](https://krebsonsecurity.com/2025/11/meet-rey-the-admin-of-scattered-lapsus-hunters/)
- [KrebsOnSecurity — Salesloft Breach Fallout](https://krebsonsecurity.com/2025/09/the-ongoing-fallout-from-a-breach-at-ai-chatbot-maker-salesloft/)
- [Google TIG — Voice Phishing Campaign](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
- [Oracle Alert — CVE-2025-61882](https://www.oracle.com/security-alerts/alert-cve-2025-61882.html)
- [Red Hat — GitLab Incident Disclosure](https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance)
- [KELA — Hellcat Group Unmasked](https://www.kelacyber.com/blog/hellcat-hacking-group-unmasked-rey-and-pryx/)
- [KrebsOnSecurity — $115M Scattered Spider Charges](https://krebsonsecurity.com/2025/09/feds-tie-scattered-spider-duo-to-115m-in-ransoms/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0013