# ShinyHunters Extortion Campaign - Evolved Vishing and SSO Credential Theft

> ShinyHunters has evolved from a dark web data broker into one of the most impactful financially-motivated threat groups of 2024-2026, orchestrating the Snowflake customer data theft campaign (UNC5537) that compromised 165+ organizations including AT&T (110M records), Ticketmaster/Live Nation (560M records), and Santander Bank (30M records). The group's operational evolution traces four distinct phases: data breach marketplace operator (2020-2022) → phishing kit adoption (2022-2023) → vishing-based help desk social engineering (2023-2024) → infostealer credential harvesting at industrial scale for SaaS platform targeting (2024-2026). The Snowflake campaign demonstrated a paradigm shift: rather than exploiting vulnerabilities, UNC5537 systematically compromised customer instances using stolen credentials from infostealer malware (VIDAR, RISEPRO, REDLINE, RACCOON STEALER, LUMMA, METASTEALER) — some dating to 2020 — against accounts lacking MFA. The group developed a custom reconnaissance tool (FROSTBITE) and used DBeaver Ultimate for SQL-based data staging and exfiltration via Snowflake's native COPY INTO → GET pipeline. SIM-swapping serves as a secondary identity theft vector for MFA bypass when accounts do have MFA enabled. ShinyHunters monetizes through dual extortion: selling stolen data on BreachForums while simultaneously extorting victims directly. The Snowflake campaign is the largest single-platform credential-based breach campaign in history, exposing the catastrophic risk of credential reuse, absent MFA, and the robust infostealer marketplace ecosystem.

- **Published:** 2026-02-02T23:38:00Z
- **Last reviewed:** 2026-02-02T23:38:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0030
- **ID:** TL-2026-0030
- **Severity:** HIGH (CVSS 8.2)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** ShinyHunters (France)
- **Detections:** 13 · **IOCs:** 63 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ShinyHunters emerged circa 2020 as a prolific data breach operator, initially stealing and selling databases from GitHub private repos, Tokopedia (91M records), Mashable, Bonobos, Pixlr, Wattpad (270M records), and dozens more targets via RaidForums and later BreachForums. Core member Sebastien Raoult (SeyzoKaizen) was arrested in Morocco (2022) and convicted in US federal court (2024). Despite arrests, the group's operational capability expanded rather than contracted.

THE SNOWFLAKE CAMPAIGN (UNC5537) — SPRING/SUMMER 2024:

Mandiant tracks the Snowflake targeting cluster as UNC5537, a financially motivated threat actor with members based in North America and at least one collaborator in Turkey. The campaign represents ShinyHunters' evolution from traditional database theft to SaaS platform credential exploitation at industrial scale.

CAMPAIGN MECHANICS:

1. CREDENTIAL HARVESTING: UNC5537 aggregated Snowflake customer credentials from multiple infostealer malware families: VIDAR, RISEPRO, REDLINE, RACCOON STEALER, LUMMA, and METASTEALER. The earliest stolen credential dated to November 2020 — still valid 4 years later. At least 79.7% of compromised accounts had prior credential exposure via infostealers. Credentials were purchased from the underground infostealer marketplace and harvested from historical stealer log collections.

2. CONTRACTOR VECTOR: In several cases, initial infostealer compromise occurred on contractor systems used for personal activities including gaming and pirated software downloads. A single compromised contractor laptop provided access to multiple organizations with IT/admin-level Snowflake privileges.

3. ACCESS: UNC5537 accessed Snowflake instances via the native web UI (SnowSight), CLI tool (SnowSQL), and a custom reconnaissance utility dubbed FROSTBITE (available in .NET and Java variants). FROSTBITE performed SQL reconnaissance: listing users, current roles, IPs, session IDs, and organization names. DBeaver Ultimate was used for interactive query execution.

4. DATA STAGING: Systematic SQL pipeline:
   - SHOW TABLES → enumerate all databases and tables
   - SELECT * FROM target tables
   - CREATE TEMPORARY STAGE → create ephemeral staging area
   - COPY INTO @stage → compress data as GZIP CSV (5GB max file size)
   - GET @stage → exfiltrate to local attacker system

5. INFRASTRUCTURE: Mullvad and Private Internet Access (PIA) VPN for access. ALEXHOST SRL (AS200019, Moldova) VPS for staging. MEGA cloud storage for stolen data.

6. MONETIZATION: Dual extortion — victims contacted directly for ransom payment + stolen data advertised on BreachForums and Telegram channels.

THREE PRIMARY FAILURE FACTORS (per Mandiant):
- Impacted accounts were NOT configured with MFA
- Credentials had NOT been rotated (some valid since 2020)
- NO network allow lists to restrict access to trusted locations

KNOWN VICTIMS:
- AT&T: ~110 million customer call and text records stolen from Snowflake instance
- Ticketmaster/Live Nation: ~560 million customer records stolen and offered for $500K on BreachForums
- Santander Bank: ~30 million customer and employee records compromised
- 165+ total organizations notified by Mandiant and Snowflake

VISHING EVOLUTION (2023-2026):

Parallel to the Snowflake campaign, ShinyHunters and affiliated actors developed sophisticated vishing (voice phishing) capabilities targeting enterprise help desks:

- Impersonating employees using stolen PII from prior breaches (employee ID, manager name, birthday, last 4 SSN)
- Requesting MFA factor resets and password resets via phone calls to IT help desks
- 30-60% success rate for well-researched vishing calls vs 5-15% for email phishing
- SSO provider targeting: Okta, Azure AD (Entra ID), OneLogin, Duo
- Help desk verification bypass exploits static knowledge-based verification (all answers available from prior breaches)
- MGM Resorts and Caesars Entertainment breaches (2023) used this methodology via affiliated Scattered Spider actors

SIM-SWAPPING VECTOR:

ShinyHunters employs SIM-swapping as a secondary MFA bypass technique:
- Social engineering mobile carrier employees to transfer victim's phone number to attacker-controlled SIM
- Intercepts SMS-based MFA codes for accounts with SMS 2FA enabled
- Enables account takeover even when MFA is present (but SMS-based)
- Combined with credential theft: stolen password + SIM-swapped phone = full account access
- Used against high-value individual targets (executives, admins) when SSO credentials require MFA

VOICE DEEPFAKE ESCALATION:

AI-generated voice clones (ElevenLabs, Resemble AI, open-source TTS) enable real-time voice impersonation in vishing calls with 3-10 seconds of sample audio. This defeats voice-based verification and creates near-perfect employee impersonation when combined with caller ID spoofing and PII-backed identity answers.

SHINYHUNTERS vs SCATTERED SPIDER (TL-0013):

Distinct but overlapping groups:
- ShinyHunters: data broker origin, credential marketplace expertise, SaaS platform targeting (Snowflake), infostealer credential aggregation, BreachForums monetization
- Scattered Spider (TL-0013): identity infrastructure targeting, SIM-swapping specialization, help desk social engineering, ransomware deployment (ALPHV/BlackCat)
- Overlap: shared TTPs (vishing, MFA bypass), some member crossover, both target enterprise SSO
- Key distinction: ShinyHunters weaponizes stolen CREDENTIALS at scale; Scattered Spider weaponizes IDENTITY INFRASTRUCTURE

DATA MONETIZATION PIPELINE:

ShinyHunters operates a sophisticated data monetization pipeline:
1. Steal credentials via infostealer malware or purchase from underground markets
2. Access SaaS platforms (Snowflake, cloud storage, SSO portals) using stolen credentials
3. Exfiltrate data using platform-native tools (no malware needed)
4. List data for sale on BreachForums (public advertisement)
5. Simultaneously extort victims directly (private ransom demand)
6. If victim pays: data (allegedly) withheld from public sale
7. If victim doesn't pay: data sold to highest bidder or leaked publicly

This dual-revenue model maximizes financial return per breach while creating urgency for victim payment.

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1621 Multi-Factor Authentication Request Generation
- T1098.001 Additional Cloud Credentials
- T1530 Data from Cloud Storage
- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1588 Obtain Capabilities
- T1566 Phishing
- T1078 Valid Accounts
- T1539 Steal Web Session Cookie
- T1098 Account Manipulation
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1580 Cloud Infrastructure Discovery
- T1204 User Execution
- T1608 Stage Capabilities
- T1552 Unsecured Credentials
- T1111 Multi-Factor Authentication Interception
- T1074 Data Staged
- T1119 Automated Collection
- T1537 Transfer Data to Cloud Account
- T1059 Command and Scripting Interpreter
- T1594 Search Victim-Owned Websites
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1199 Trusted Relationship
- T1555 Credentials from Password Stores
- T1556 Modify Authentication Process
- T1020 Automated Exfiltration

## Sources

- [Mandiant/Google Cloud — UNC5537 Snowflake Data Theft and Extortion](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion)
- [Snowflake — Detecting and Preventing Unauthorized Access (Joint Advisory)](https://community.snowflake.com/s/question/0D5VI00000Emyl00AB/)
- [Mandiant — Snowflake Threat Hunting Guide](https://services.google.com/fh/files/misc/snowflake-threat-hunting-guide.pdf)
- [DOJ — Sebastien Raoult Conviction](https://www.justice.gov/usao-wdwa/pr/)
- [CrowdStrike — Scattered Spider Profile](https://www.crowdstrike.com/adversaries/scattered-spider/)
- [Okta — Support System Breach Advisory](https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system)
- [AT&T — Customer Data Breach Disclosure](https://about.att.com/story/2024/addressing-illegal-download.html)
- [BleepingComputer — Snowflake Breach Coverage](https://www.bleepingcomputer.com/tag/snowflake/)
- [KrebsOnSecurity — Snowflake Investigation](https://krebsonsecurity.com/tag/snowflake/)
- [The Record — ShinyHunters/UNC5537 Analysis](https://therecord.media/)
- [MITRE ATT&CK — Valid Accounts: Cloud (T1078.004)](https://attack.mitre.org/techniques/T1078/004/)
- [MITRE ATT&CK — Spearphishing Voice (T1566.004)](https://attack.mitre.org/techniques/T1566/004/)
- [Flashpoint — ShinyHunters Profile](https://flashpoint.io/)
- [DataBreaches.net — ShinyHunters Tracking](https://www.databreaches.net/)
- [Microsoft — Entra ID Security](https://learn.microsoft.com/en-us/entra/identity/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0030