# ShinyHunters Cluster A Phishing Infrastructure on Mevspace (Doko's Panel, vishing + AiTM credential capture)

> Team Cymru validated active phishing infrastructure consistent with Push Security's ShinyHunters 'Cluster A' reporting: two Mevspace-hosted IPs (AS201814, Poland) tied to roughly 65 victim-themed domains used in vishing-led, operator-driven adversary-in-the-middle capture of identity-provider credentials and MFA codes. Team Cymru does not independently attribute the activity to ShinyHunters from passive telemetry alone.

- **Published:** 2026-10-19T14:39:16Z
- **Last reviewed:** 2026-10-19T14:39:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3892
- **ID:** TL-2026-3892
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** ShinyHunters  - Cluster A infrastructure
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Team Cymru (published 2026-08-05) used network telemetry to validate Cluster A infrastructure described by Push Security (2026-05-07). Two IPs in the Mevspace AS201814 block 149.50.96.0/22, 149.50.97.174 (34 associated domains) and 149.50.127.228 (32 associated domains), were last seen in the telemetry on 2026-05-07. Associated domains are victim-themed and follow the patterns <target>internal.com, my<target>sso.com, my<target>manager.com, my<target>connect.com and admin./cp. operator subdomains. Themes cover higher education (Yale, University of Pennsylvania), financial services (Shift4, KKR, VanEck, IQ-EQ, Meridian Savings), real estate (Brixmor), luxury goods (LVMH), retail and consumer brands (Nike, Disney, Dick's Sporting Goods, Publix, Petco, JB Hi-Fi, Purple), cryptocurrency platforms (Coinbase, Binance, Nexo, NDAX, Bitpanda, Blofin, CoinTracker, Koinly), telecommunications (Verizon) and Australian Taxation Office tax filing. The host 149.50.97.174 exposed an FTP service on port 21 presenting a self-signed BT-Panel certificate (serial 58:23:e9:3d:a7:48:1e:3e:7f:5c:85:12:15:d9:63:0c:f4:6e:f2:06, valid 2025-10-23 to 2027-03-19). Team Cymru treats the BT-Panel artifact as hosting context rather than attribution evidence. Phishing sites are fronted by Cloudflare, and Binance-themed domains use URL-bar truncation typosquats such as www.binance.com.53253binance.com. Registrar and nameserver fingerprint for Cluster A: NICENIC INTERNATIONAL GROUP CO., LIMITED (parent CNOBIN INFORMATION TECHNOLOGY LIMITED) with nameservers ns0.1984.is and ns1.1984hosting.com.

Per Push Security, the tooling is Doko's Panel, named for its developer's Telegram alias 'Doko'. A client.js script on the victim page pings /backend.php with JSON (action 'ping', token, window_id, page, os, browser). Captured credentials are relayed to operator Telegram channels (sendTelegramMessage()/sendtg(), j.php). The workflow is operator-driven rather than an automated reverse proxy: the victim lands on a gated page with a spinner, the operator accepts the visitor from the admin panel, the victim is shown a cloned login page, and the operator replays credentials to the real identity provider and captures the MFA response (SMS OTP, Google Authenticator TOTP, push approval redirects). The victim is then redirected to a decoy page. Some deployments had no authentication on the admin panel, and one variant could display a Microsoft Teams Meeting ID and passcode to support the vishing pretext. Push reports signs of LLM-assisted code modification. Push also describes Clusters B (Njalla/Tucows, heartbeat variant), C (Cloudflare, Turnstile, passkeysetup.com subdomains) and D (minified variant, passkeyportalsetup.com); these share code heritage with Doko's Panel but appear to be deployed by separate groups.

Per Mandiant/GTIG (2026-01-30), UNC6661 phoned employees while posing as IT staff, directed them to victim-branded credential harvesting sites to 'update MFA settings', then registered attacker-controlled MFA devices and exfiltrated data from SaaS platforms (SharePoint, OneDrive, Salesforce, DocuSign, Slack, Google Workspace, Okta). Follow-on extortion is attributed to UNC6240 (ShinyHunters), based on a shared Tox account, ShinyHunters-branded emails and Limewire-hosted samples. Team Cymru states Cluster A correlates with UNC6661 intrusions plus UNC6240 extortion, but explicitly cautions that passive DNS does not prove common ownership, that numeric-token domains (e.g. 412721coinbase.com) have an unconfirmed operational role, and that dokopanel.com (registered 2026-01-17 via Tucows with Njalla nameservers) is a hosting-layer artifact that does not identify individuals. Details drawn from Push Security and Mandiant reporting are not independently verified here.

## MITRE ATT&CK

- T1598.004 Spearphishing Voice
- T1583.001 Domains
- T1588.002 Tool
- T1566.004 Spearphishing Voice
- T1566.002 Spearphishing Link
- T1078.004 Cloud Accounts
- T1204.001 Malicious Link
- T1111 Multi-Factor Authentication Interception
- T1098.005 Device Registration
- T1684.001 Impersonation
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Behind the Panels: Validating ShinyHunters Cluster A Infrastructure Through Network Telemetry](https://www.team-cymru.com/post/validating-shinyhunters-cyber-threat-actors-infrastructure)
- [Push Security: Inside a phishing panel used by ShinyHunters and BlackFile](https://pushsecurity.com/blog/inside-criminal-phishing-panel)
- [Google Cloud / Mandiant GTIG: Vishing for Access - Tracking ShinyHunters-Branded SaaS Data Theft](https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft)
- [Google Cloud: Defense against ShinyHunters-branded SaaS data theft (hardening guide)](https://cloud.google.com/blog/topics/threat-intelligence/defense-against-shinyhunters-cybercrime-saas)
- [The Hacker News: Mandiant finds ShinyHunters using vishing to steal MFA and breach SaaS platforms](https://thehackernews.com/2026/01/mandiant-finds-shinyhunters-using.html)
- [BankInfoSecurity: Hanging Up on ShinyHunters - Experts Detail Vishing Defenses](https://www.bankinfosecurity.com/hanging-up-on-shinyhunters-experts-detail-vishing-defenses-a-30657)
- [CSO Online: ShinyHunters ramp up new vishing campaign with 100s in crosshairs](https://www.csoonline.com/article/4124684/shinyhunters-ramp-up-new-vishing-campaign-with-100s-in-crosshairs.html)
- [GTI Collection of ShinyHunters-branded campaign IOCs (VirusTotal)](https://www.virustotal.com/gui/collection/214da7a4bb12360a85e03a15da1ff74284e09651a33f4f760ee01230439c16af)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3892