Skip to navigation

Threat reportThreat IntelligenceTL-2026-5249

ShinyHunters Post-Arrest Brand Fight: Rival Factions, Shared Extortion Infrastructure and Impersonation (SLSH / Aegis / ShinyEquationCartel)

mediumACTIVE

After arrests in September-October 2026, rival factions (leak-site faction, Aegis, ShinyEquationCartel) are competing for the ShinyHunters brand, reusing the same download servers, forging PGP signatures and recycling unverified victim claims. Aegis announced an Extortion-as-a-Service affiliate program with an unverified 80% revenue split on Oct 13-14, 2026.

Key facts for ShinyHunters brand split

IdentifiersTL-2026-5249
Also known asShinyHunters brand fight, SLSH, ShinyHunters Extortion-as-a-Service
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsMultiple Organizations named in unverified extortion claims (H&M, Orange, Baxter International, Salesforce, Cisco, University of Nottingham, Council of Europe, Brinks Home)
AttributionShinyHunters (medium confidence)
MalwareLockBit, Morpheus, scattered lapsus$ hunters, telegram
MITRE ATT&CK techniquesT1190 Exploit Public-Facing Application, T1583.001 Domains, T1583.004 Server, T1585.001 Social Media Accounts, T1585.002 Email Accounts, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorstechnology, retail, telecoms, health, education, government administration
Target regionsGlobal, Europe, North America
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for ShinyHunters brand split

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5249 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ShinyHunters Factions Shared Download Servers — Firewall Contact (Proton66/PROSPERO)

TL-2026-5249: detects firewall sessions to the four download servers reused by the rival ShinyHunters factions (176.120.22.24 on Proton66 AS198953; 91.202.233.104, 91.215.85.103 and 91.215.85.22 on PROSPERO AS200593). These host the victim-data download links used as proof in extortion posts, so inbound-heavy sessions suggest staff retrieving extortion proof or a host fetching or staging stolen data. Summarises volume per source and destination.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1583.004, T1657
  • Data sources: firewall:pan:traffic, network_traffic
  • Severity: high
  • Confidence: high

Splunk SPL

index=firewall sourcetype="pan:traffic" earliest=-24h
dest_ip IN ("176.120.22.24", "91.202.233.104", "91.215.85.103", "91.215.85.22")
| stats count AS sessions sum(bytes_out) AS bytes_out sum(bytes_in) AS bytes_in values(dest_port) AS dest_ports values(action) AS actions min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_ip
| eval mb_in=round(bytes_in/1048576,2), mb_out=round(bytes_out/1048576,2)
| convert ctime(first_seen) ctime(last_seen)
| sort - bytes_in

Microsoft KQL

let IocIps = dynamic(["176.120.22.24", "91.202.233.104", "91.215.85.103", "91.215.85.22"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (IocIps)
| summarize Sessions=count(), BytesIn=sum(ReceivedBytes), BytesOut=sum(SentBytes), Ports=make_set(DestinationPort), Actions=make_set(DeviceAction), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DeviceVendor
| order by BytesIn desc

Sigma

title: ShinyHunters Factions Shared Download Server Contact - Firewall
id: 5b1e7c3a-2a4d-4f6e-9a10-5249a0000001
status: experimental
description: Detects network sessions to download servers reused by rival ShinyHunters factions (Proton66 AS198953 and PROSPERO AS200593 hosts).
references:
    - https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight
    - https://intel.threadlinqs.com/TL-2026-5249
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.resource_development
    - attack.t1583.004
    - attack.impact
    - attack.t1657
logsource:
    category: firewall
detection:
    selection:
        dst_ip:
            - '176.120.22.24'
            - '91.202.233.104'
            - '91.215.85.103'
            - '91.215.85.22'
    condition: selection
falsepositives:
    - Threat-intel analysts deliberately browsing extortion proof links from a sandbox
    - Security scanners or CTI crawlers probing the hosts
level: high

Known false positives:

  • Authorised CTI/DFIR sandbox hosts visiting the servers to validate an extortion claim
  • Internet-wide scanners or threat-intel crawlers logged against the same IPs

Tuning notes: Swap index/sourcetype for your firewall (e.g. cisco:asa, fgt_traffic). Exclude CTI sandbox subnets. Raise priority when bytes_in is large or the source is a server. Add new IPs from sibling servers sharing the '// SH' page title or the Jun 17/Jul 26/Sep 18 certificate start dates.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ShinyHunters Download Servers — Web-Server Process Egress After Public-Facing App Compromise · unlock with TL Creds
  • ShinyHunters Aegis Extortion Contact — Outbound Email To Known Contact Addresses · unlock with TL Creds
  • ShinyHunters Community-Observed Sibling Domains — DNS and Network Contact · unlock with TL Creds
  • ShinyHunters Download Servers — Endpoint Network Connection To Shared Infrastructure · unlock with TL Creds
  • ShinyHunters Faction Telegram Contact Accounts — Proxy Access To [indicator] and [indicator] · unlock with TL Creds
  • Fake AEGIS VPN Phishing Domain vpnaegis2.site — Proxy and Email URL Contact · unlock with TL Creds
  • ShinyHunters Aegis Extortion Contact — Inbound Email From Known Contact Addresses · unlock with TL Creds
  • ShinyHunters Extortion Infrastructure — DNS Lookups for [indicator] and [indicator] · unlock with TL Creds

Indicators of compromise for ShinyHunters brand split

As of 2026-11-04, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5249.

Sample indicators (3 of 21)

  • IP address: 176.120.22[.]24
  • Domain: shinywire[.]com
  • File hash: E80C1308A09EC1ADC418C3F02578988F69BCA3FC

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for ShinyHunters brand split

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How ShinyHunters brand split works

Following the Dutch police arrest of a 24-year-old on Sep 15, 2026, the detention of 'Rey' in Jordan on Sep 29 (Reuters later reported FBI cooperation) and the arrest of former CYPFER executive Edward Dubrovsky on federal extortion charges (reported Oct 8-9; FBI Director Kash Patel announced the arrest of 'another suspected co-conspirator'), the ShinyHunters leak site went offline on Sep 30 and several actors began claiming the brand. Jon DiMaggio (Arkem Cyber, published via Flare on 2026-11-04) assesses with moderate confidence that three factions now exist: the original leak-site faction, the 'Aegis' faction (which ran the 'ShinyHunters (SLSH)' Telegram channel and claimed 'Grand Founder' status after Rey's detention, though forum peers dismissed the persona as a 'larp'), and 'ShinyEquationCartel' (channel opened Oct 10, claiming ex-members of ShinyHunters, LAPSUS$, HellCat and LockBit).

Infrastructure analysis shows the factions reuse the same download servers: 176.120.22.24 (Proton66, AS198953, certificate validity starting Sep 18 12:19:57 UTC) and 91.202.233.104, 91.215.85.103 and 91.215.85.22 (PROSPERO, AS200593). The three backup servers share certificate start dates (Jun 17, Jul 26, Sep 18) and a '// SH' page title, with the earliest sighting on 91.215.85.103 (Jul 10). The same download token for Baxter International appeared across platforms. The @shsupportsh Telegram account (ID 8581727007) posted 779 of 849 messages matching the 'International Global Network (SLSH)' channel exactly, with 315 message pairs inside 60 seconds, supporting coordinated publishing (moderate confidence). The Aegis faction on Oct 5 pruned its contact list (dropping XMPP, Tuta and OnionMail addresses, retaining shinyprocorp@proton.me) and uses Session IDs.

Impersonation and deception tradecraft includes a Jun 12 extortion post that carried a forged copy of a December 2025 BreachForums admin PGP signature whose verification fails on altered text (original fingerprint E80C1308A09EC1ADC418C3F02578988F69BCA3FC), contact handles swapped from @wokawoka10 to @myselft6040, recycled postings (CIA '300GB documents', Sep 30) and a recycled H&M claim: Aegis demanded $100,000 on Oct 6, ShinyEquationCartel auctioned the same data on Oct 13 saying '@reyswap does NOT possess this database', and an Oct 12 investigation found no evidence of compromise. Other claims (University of Nottingham, Council of Europe, Brinks Home, Baxter International, Orange, Salesforce and Cisco at a $250,000 ask) are unverified per the source. On Oct 13-14 Aegis posted a 'SHINYHUNTERS AFFILIATE PROGRAM - RANSOMWARE-AS-A-SERVICE' offering affiliates 80% of revenue (unverified); the source frames this as an extortion-as-a-service model. KrebsOnSecurity reported the extortion site shinywire.com operated roughly May 3 to Oct 16, 2026, and a BreachForums revival at breached.rs was announced Oct 16.

Attribution caveats: Google tracks the ShinyHunters leak site as UNC6240. UNC6395 (Salesloft Drift token theft) and UNC6040 identifiers are being co-opted by personas (@myselft6395, @myselft6040) and are not valid attribution for these factions. UNC6671 (BlackFile/Redact extortion) is assessed as separate from ShinyHunters. Press reporting (The Hacker News) attributes to the broader brand 140+ breaches and about $70 million in extortion payments; these are not verified for any individual current faction. No CVE or CVSS applies.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1583.001 Domains; T1583.004 Server; T1585.001 Social Media Accounts; T1585.002 Email Accounts

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation for ShinyHunters brand split

Immediate actions

  • Block or alert on 176.120.22.24, 91.202.233.104, 91.215.85.103 and 91.215.85.22 at the perimeter and in proxy/DNS logs
  • Treat extortion claims naming your organization as unverified until independently validated; check the claimed data against internal telemetry before engaging or paying
  • Do not rely on PGP signatures or brand names alone to authenticate extortion messages; verify signatures against known-good fingerprints

Workarounds

  • Treat inbound contact from the listed Session IDs, Telegram accounts and email addresses as hostile extortion contact and escalate to incident response

Longer-term hardening

  • Monitor Telegram, leak-site and forum channels for brand-name mentions and recycled victim claims
  • Track shared infrastructure (hosting ASNs AS198953 and AS200593, certificate start dates, page titles) rather than persona names for clustering
  • Maintain an extortion-response playbook with legal and law-enforcement contacts

Affected and fixed versions

  • Multiple — Organizations named in unverified extortion claims (H&M, Orange, Baxter International, Salesforce, Cisco, University of Nottingham, Council of Europe, Brinks Home)

Timeline of ShinyHunters brand split

  • Extortion post carries a forged copy of a December 2025 BreachForums admin PGP signature; verification fails on altered text. The same day a University of Nottingham claim links to locked-ioc-15.
  • Dutch police arrest a 24-year-old for 'participation' in ShinyHunters.
  • Certificate validity begins on locked-ioc-15 (12:19:57 UTC); backup servers on PROSPERO show the same Sep 18 certificate start.
  • 'Rey' is detained in Jordan; Reuters later reports (Oct 3) FBI cooperation.
  • ShinyHunters leak site goes offline after a deadline expires; a recycled 'CIA 300GB documents' claim is posted.
  • Aegis faction drops XMPP, Tuta and OnionMail contacts and retains locked-ioc-7 plus Session IDs.
  • Aegis faction demands $100,000 from H&M; an Oct 12 investigation finds no evidence of compromise.
  • Former CYPFER executive Edward Dubrovsky arrested on federal extortion charges (Flare dates this Oct 8); FBI Director Kash Patel announces arrest of 'another suspected co-conspirator'.
  • locked-ioc-11 Telegram channel opens, claiming former ShinyHunters, LAPSUS$, HellCat and LockBit members.
  • Aegis announces a ShinyHunters affiliate program with an unverified 80% revenue split (posted Oct 13-14); locked-ioc-11 auctions the same H&M data.
  • locked-ioc-17 extortion site ends operation (active since about May 3) and BreachForums revival locked-ioc-20 is announced.
  • Flare publishes Jon DiMaggio's analysis of the post-arrest brand fight.

Sources cited for ShinyHunters brand split

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats