Threat video1:00
ShinyHunters Impostor Binance Claim: Detection & IOCs
A ShinyHunters-named seller offers 335M Binance user records; Binance denies any breach. Track it with 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for ShinyHunters Impostor Binance Claim: Detection & IOCs →
Chapters
- 0:00The hookClaimed: 335M Binance users.
- 0:05The storyA ShinyHunters handle offered them for $900,000.
- 0:12Attack pathPer reports, a new forum claims passwords, private keys, KYC.
- 0:30AttributionNo threat actor is attributed.
- 0:35Indicators of compromise2 indicators to hunt: 2 domains.
- 0:40MITRE ATT&CK techniques8 ATT&CK techniques, from resource development to impact.
- 0:44Remediation4 steps now: Treat the claim as unverified.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Claimed: 335M Binance users. Denied.
0:05A ShinyHunters handle offered them for $900,000.
0:09Binance found no evidence of a breach.
0:12Per reports, a new forum claims passwords, private keys, KYC.
0:17The ShinyHunters name is believed impersonated.
0:20The seller issued a pay-or-leak ultimatum.
0:23If real or recycled: credential stuffing and phishing risk.
0:27Verify before acting.
0:31No threat actor is attributed. Confidence: low.
0:352 indicators to hunt: 2 domains.
0:408 ATT&CK techniques, from resource development to impact.
0:444 steps now: Treat the claim as unverified.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.