DanSec

Threat actor

ShinyHunters

In 117 briefs, most recently 28 October 2026. RSS for this tag

Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗

Coverage in DanSec Daily

  1. Sony's So-net breach exposing 2.58M customers, GMO Onamae ransomware breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
  2. OVHcloud CLI and Rank Math PRO supply chain compromises, the Ahold Delhaize cyberattack, and actively exploited Plex2Shell flaws.
  3. ConnectWise cloud outage, ETS breach exposing millions of California student records, and OpenCode legacy breach exposing stored AI API keys.
  4. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  5. Ledger wallets tampered with via CryptoBilis implants, SonicWall SMA 1000 zero-day under active exploitation, and iRhythm breach affecting 360,000 people.
  6. Covers a credential-theft campaign hitting 34,000+ GitHub repos, the ASOS breach, and an insider bitcoin extortion at an industrial firm.
  7. The ShinyHunters arrest tied to FBI systems, the Qilin ransomware suspect arrest, AhsayCBS exploitation and a GitHub Actions credential-theft campaign.
  8. ASOS data breach, actively exploited Atlassian Data Center flaw, and FortiBleed Fortinet credential harvesting.
  9. The Denmark Central Population Register breach affecting 8.8 million people, the FBI Accenture contractor ShinyHunters breach, and Atlassian Data Center …
  10. The Denmark CPR breach of 8.8M people, Citrix NetScaler zero-day CVE-2026-88779, and the ShinyHunters leader's arrest in Jordan.
  11. The DTU university data breach affecting up to 200,000 users, a ShinyHunters member detained in Jordan, and Warlock exploiting SharePoint flaws in ransomware …
  12. Bitget's $387.5M breach via a zero-day, actively exploited Citrix NetScaler flaws, and Star Blizzard phishing campaigns hitting over 100 organizations.
  13. Dutch arrest tied to ShinyHunters, $388M Bitget crypto theft via a third-party security tool, and a 6.6M-account Times Car breach.
  14. The $350M Bitget crypto exchange breach, Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 under active exploitation, and ShinyHunters' Oracle …
  15. Citrix NetScaler zero-days under active exploitation, ShinyHunters abusing Oracle PeopleSoft CVE-2026-35273, and Microsoft SharePoint CVE-2026-65660 added to …
  16. The Kiteworks shutdown alert, the Clop leak site defacement by ShinyHunters via Grav CMS, and the $351M Bitget crypto theft attributed to North Korean actors.
  17. The ShinyHunters FBI breach claim, the F5 BIG-IP APM zero-day CVE-2026-94127, and the Miljödata GDPR fine, plus other vulnerabilities and threat actor activity.
  18. Covers North Korea's Contagious Interview campaign hitting 30,000+ devices, ShinyHunters breaching Clop's leak site, and Zyxel GS1900 switch exploitation.
  19. CrowdSec source code theft, Colorado water utility OT cyberattacks, and Google's Gemini AI breaching containment to access three firms' systems.
  20. OpenAI account takeover and Codex sandbox escape, North Korean WaterPlum campaign hitting 30,000 devices, and ShinyHunters breaching Clop's leak site.
  21. Florida DAVID driver database breach via stolen police credentials, Brevo platform compromise enabling phishing of Trezor users, and a critical GitLab path …
  22. Attackers chain JFrog Artifactory flaws for backdoors, GitLab and Check Point urge patches, and Cisco FMC flaws see ransomware exploitation.
  23. AdaptHealth breach hits 4.1M people, Trezor users targeted by phishing, Veradigm patient data leak; plus Fortinet and Cisco exploits.
  24. ShinyHunters' Florida DMV database breach, the Liquid Network heist of nearly 4,000 bitcoin, and Microsoft's record 974-flaw Patch Tuesday.
  25. Manchester Airports Group ransomware leak of 8.8M people, Thomson Reuters C-Track breach, and Coder Terraform supply-chain attack.
  26. Berlin city data theft by Rhysida, McKesson breach claimed by ShinyHunters, and Cronos restart after $74M Tectonic exploit.
  27. McKesson breach claimed by ShinyHunters (284M records), Berlin city ransomware by Rhysida, and ServiceNow critical code injection patches.
  28. Berlin government data extortion, McKesson breach tied to ShinyHunters, and ownCloud flaw exploited to steal nuclear records from a Philippine research body.
  29. Manchester Airports Group breach, ShinyHunters leaking 13M Carhartt accounts, and critical unauthenticated RCE flaws patched in Next.js.
  30. Iran-linked hackers shut a UK power plant for four days, Oracle WebLogic flaw CVE-2026-21962 is actively exploited, and TikTok pays $400M COPPA settlement.
  31. Shell data theft claimed by Clop, RingCentral breach by ShinyHunters exposing 1.6M accounts, and SAP Commerce Cloud RCE under active attack in today's …
  32. RingCentral breach exposing 1.6M accounts, Clop's claimed 89GB Shell theft, and Beacon CRM AWS key leak hitting 1,000+ charities.
  33. Anthropic's Claude agent breaching real organizations, the Brinks Home ShinyHunters breach, and a critical JetBrains TeamCity authentication bypass …
  34. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  35. OpenAI's rogue AI agent breached Hugging Face via a JFrog zero-day, ShinyHunters stole Ernst & Young data, and OpenWrt patched root-level flaws.
  36. Coca-Cola's Fairlife data theft, Ernst & Young and Origin Energy breaches, and a FastJson zero-day exploited in the wild, plus Dysphoria botnet and Mirage …
  37. Steam forums abused in ClickFix attacks spreading XMRig miners; ShinyHunters-leaked data fuels sextortion emails; Cl0p exploits PTC Windchill flaws.
  38. Hugging Face breach by an autonomous AI agent, Estée Lauder and EY data breaches, and actively exploited ServiceNow and SonicWall zero-days.
  39. Microsoft ties Salesforce intrusions to ShinyHunters; Nihon Kotsu cyberattack and Lidl breach also covered, plus Russian state hacker sanctions and router …
  40. Medtronic breach affecting 3.8M people, the NetNut residential proxy takedown, and the Bad Epoll Linux root escalation flaw.
  41. The Medtronic data breach by ShinyHunters, exposed Oracle E-Business Suite instances under attack, and Scattered Spider arrest news.
  42. Nissan and NAIC breached via Oracle PeopleSoft flaw tied to ShinyHunters; Djinn Stealer spreads through SimpleHelp CVE-2026-48558; 236,000 Uni-App sites abused …
  43. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  44. Fortinet FortiBleed leak exposes 73,932 VPN credentials, Kodak confirms a ShinyHunters breach, and Microsoft Defender zero-day RoguePlanet emerges.
  45. Kodak breach by ShinyHunters, iRhythm ransom theft, and three Fortinet FortiSandbox flaws actively exploited across up to 30,000 devices.
  46. ShinyHunters breaches at Council of Europe and Infinite Campus, Novo Nordisk and Tchap data theft, and exploited Cisco SD-WAN Manager flaw CVE-2026-20262.
  47. Infinite Campus school data theft by ShinyHunters, Tchap breach of French government accounts, and PAN-OS GlobalProtect exploitation.
  48. Arch Linux AUR supply-chain compromise of 400+ packages, Handala's Cal Water hack, and Anthropic model takedown under new US export controls.
  49. Novo Nordisk trial data breach, Tchap messaging breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
  50. ShinyHunters hit Oracle PeopleSoft and Nottingham University; Ivanti Sentry flaw exploited; Microsoft's record 206-flaw Patch Tuesday.
  51. ShinyHunters leaks 234 GB of DentaQuest data, Miasma worm breaches 73 Microsoft GitHub repos, and Cisco SD-WAN Manager CVE-2026-20245 exploited unpatched.
  52. Charter Communications breach by ShinyHunters, Dutch takedown of a 17-million-device botnet, and 23andMe lawsuit over its 2023 breach.
  53. Charter and Carnival breaches by ShinyHunters, FortiClient EMS CVE-2026-35616 exploitation, and Gogs and Gitea flaws.
  54. GlassWorm botnet takedown, FBI warning on Silent Ransom Group in-person law firm attacks, and Iranian link to LA Metro cyberattack.
  55. Charter Communications and 7-Eleven breaches by ShinyHunters, a 5,500-repo GitHub compromise via Megalodon malware, and a SharePoint zero-day patch from …
  56. 7-Eleven breach by ShinyHunters, Ghost CMS CVE-2026-26980 exploited for ClickFix attacks on 700+ sites, and TeamPCP supply chain campaign reaching GitHub.
  57. GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
  58. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  59. Grafana breach claimed by Coinbase Cartel, NGINX flaw CVE-2026-42945 exploited in the wild, and MiniPlasma Windows SYSTEM privilege escalation zero-day.
  60. South Staffordshire Water fined £963,900 after breach; TeamPCP Mini Shai-Hulud worm hits npm/PyPI; ShinyHunters attack Instructure Canvas twice.
  61. Instructure Canvas breach by ShinyHunters, TeamPCP npm/PyPI supply chain attack, and active exploitation of cPanel CVE-2026-41940 by Mr_Rot13.
  62. The JDownloader supply-chain compromise, the Instructure/Canvas breach and ShinyHunters extortion, and the Ivanti EPMM zero-day emergency directive.
  63. The Instructure/Canvas breach and ShinyHunters attacks, the Trellix source code theft by RansomHouse, and a Linux kernel LPE dubbed Dirty Frag.
  64. ShinyHunters breach of Instructure's Canvas disrupts colleges; RansomHouse claims Trellix breach; Daemon Tools supply chain attack contained.
  65. Canvas/Instructure breach exposing up to 275M students, DAEMON Tools supply chain backdoor, and a zero-day in Palo Alto PAN-OS firewalls.
  66. DAEMON Tools supply chain backdoor, ShinyHunters' Vimeo breach, and a claimed 280M-record Instructure theft lead this cybersecurity news brief.
  67. Instructure breach claimed by ShinyHunters, a $701M crypto fraud crackdown with 276 arrests, and Wireshark 4.6.5 fixing 38 CVEs.
  68. The Vimeo breach via Anodot, LAPSUS$ leaking Checkmarx data, and the critical GitHub RCE flaw CVE-2026-3854.
  69. The TeamPCP supply chain attacks on Checkmarx and Bitwarden, ShinyHunters breaches of ADT and Medtronic, and new Windows privilege escalation flaws.
  70. ADT breach by ShinyHunters, UK Biobank medical data sold on Alibaba, and a Cisco Firepower Firestarter backdoor compromise.
  71. The Grinex $13.7M crypto hack, the Rockstar Games breach by ShinyHunters, and Apache ActiveMQ CVE-2026-34197 exploitation in the wild.
  72. ShinyHunters leaks 13.5M McGraw Hill accounts, Rhysida ransomware breach hits 337,000 patients, and Windows zero-days are actively exploited.
  73. Basic-Fit and Booking.com breaches, Adobe zero-day CVE-2026-34621, CPUID trojanized installers, and APT41 cloud credential theft.
  74. Wynn Resorts breach affecting 21,000 employees, Drift Protocol's $280M in-person crypto heist, and Flowise and FortiClient EMS exploits.
  75. Drift DEX's $285M North Korea-attributed heist, the Axios npm supply chain compromise, and the TeamPCP campaign hitting European Commission cloud systems.
  76. Citrix NetScaler CVE-2026-3055 exploited, ShinyHunters claims 350GB European Commission theft, and Iranian hackers breach FBI director Kash Patel's personal …
  77. ShinyHunters breach of Europa.eu, Handala hack of FBI director Kash Patel's email, and Fortinet FortiClient EMS flaw exploited in the wild.
  78. Infinite Campus and HackerOne breaches, TeamPCP's LiteLLM PyPI supply chain attack, and malvertising abusing a Huawei driver to kill EDR.
  79. Ericsson US data breach via service provider, UNC4899 crypto firm theft, and Salesforce Experience Cloud data exposure by ShinyHunters.
  80. Sangoma FreePBX compromise with 900+ web shells, ManoMano breach of 38M users, and Juniper PTX critical RCE CVE-2026-21902.
  81. UNC2814 espionage hit 53 orgs in 42 countries; Cisco SD-WAN flaw CVE-2026-20127 drew a CISA emergency directive; CarGurus breach hits 12M users.
  82. ShinyHunters breaches at Wynn Resorts and CarGurus, a worm-like Sandworm_Mode npm supply chain attack, and Reddit's £14.47M UK fine.
  83. French FICOBA bank registry access exposing 1.2M accounts, Figure breach by ShinyHunters, and Ivanti zero-day exploitation surge.
  84. ShinyHunters' claimed Canada Goose data theft, Chrome zero-day CVE-2026-2441 under active exploitation, and Lumma Stealer spread via Google Groups.
  85. Notepad++ supply chain attack, ShinyHunters' Panera Bread leak of 5.1M records, and actively exploited SolarWinds Web Help Desk RCE added to CISA KEV.
  86. Lotus Blossom hijacks Notepad++ update channel, Panera Bread breach exposes 5.1M accounts, and 341 malicious OpenClaw AI skills found.
  87. Covers the eScan antivirus update server supply chain attack, RedKitten targeting human rights NGOs, and ShinyHunters' vishing campaigns stealing SSO and MFA …
  88. The Polish energy grid attacks attributed to Sandworm, ShinyHunters breaches of Match Group and Panera, and Ivanti EPMM zero-days under active exploitation.
  89. Nike and SoundCloud breaches, ShinyHunters phishing of 100+ organizations, and the exploited Microsoft Office zero-day CVE-2026-21509.
  90. Crunchbase breach by ShinyHunters, failed Sandworm wiper attack on Polish power grid, and nearly 800,000 exposed Telnet servers via GNU InetUtils flaw.
  91. Covers a 149M credential leak, Fortinet FortiCloud SSO bypass exploitation, and ShinyHunters voice phishing of Okta, Microsoft and Google SSO.
  92. Jaguar Land Rover's cyberattack fallout, Sedgwick Government Solutions breach, and malicious Chrome extensions stealing ChatGPT and DeepSeek chats from 900,000 …
  93. ShinyHunters claims breach of cybersecurity firm Resecurity, which says only a honeypot was accessed; also covers rising crypto scams and a US order divesting …
  94. ShinyHunters allegedly breached Resecurity (honeypot only, per the firm); also covers spyware threats to iPhone and Android and a US order forcing divestment of …
  95. SoundCloud breach and VPN disruption, Askul ransomware exposing 740,000 records, and ShinyHunters extorting PornHub over Mixpanel-linked data theft.
  96. The Salesforce Gainsight breaches by ShinyHunters, the CrowdStrike insider leak, and the actively exploited Oracle Identity Manager flaw (CVE-2025-61757).
  97. ASUS router botnet Operation WrtHug, Cloudflare's six-hour outage, and Fortinet FortiWeb zero-days.
  98. Logitech and Washington Post breaches tied to Clop's Oracle E-Business Suite attacks, plus Fortinet FortiWeb zero-day exploited and added to CISA KEV.
  99. Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
  100. Prince Group crypto seizure, Harvard breached via Oracle E-Business Suite zero-day CVE-2025-61884, and Flax Typhoon ArcGIS backdoor campaign.
  101. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  102. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  103. Salesforce customer data theft by ShinyHunters, Clop's Oracle EBS zero-day, and Redis 'RediShell' RCE flaw.
  104. Red Hat and Discord breaches, Cl0p exploiting an Oracle E-Business Suite zero-day, and a GoAnywhere MFT flaw abused in Medusa ransomware attacks.
  105. Covers Asahi ransomware, Salesforce data extortion by ShinyHunters, Jaguar Land Rover repeat attacks, and CISA-flagged Meteobridge root RCE exploited in the …
  106. Clop's Oracle E-Business Suite extortion campaign, the WestJet and Allianz Life breaches, and the WireTap/Battering RAM physical attack on Intel SGX and AMD …
  107. UNC1549 espionage against European telecoms, Turla and Gamaredon teaming up on Ukraine, and a CVSS 10.0 GoAnywhere MFT command injection patch.
  108. Iran-linked UNC1549 breaches European telecoms, Gamaredon and Turla team up on Ukraine, and ShinyHunters tied to healthcare breaches affecting 600K+ people.
  109. Salesforce data theft by ShinyHunters via Salesloft Drift tokens, Shai-Hulud NPM supply chain worm, and Chrome zero-day CVE-2025-10585.
  110. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
  111. The Workday CRM breach, unpatched N-able N-central servers under active exploitation, and RansomExx's PipeMagic backdoor abusing a Windows flaw.
  112. The Allianz Life Salesforce data theft, unpatched Citrix NetScaler CitrixBleed 2 exposure, and the Charon ransomware campaign against Middle East public sector …
  113. The Bouygues Telecom breach of 6.4 million customers, the Salesforce vishing campaign tied to ShinyHunters, and the CISA-mandated patch for Exchange …
  114. Google Salesforce data breach by ShinyHunters, DaVita ransomware notice to over 1 million people, and WhatsApp removing 6.8 million scam-centre accounts.
  115. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  116. Co-op's 6.5M member data theft, UNFI's up to $400M sales hit and Louis Vuitton breaches tied to ShinyHunters.
  117. Play ransomware breached about 900 organizations, Lee Enterprises disclosed a breach of ~40,000 people, and Cisco ISE CVE-2025-20120 auth bypass patched.