{ "Event": { "uuid": "6f667981-4451-5004-a851-e42a3420ab88", "info": "ShinyHunters Data Leak Site (91.215.85.22)", "date": "2026-04-17", "threat_level_id": 1, "analysis": 2, "timestamp": 1791704589, "publish_timestamp": 1791704589, "published": true, "Orgc": { "name": "The Hunters Ledger", "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d" }, "Tag": [ { "name": "tlp:clear", "colour": "#ffffff" }, { "name": "hunters-ledger:topic=\"Exfil\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Cred Theft\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Open Dir\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Threat\"", "colour": "#58a6ff" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Data from Cloud Storage - T1530\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Voice - T1566.004\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Financial Theft - T1657\"", "colour": "#0088cc" } ], "Attribute": [ { "uuid": "272d8d4f-2cc4-5e26-bf0e-909d59b4b3a4", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "to_ids": false, "comment": "Detection rules, The Hunters Ledger", "timestamp": 1791704589 }, { "uuid": "cf771e83-06fe-5707-8828-abea9c26809c", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/ioc-feeds/shinyhunters-dls-91-215-85-22-20260417-iocs.json", "to_ids": false, "comment": "IOC feed (JSON), The Hunters Ledger", "timestamp": 1791704589 }, { "uuid": "54f453ec-e16f-5040-856c-78dce2d08de8", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/", "to_ids": false, "comment": "Report, The Hunters Ledger", "timestamp": 1791704589 }, { "uuid": "f3399819-dcb3-543c-a8ff-c7ed681d8292", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/stix/shinyhunters-dls-91-215-85-22-20260417.json", "to_ids": false, "comment": "STIX 2.1 bundle, The Hunters Ledger", "timestamp": 1791704589 }, { "uuid": "62423354-58b1-5fa3-93e5-047e98022501", "type": "domain", "category": "Network activity", "value": "pro-spero.ru", "to_ids": true, "comment": "domain: pro-spero.ru. PROSPERO OOO operator domain; RIPE abuse-contact root [confidence 95/100]", "timestamp": 1791704589 }, { "uuid": "b51ed262-fc42-5c78-9580-cd4fa3d2fcf1", "type": "domain", "category": "Network activity", "value": "shinyhunte.rs", "to_ids": true, "comment": "domain: shinyhunte.rs. ShinyHunters identity / PGP-key rotation landing page; DDoS-Guard-fronted [confidence 95/100]", "timestamp": 1791704589 }, { "uuid": "af2ff2f7-2595-5913-a408-2340e9318a28", "type": "url", "category": "Network activity", "value": "http://91.215.85.22/pay_or_leak/", "to_ids": true, "comment": "url: http://91.215.85.22/pay_or_leak/. Primary victim-dump directory (nginx autoindex) [confidence 95/100]", "timestamp": 1791704589 }, { "uuid": "774d900e-9a44-53cc-a268-2af97b540e45", "type": "url", "category": "Network activity", "value": "http://91.215.85.22/pay_or_leak/INFORMATION.txt", "to_ids": true, "comment": "url: http://91.215.85.22/pay_or_leak/INFORMATION.txt. Ransom-note URL [confidence 95/100]", "timestamp": 1791704589 }, { "uuid": "a16afa9a-5824-5a6a-bad1-a1261666d324", "type": "url", "category": "Network activity", "value": "https://pastebin.com/raw/sb7aB9eU", "to_ids": true, "comment": "url: https://pastebin.com/raw/sb7aB9eU. PGP-key mirror referenced in signed rotation messages | pastebin.com is a shared-service domain; block only this specific raw-paste URL, not pastebin.com wholesale [confidence 80/100]", "timestamp": 1791704589 }, { "uuid": "aaf6a059-762b-5d56-9b1e-8720e81b90fa", "type": "url", "category": "Network activity", "value": "https://shinyhunte.rs/", "to_ids": true, "comment": "url: https://shinyhunte.rs/. ShinyHunters identity page (current: PGP rotation announcement) [confidence 95/100]", "timestamp": 1791704589 }, { "uuid": "a05dbeee-2e59-517f-9982-0b159031a48e", "type": "url", "category": "Network activity", "value": "https://shinyhunte.rs/newpgp", "to_ids": true, "comment": "url: https://shinyhunte.rs/newpgp. Published location of current PGP key (currently 404 at origin; archive.org preserves) [confidence 80/100]", "timestamp": 1791704589 }, { "uuid": "3a519f6f-f13c-5fb7-b3f1-564ac07d7169", "type": "ip-dst", "category": "Network activity", "value": "91.215.43.200", "to_ids": true, "comment": "ipv4: 91.215.43.200. shinyhunte.rs identity-page origin; AS57724 DDoS-Guard (Russia) [confidence 95/100]", "timestamp": 1791704589 }, { "uuid": "e82ce7c7-f0e8-565e-afe6-c3d4889f2052", "type": "ip-dst", "category": "Network activity", "value": "91.215.85.22", "to_ids": true, "comment": "ipv4: 91.215.85.22. ShinyHunters DLS clearnet host; nginx/1.22.1; AS200593 PROSPERO OOO (Russia bulletproof hosting) [confidence 95/100]", "timestamp": 1791704589 }, { "uuid": "9fee3b9c-aca1-59b0-8a2a-4985137d876c", "type": "snort", "category": "Network activity", "value": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT ShinyHunters DLS - HTTP Request to DLS Content Path pay_or_leak\"; flow:established,to_server; http.uri; content:\"/pay_or_leak/\"; reference:url,the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/; classtype:trojan-activity; threshold:type limit,track by_src,count 1,seconds 300; sid:9300103; rev:3; metadata:author The_Hunters_Ledger, date 2026-04-17, attack_target Client_Endpoint, mitre_tactic_id TA0040, mitre_technique_id T1657;)", "to_ids": true, "comment": "ShinyHunters DLS: HTTP Request to DLS Content Path (pay_or_leak) | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1657 | rule hash 1d469b69 | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "3073d1f7-0bb9-5f87-886d-5a6d3fade440", "type": "snort", "category": "Network activity", "value": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT ShinyHunters DLS - HTTP Host Header shinyhunte.rs\"; flow:established,to_server; http.host; content:\"shinyhunte.rs\"; endswith; reference:url,the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/; classtype:trojan-activity; sid:9001001; rev:2; metadata:author The_Hunters_Ledger, date 2026-04-17, attack_target Client_Endpoint, mitre_tactic_id TA0011, mitre_technique_id T1583.001;)", "to_ids": false, "comment": "ShinyHunters DLS: HTTP Host Header shinyhunte.rs | TIER: Hunting | robustness 1 | confidence HIGH | ATT&CK T1583.001, T1657 | rule hash f34860e7 | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "fb5a2e6a-f215-55a6-8187-2d897a8b52cd", "type": "snort", "category": "Network activity", "value": "alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT ShinyHunters DLS - TLS SNI shinyhunte.rs\"; flow:established,to_server; tls.sni; content:\"shinyhunte.rs\"; endswith; nocase; reference:url,the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/; classtype:trojan-activity; sid:9300102; rev:2; metadata:author The_Hunters_Ledger, date 2026-04-17, attack_target Client_Endpoint, mitre_tactic_id TA0011, mitre_technique_id T1583.001;)", "to_ids": false, "comment": "ShinyHunters DLS: TLS SNI shinyhunte.rs | TIER: Hunting | robustness 1 | confidence HIGH | ATT&CK T1583.001, T1657 | rule hash 4663cb77 | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "64b66faf-de22-5591-87aa-e0c4cc67189f", "type": "sigma", "category": "Payload installation", "value": "title: ShinyHunters DLS — Okta MFA Factor Deactivation or Unexpected Enrollment\nid: ef025d6d-d54d-4db3-87b8-a255895ebafd\nstatus: experimental\ndescription: >-\n Detects Okta MFA factor deactivation or new factor enrollment events\n matching the ShinyHunters vishing TTP: threat actors impersonate\n employees to convince IT support to reset MFA\n (user.mfa.factor.deactivate), then enroll an actor-controlled\n authenticator device (user.mfa.factor.activate). Fires on either\n event individually — MFA resets and enrollments are routine IT\n operations, so this rule is a scoping lead for manual, time-windowed\n correlation review rather than a standalone alert. Correlate both\n event types by target user ID within a 30-minute window before\n escalating.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.credential-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.initial-access\n - attack.t1566.004\n - attack.t1528\n - attack.t1098\n - detection.emerging-threats\nlogsource:\n product: okta\n service: system_log\ndetection:\n selection_reset:\n eventType: 'user.mfa.factor.deactivate'\n selection_enroll:\n eventType: 'user.mfa.factor.activate'\n condition: selection_reset or selection_enroll\nfalsepositives:\n - Legitimate employee MFA resets followed by self-enrollment on a new device\n - IT administrators assisting users with routine device replacement\n - Bulk MFA enrollment during onboarding campaigns\nlevel: medium", "to_ids": false, "comment": "ShinyHunters DLS: Okta MFA Factor Deactivation or Unexpected Enrollment | TIER: Hunting | robustness 1 | confidence MODERATE — the individual events are common in legitimate IT operations; the detection value comes from correlating the two events by user within a time window, which standard Sigma syntax cannot express in one rule (see Coverage Gaps). | ATT&CK T1566.004, T1528, T1098 | rule hash 1c7f2a1f | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "aad916b0-20cf-59e7-97fe-ca754bd7505c", "type": "sigma", "category": "Payload installation", "value": "title: ShinyHunters DLS — PROSPERO Bulletproof Hosting CIDR Range Access\nid: 5a0f622b-3b12-4811-a857-0eaed858017c\nstatus: experimental\ndescription: >-\n Detects network connections to PROSPERO AS200593 IP prefixes\n associated with ShinyHunters DLS infrastructure and co-hosted\n extortion campaigns. These CIDR blocks are bulletproof-hosting\n ranges shared by multiple threat-actor operations beyond\n ShinyHunters. A lower-fidelity, context-dependent indicator —\n enrich with destination reputation and correlate with other\n ShinyHunters indicators before actioning.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.command-and-control\n - attack.resource-development\n - attack.t1583.003\n - attack.t1090.003\n - detection.emerging-threats\nlogsource:\n product: firewall\ndetection:\n selection:\n DestinationIp|cidr:\n - '91.215.85.0/24'\n - '91.202.233.0/24'\n - '193.24.123.0/24'\n condition: selection\nfalsepositives:\n - Legitimate services co-hosted on PROSPERO AS200593 — shared bulletproof hosting environment where other tenants may include unrelated or lower-risk operations\n - Threat intelligence platform automated scanning of known malicious ranges\nlevel: low", "to_ids": false, "comment": "ShinyHunters DLS: PROSPERO Bulletproof Hosting CIDR Range Access | TIER: Hunting | robustness 1 | confidence MODERATE — range-level indicator; specificity is lower than IP or domain indicators. | ATT&CK T1583.003, T1090.003 | rule hash 616ba6fa | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "443caff4-2d80-5c33-aa64-924cb6ca9562", "type": "sigma", "category": "Payload installation", "value": "title: ShinyHunters DLS — Salesforce Bulk Export OAuth App Authorization\nid: 8bee360b-081a-4cf0-8448-07d7eb18d84e\nstatus: experimental\ndescription: >-\n Detects Salesforce OAuth connected-application authorizations\n involving DataLoader or DataExporter family app names. The\n ShinyHunters 2026 campaign used vishing to convince helpdesk to\n authorize Salesforce bulk-export OAuth apps, enabling mass CRM data\n exfiltration across 28+ confirmed victims. Targets Salesforce Shield\n Event Monitoring logs (ConnectedApp event type). Note: the native\n Salesforce DataLoader application is filtered; alerts fire on\n third-party or unrecognized DataLoader variants.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\n - https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_endpoints.htm\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.credential-access\n - attack.collection\n - attack.t1528\n - attack.t1213\n - detection.emerging-threats\nlogsource:\n product: salesforce\n service: event_monitoring\ndetection:\n selection:\n EventType: 'ConnectedApp'\n AppName|contains:\n - 'DataLoader'\n - 'DataExporter'\n - 'DataImporter'\n - 'Bulk API'\n filter_known_good:\n AppName|contains: 'Salesforce DataLoader'\n condition: selection and not filter_known_good\nfalsepositives:\n - Legitimate use of Salesforce Data Loader by authorized administrators performing data migrations\n - ETL pipeline integrations using Salesforce Bulk API with app names matching these patterns\nlevel: medium", "to_ids": false, "comment": "ShinyHunters DLS: Salesforce Bulk Export OAuth App Authorization | TIER: Hunting | robustness 2 | confidence MODERATE — requires Salesforce Shield / Event Monitoring to be enabled; app-name matching depends on how third-party OAuth clients are registered. | ATT&CK T1528, T1213 | rule hash 015cf036 | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "f34460f8-2c8e-5ce3-949d-ddf501a8e6c9", "type": "sigma", "category": "Payload installation", "value": "title: ShinyHunters DLS — Web Proxy Hit on DLS Content Path\nid: f9426448-3e1b-402e-8a1a-996b06c73be0\nstatus: experimental\ndescription: >-\n Detects HTTP proxy requests containing the ShinyHunters DLS\n content-directory path (/pay_or_leak/) or ransom-note filename\n (INFORMATION.txt). These path tokens are specific to the DLS\n web-application structure and remain valid even if the underlying\n hosting IP or domain rotates. A hit from an internal host indicates\n retrieval of ransom materials following extortion contact or active\n exfiltration confirmation by a threat actor using a compromised\n endpoint.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.exfiltration\n - attack.impact\n - attack.t1657\n - attack.t1485\n - detection.emerging-threats\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-uri-stem|contains:\n - '/pay_or_leak/'\n - 'INFORMATION.txt'\n condition: selection\nfalsepositives:\n - Threat intelligence analysts or security researchers manually retrieving DLS content for analysis\n - Automated threat-intel crawler services indexing extortion infrastructure\n - A coincidentally-named INFORMATION.txt on an unrelated internal or third-party web application\nlevel: medium", "to_ids": false, "comment": "ShinyHunters DLS: Web Proxy Hit on DLS Content Path | TIER: Hunting | robustness 2 | confidence HIGH | ATT&CK T1657, T1485 | rule hash 8c59a140 | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "9ae6b372-e51e-5ae3-9a7c-df15f328053c", "type": "yara", "category": "Payload installation", "value": "/*\n Yara Rule Set\n Identifier: ShinyHunters DLS — Ransom Note and Identity Artifacts\n Author: The Hunters Ledger\n Source: https://the-hunters-ledger.com/\n License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule MALW_ShinyHunters_RansomNote {\n meta:\n description = \"Detects the ShinyHunters Data Leak Site ransom note (INFORMATION.txt) by one of two verbatim phrases (the DLS download sentence or the leaked-because-the-victim-did-not-pay sentence) together with one of three .onion mirror addresses or the pay_or_leak path token, as served from every directory of the actor's leak site and so present in downloaded leak archives; a match is a copy of the note text, which also sits in researcher copies and write-ups, and is not by itself evidence that this host's data was exfiltrated\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"cec16fca-e975-5ff5-9802-824fd6b03228\"\n strings:\n $s1 = \"This file has been downloaded from the ShinyHunters Data Leak Site (DLS)\" ascii\n $s2 = \"leaked on the ShinyHunters DLS because the victim did not pay a ransom\" ascii\n $s3 = \"shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion\" ascii\n $s4 = \"shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion\" ascii\n $s5 = \"toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion\" ascii\n $s6 = \"pay_or_leak\" ascii\n condition:\n filesize < 500KB and\n ($s1 or $s2) and\n (1 of ($s3, $s4, $s5) or $s6)\n}", "to_ids": true, "comment": "ShinyHunters DLS Ransom Note (INFORMATION.txt) | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1657, T1583.001 | rule hash f050e061 | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "4028a8a2-123f-5704-b074-f7b0024b988b", "type": "yara", "category": "Payload installation", "value": "rule MALW_ShinyHunters_DLS_HTML {\n meta:\n description = \"Detects ShinyHunters clearnet identity page (shinyhunte.rs) HTML artifacts by one of two page-title strings together with at least one of the PGP URL path, the main .onion mirror address or the /pay_or_leak/ path; intended for threat-intel collection review, proxy-cache hunting, and CASB alerting rather than production endpoint blocking\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"ae8d24ef-9ee5-5611-9165-f27338ffde7a\"\n strings:\n $s1 = \"Scattered LAPSUS$ Hunters | DLS\" ascii\n $s2 = \"ShinyHunters Data Leak Site\" ascii\n $s3 = \"shinyhunte.rs/newpgp\" ascii\n $s4 = \"shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd\" ascii\n $s5 = \"/pay_or_leak/\" ascii\n condition:\n filesize < 2MB and\n ($s1 or $s2) and\n 1 of ($s3, $s4, $s5)\n}", "to_ids": false, "comment": "ShinyHunters Clearnet Identity Page (shinyhunte.rs HTML) | TIER: Hunting | robustness 2 | confidence HIGH | ATT&CK T1583.001 | rule hash cd9251dd | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "069b67d9-8601-5f97-bee0-424e161a21d9", "type": "yara", "category": "Payload installation", "value": "rule MALW_ShinyHunters_PGP_Identity {\n meta:\n description = \"Detects ShinyHunters actor-identity documents where the shinyhunte.rs domain and the self-styled 'Scattered LAPSUS$ Hunters' collective name co-occur, indicating direct contact with DLS actor identity material such as PGP key exports or signed statements; individual PGP fingerprint matching was removed since a single fingerprint invalidates on each key rotation (see the campaign IOC feed for exact-match fingerprint lookups)\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"6c559875-8b0e-55ff-a177-c98927430cb8\"\n strings:\n $domain = \"shinyhunte.rs\" ascii\n $collective = \"Scattered LAPSUS$ Hunters\" ascii\n condition:\n filesize < 200KB and\n $domain and $collective\n}", "to_ids": false, "comment": "ShinyHunters Actor Identity: Domain + Collective Name | TIER: Hunting | robustness 2 | confidence HIGH | ATT&CK T1583.001, T1657 | rule hash 42131c6b | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "cf32d1ca-7adb-5d35-a1df-1bfd28ed6770", "type": "yara", "category": "Payload installation", "value": "rule MALW_ShinyHunters_TauntFilename {\n meta:\n description = \"Detects ShinyHunters actor-branded taunt filename patterns embedded in archive names and forensic file-path artifacts (browser download history, LNK targets, directory-listing exports); the naming convention has held across 25+ distinct victim-dump archives on this DLS\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"b056e217-9545-585c-9439-a1c113a03b93\"\n strings:\n $s1 = \"shouldve_paid_the_ransom\" nocase ascii wide\n $s2 = \"should_have_paid_the_ransom\" nocase ascii wide\n $s3 = \"pay_the_ransom_next_time\" nocase ascii wide\n $s4 = \"didnt_pay_the_ransom\" nocase ascii wide\n $s5 = \"you_shouldve_paid\" nocase ascii wide\n $actor = \"shinyhunters\" nocase ascii wide\n condition:\n filesize < 10MB and\n $actor and\n 1 of ($s1, $s2, $s3, $s4, $s5)\n}", "to_ids": true, "comment": "ShinyHunters Taunt-Filename Naming Convention | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1657, T1485 | rule hash dcfc4d58 | https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/", "timestamp": 1791704589, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] } ], "Object": [] } }