{ "type": "bundle", "id": "bundle--434e53b6-e2cc-4f00-b93b-1c94bf02b005", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.476891Z", "modified": "2026-10-01T19:54:20.476891Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--b0cc2f56-5c61-5c99-86d5-a844a89701bb", "value": "91.215.43.200" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1e96dc3e-a201-586c-a57b-2d344b893ce3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.47739Z", "modified": "2026-10-01T19:54:20.47739Z", "name": "ipv4: 91.215.43.200", "description": "shinyhunte.rs identity-page origin; AS57724 DDoS-Guard (Russia)", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.215.43.200']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 95 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--85585027-108d-5823-87aa-f7482165e252", "value": "91.215.85.22" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57e9b5ea-6509-56d5-8a98-ba6b3f553142", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.480131Z", "modified": "2026-10-01T19:54:20.480131Z", "name": "ipv4: 91.215.85.22", "description": "ShinyHunters DLS clearnet host; nginx/1.22.1; AS200593 PROSPERO OOO (Russia bulletproof hosting)", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.215.85.22']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 95 }, { "type": "url", "spec_version": "2.1", "id": "url--a8efc53b-5ed1-5770-ad9e-73064fb8d911", "value": "http://91.215.85.22/pay_or_leak/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--334aa285-19b3-5633-87ae-20cb154dec1e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.480568Z", "modified": "2026-10-01T19:54:20.480568Z", "name": "url: http://91.215.85.22/pay_or_leak/", "description": "Primary victim-dump directory (nginx autoindex)", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://91.215.85.22/pay_or_leak/']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 95 }, { "type": "url", "spec_version": "2.1", "id": "url--d151e72f-ae01-586f-a2c7-e796da422dba", "value": "http://91.215.85.22/pay_or_leak/INFORMATION.txt" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4af72e9c-223c-502e-aefe-662a0ee3aff8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.481242Z", "modified": "2026-10-01T19:54:20.481242Z", "name": "url: http://91.215.85.22/pay_or_leak/INFORMATION.txt", "description": "Ransom-note URL", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://91.215.85.22/pay_or_leak/INFORMATION.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 95 }, { "type": "url", "spec_version": "2.1", "id": "url--a1fb9f46-66e0-5a22-874c-8cb621988ccd", "value": "https://pastebin.com/raw/sb7aB9eU" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d848fd1c-47f9-5b7a-8277-2cc71c636c4e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.481741Z", "modified": "2026-10-01T19:54:20.481741Z", "name": "url: https://pastebin.com/raw/sb7aB9eU", "description": "PGP-key mirror referenced in signed rotation messages | pastebin.com is a shared-service domain; block only this specific raw-paste URL, not pastebin.com wholesale", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://pastebin.com/raw/sb7aB9eU']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--9935facd-f07c-510f-8214-3531539662f9", "value": "https://shinyhunte.rs/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--031c3154-8923-5ae5-ac36-a04a5793041a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.482241Z", "modified": "2026-10-01T19:54:20.482241Z", "name": "url: https://shinyhunte.rs/", "description": "ShinyHunters identity page (current: PGP rotation announcement)", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://shinyhunte.rs/']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 95 }, { "type": "url", "spec_version": "2.1", "id": "url--c4730001-9c33-5dbe-8320-2023146876f6", "value": "https://shinyhunte.rs/newpgp" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d7a63bf4-db56-5e57-b166-ab7e323698cb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.482602Z", "modified": "2026-10-01T19:54:20.482602Z", "name": "url: https://shinyhunte.rs/newpgp", "description": "Published location of current PGP key (currently 404 at origin; archive.org preserves)", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://shinyhunte.rs/newpgp']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--55c8bc3b-747f-5faf-ace6-62501724eac1", "value": "pro-spero.ru" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--88e9262a-21c5-5858-8697-d9bd060ca835", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.483146Z", "modified": "2026-10-01T19:54:20.483146Z", "name": "domain: pro-spero.ru", "description": "PROSPERO OOO operator domain; RIPE abuse-contact root", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'pro-spero.ru']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 95 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--f194d404-fa16-5700-bf0f-fa53f817e82d", "value": "shinyhunte.rs" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--31d0fe4a-98c8-5e9a-b93b-b42731d8bc14", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.483667Z", "modified": "2026-10-01T19:54:20.483667Z", "name": "domain: shinyhunte.rs", "description": "ShinyHunters identity / PGP-key rotation landing page; DDoS-Guard-fronted", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'shinyhunte.rs']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-17T00:00:00Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 95 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--86d9bf1e-f6bb-5f30-bf82-141d2c4a17ca", "value": "ns1.ddos-guard.net" }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--0ded23c6-0cee-5010-8651-3fb5bfb86087", "value": "ns2.ddos-guard.net" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--db177dd3-3823-541f-ba0d-1adfaf07b99e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.487741Z", "modified": "2026-10-11T07:42:16.529569Z", "name": "MALW_ShinyHunters_RansomNote", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Yara Rule Set\n Identifier: ShinyHunters DLS — Ransom Note and Identity Artifacts\n Author: The Hunters Ledger\n Source: https://the-hunters-ledger.com/\n License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule MALW_ShinyHunters_RansomNote {\n meta:\n description = \"Detects the ShinyHunters Data Leak Site ransom note (INFORMATION.txt) by one of two verbatim phrases (the DLS download sentence or the leaked-because-the-victim-did-not-pay sentence) together with one of three .onion mirror addresses or the pay_or_leak path token, as served from every directory of the actor's leak site and so present in downloaded leak archives; a match is a copy of the note text, which also sits in researcher copies and write-ups, and is not by itself evidence that this host's data was exfiltrated\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"cec16fca-e975-5ff5-9802-824fd6b03228\"\n strings:\n $s1 = \"This file has been downloaded from the ShinyHunters Data Leak Site (DLS)\" ascii\n $s2 = \"leaked on the ShinyHunters DLS because the victim did not pay a ransom\" ascii\n $s3 = \"shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd.onion\" ascii\n $s4 = \"shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion\" ascii\n $s5 = \"toolatedhs5dtr2pv6h5kdraneak5gs3sxrecqhoufc5e45edior7mqd.onion\" ascii\n $s6 = \"pay_or_leak\" ascii\n condition:\n filesize < 500KB and\n ($s1 or $s2) and\n (1 of ($s3, $s4, $s5) or $s6)\n}", "pattern_type": "yara", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5797fc71-1164-5c97-83a3-35ca9881119c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.487864Z", "modified": "2026-10-01T19:54:20.487864Z", "name": "MALW_ShinyHunters_TauntFilename", "indicator_types": [ "malicious-activity" ], "pattern": "rule MALW_ShinyHunters_TauntFilename {\n meta:\n description = \"Detects ShinyHunters actor-branded taunt filename patterns embedded in archive names and forensic file-path artifacts (browser download history, LNK targets, directory-listing exports); the naming convention has held across 25+ distinct victim-dump archives on this DLS\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"b056e217-9545-585c-9439-a1c113a03b93\"\n strings:\n $s1 = \"shouldve_paid_the_ransom\" nocase ascii wide\n $s2 = \"should_have_paid_the_ransom\" nocase ascii wide\n $s3 = \"pay_the_ransom_next_time\" nocase ascii wide\n $s4 = \"didnt_pay_the_ransom\" nocase ascii wide\n $s5 = \"you_shouldve_paid\" nocase ascii wide\n $actor = \"shinyhunters\" nocase ascii wide\n condition:\n filesize < 10MB and\n $actor and\n 1 of ($s1, $s2, $s3, $s4, $s5)\n}", "pattern_type": "yara", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f4f3b9ff-cfd2-597b-afc7-670ffffbfe8d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.48796Z", "modified": "2026-10-01T19:54:20.48796Z", "name": "MALW_ShinyHunters_PGP_Identity", "indicator_types": [ "malicious-activity" ], "pattern": "rule MALW_ShinyHunters_PGP_Identity {\n meta:\n description = \"Detects ShinyHunters actor-identity documents where the shinyhunte.rs domain and the self-styled 'Scattered LAPSUS$ Hunters' collective name co-occur, indicating direct contact with DLS actor identity material such as PGP key exports or signed statements; individual PGP fingerprint matching was removed since a single fingerprint invalidates on each key rotation (see the campaign IOC feed for exact-match fingerprint lookups)\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"6c559875-8b0e-55ff-a177-c98927430cb8\"\n strings:\n $domain = \"shinyhunte.rs\" ascii\n $collective = \"Scattered LAPSUS$ Hunters\" ascii\n condition:\n filesize < 200KB and\n $domain and $collective\n}", "pattern_type": "yara", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5f6554f3-5bdd-505f-b876-be9d45b926c1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488043Z", "modified": "2026-10-11T06:31:48.254611Z", "name": "MALW_ShinyHunters_DLS_HTML", "indicator_types": [ "malicious-activity" ], "pattern": "rule MALW_ShinyHunters_DLS_HTML {\n meta:\n description = \"Detects ShinyHunters clearnet identity page (shinyhunte.rs) HTML artifacts by one of two page-title strings together with at least one of the PGP URL path, the main .onion mirror address or the /pay_or_leak/ path; intended for threat-intel collection review, proxy-cache hunting, and CASB alerting rather than production endpoint blocking\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\"\n date = \"2026-04-17\"\n family = \"ShinyHunters-DLS\"\n malware_type = \"Extortion/DLS\"\n campaign = \"ShinyHunters-DLS-91.215.85.22-20260417\"\n id = \"ae8d24ef-9ee5-5611-9165-f27338ffde7a\"\n strings:\n $s1 = \"Scattered LAPSUS$ Hunters | DLS\" ascii\n $s2 = \"ShinyHunters Data Leak Site\" ascii\n $s3 = \"shinyhunte.rs/newpgp\" ascii\n $s4 = \"shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd\" ascii\n $s5 = \"/pay_or_leak/\" ascii\n condition:\n filesize < 2MB and\n ($s1 or $s2) and\n 1 of ($s3, $s4, $s5)\n}", "pattern_type": "yara", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e6fda706-60fb-5586-ac05-ed8904b01dc9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488121Z", "modified": "2026-10-01T19:54:20.488121Z", "name": "ShinyHunters DLS — Web Proxy Hit on DLS Content Path", "indicator_types": [ "malicious-activity" ], "pattern": "title: ShinyHunters DLS — Web Proxy Hit on DLS Content Path\nid: f9426448-3e1b-402e-8a1a-996b06c73be0\nstatus: experimental\ndescription: >-\n Detects HTTP proxy requests containing the ShinyHunters DLS\n content-directory path (/pay_or_leak/) or ransom-note filename\n (INFORMATION.txt). These path tokens are specific to the DLS\n web-application structure and remain valid even if the underlying\n hosting IP or domain rotates. A hit from an internal host indicates\n retrieval of ransom materials following extortion contact or active\n exfiltration confirmation by a threat actor using a compromised\n endpoint.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.exfiltration\n - attack.impact\n - attack.t1657\n - attack.t1485\n - detection.emerging-threats\nlogsource:\n category: proxy\ndetection:\n selection:\n cs-uri-stem|contains:\n - '/pay_or_leak/'\n - 'INFORMATION.txt'\n condition: selection\nfalsepositives:\n - Threat intelligence analysts or security researchers manually retrieving DLS content for analysis\n - Automated threat-intel crawler services indexing extortion infrastructure\n - A coincidentally-named INFORMATION.txt on an unrelated internal or third-party web application\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--49c8a353-a9ec-5f12-80d0-d13836c2080b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488197Z", "modified": "2026-10-01T19:54:20.488197Z", "name": "ShinyHunters DLS — Salesforce Bulk Export OAuth App Authorization", "indicator_types": [ "malicious-activity" ], "pattern": "title: ShinyHunters DLS — Salesforce Bulk Export OAuth App Authorization\nid: 8bee360b-081a-4cf0-8448-07d7eb18d84e\nstatus: experimental\ndescription: >-\n Detects Salesforce OAuth connected-application authorizations\n involving DataLoader or DataExporter family app names. The\n ShinyHunters 2026 campaign used vishing to convince helpdesk to\n authorize Salesforce bulk-export OAuth apps, enabling mass CRM data\n exfiltration across 28+ confirmed victims. Targets Salesforce Shield\n Event Monitoring logs (ConnectedApp event type). Note: the native\n Salesforce DataLoader application is filtered; alerts fire on\n third-party or unrecognized DataLoader variants.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\n - https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_endpoints.htm\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.credential-access\n - attack.collection\n - attack.t1528\n - attack.t1213\n - detection.emerging-threats\nlogsource:\n product: salesforce\n service: event_monitoring\ndetection:\n selection:\n EventType: 'ConnectedApp'\n AppName|contains:\n - 'DataLoader'\n - 'DataExporter'\n - 'DataImporter'\n - 'Bulk API'\n filter_known_good:\n AppName|contains: 'Salesforce DataLoader'\n condition: selection and not filter_known_good\nfalsepositives:\n - Legitimate use of Salesforce Data Loader by authorized administrators performing data migrations\n - ETL pipeline integrations using Salesforce Bulk API with app names matching these patterns\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--19e9f2bd-5226-5e85-9207-87446ffb003d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488271Z", "modified": "2026-10-01T19:54:20.488271Z", "name": "ShinyHunters DLS — Okta MFA Factor Deactivation or Unexpected Enrollment", "indicator_types": [ "malicious-activity" ], "pattern": "title: ShinyHunters DLS — Okta MFA Factor Deactivation or Unexpected Enrollment\nid: ef025d6d-d54d-4db3-87b8-a255895ebafd\nstatus: experimental\ndescription: >-\n Detects Okta MFA factor deactivation or new factor enrollment events\n matching the ShinyHunters vishing TTP: threat actors impersonate\n employees to convince IT support to reset MFA\n (user.mfa.factor.deactivate), then enroll an actor-controlled\n authenticator device (user.mfa.factor.activate). Fires on either\n event individually — MFA resets and enrollments are routine IT\n operations, so this rule is a scoping lead for manual, time-windowed\n correlation review rather than a standalone alert. Correlate both\n event types by target user ID within a 30-minute window before\n escalating.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.credential-access\n - attack.persistence\n - attack.privilege-escalation\n - attack.initial-access\n - attack.t1566.004\n - attack.t1528\n - attack.t1098\n - detection.emerging-threats\nlogsource:\n product: okta\n service: system_log\ndetection:\n selection_reset:\n eventType: 'user.mfa.factor.deactivate'\n selection_enroll:\n eventType: 'user.mfa.factor.activate'\n condition: selection_reset or selection_enroll\nfalsepositives:\n - Legitimate employee MFA resets followed by self-enrollment on a new device\n - IT administrators assisting users with routine device replacement\n - Bulk MFA enrollment during onboarding campaigns\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--55e860b7-9fa6-5d06-ad26-dc85a0ec624b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488345Z", "modified": "2026-10-01T19:54:20.488345Z", "name": "ShinyHunters DLS — PROSPERO Bulletproof Hosting CIDR Range Access", "indicator_types": [ "malicious-activity" ], "pattern": "title: ShinyHunters DLS — PROSPERO Bulletproof Hosting CIDR Range Access\nid: 5a0f622b-3b12-4811-a857-0eaed858017c\nstatus: experimental\ndescription: >-\n Detects network connections to PROSPERO AS200593 IP prefixes\n associated with ShinyHunters DLS infrastructure and co-hosted\n extortion campaigns. These CIDR blocks are bulletproof-hosting\n ranges shared by multiple threat-actor operations beyond\n ShinyHunters. A lower-fidelity, context-dependent indicator —\n enrich with destination reputation and correlate with other\n ShinyHunters indicators before actioning.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-17\ntags:\n - attack.command-and-control\n - attack.resource-development\n - attack.t1583.003\n - attack.t1090.003\n - detection.emerging-threats\nlogsource:\n product: firewall\ndetection:\n selection:\n DestinationIp|cidr:\n - '91.215.85.0/24'\n - '91.202.233.0/24'\n - '193.24.123.0/24'\n condition: selection\nfalsepositives:\n - Legitimate services co-hosted on PROSPERO AS200593 — shared bulletproof hosting environment where other tenants may include unrelated or lower-risk operations\n - Threat intelligence platform automated scanning of known malicious ranges\nlevel: low", "pattern_type": "sigma", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--803e1ca2-38a5-5852-a30d-b2e3fbaaf9f9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488418Z", "modified": "2026-10-09T13:20:12.728943Z", "name": "THL DETECT ShinyHunters DLS - HTTP Request to DLS Content Path pay_or_leak", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT ShinyHunters DLS - HTTP Request to DLS Content Path pay_or_leak\"; flow:established,to_server; http.uri; content:\"/pay_or_leak/\"; reference:url,the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/; classtype:trojan-activity; threshold:type limit,track by_src,count 1,seconds 300; sid:9300103; rev:3; metadata:author The_Hunters_Ledger, date 2026-04-17, attack_target Client_Endpoint, mitre_tactic_id TA0040, mitre_technique_id T1657;)", "pattern_type": "suricata", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--11d8f295-70d5-5d07-b159-7adfe1cfa658", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488491Z", "modified": "2026-10-01T19:54:20.488491Z", "name": "THL HUNT ShinyHunters DLS - HTTP Host Header shinyhunte.rs", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT ShinyHunters DLS - HTTP Host Header shinyhunte.rs\"; flow:established,to_server; http.host; content:\"shinyhunte.rs\"; endswith; reference:url,the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/; classtype:trojan-activity; sid:9001001; rev:2; metadata:author The_Hunters_Ledger, date 2026-04-17, attack_target Client_Endpoint, mitre_tactic_id TA0011, mitre_technique_id T1583.001;)", "pattern_type": "suricata", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c529d344-80c2-5f51-830b-4e365eeccd9b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488565Z", "modified": "2026-10-09T13:20:12.72919Z", "name": "THL HUNT ShinyHunters DLS - TLS SNI shinyhunte.rs", "indicator_types": [ "malicious-activity" ], "pattern": "alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT ShinyHunters DLS - TLS SNI shinyhunte.rs\"; flow:established,to_server; tls.sni; content:\"shinyhunte.rs\"; endswith; nocase; reference:url,the-hunters-ledger.com/hunting-detections/shinyhunters-dls-91-215-85-22-20260417-detections/; classtype:trojan-activity; sid:9300102; rev:2; metadata:author The_Hunters_Ledger, date 2026-04-17, attack_target Client_Endpoint, mitre_tactic_id TA0011, mitre_technique_id T1583.001;)", "pattern_type": "suricata", "valid_from": "2026-04-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488645Z", "modified": "2026-10-01T19:54:20.488645Z", "name": "ShinyHunters", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488719Z", "modified": "2026-10-01T19:54:20.488719Z", "name": "Scattered LAPSUS$ Hunters 2026 cluster", "is_family": true, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8e773df3-b3cc-54bd-83db-4028fe946d79", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488793Z", "modified": "2026-10-01T19:54:20.488793Z", "name": "Financial Theft", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1657", "external_id": "T1657" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--40b34036-0c2f-5429-b133-afcd52bb880c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488909Z", "modified": "2026-10-01T19:54:20.488909Z", "name": "Phishing: Spearphishing Voice (vishing)", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1566/004", "external_id": "T1566.004" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d1d66d90-5aa7-5866-9753-179f8e1fdc18", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.488998Z", "modified": "2026-10-01T19:54:20.488998Z", "name": "Supply Chain Compromise: Compromise Software Supply Chain", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1195/002", "external_id": "T1195.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f04532fb-150d-5d27-99b3-5392af504899", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489081Z", "modified": "2026-10-01T19:54:20.489081Z", "name": "Steal Application Access Token", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1528", "external_id": "T1528" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1076c468-8982-548b-9292-726a22f83ecb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489165Z", "modified": "2026-10-01T19:54:20.489165Z", "name": "Unsecured Credentials: Credentials In Files", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/001", "external_id": "T1552.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e42939d6-6332-5a6c-8dac-6195c79081bc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489245Z", "modified": "2026-10-01T19:54:20.489245Z", "name": "Data from Information Repositories", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1213", "external_id": "T1213" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cda30ca1-c824-539f-932b-fb0809cbd444", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489323Z", "modified": "2026-10-01T19:54:20.489323Z", "name": "Data from Cloud Storage", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1530", "external_id": "T1530" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ed69c65f-7bc6-5a49-accd-759abe8c1c1b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489398Z", "modified": "2026-10-01T19:54:20.489398Z", "name": "Exfiltration Over Web Service: to Cloud Storage", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1567/002", "external_id": "T1567.002" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489478Z", "modified": "2026-10-01T19:54:20.489478Z", "name": "Proxy: Multi-hop Proxy (Tor mirrors)", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1090/003", "external_id": "T1090.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d81b46ce-ef63-5c04-a945-180b77ff6da7", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489555Z", "modified": "2026-10-01T19:54:20.489555Z", "name": "Acquire Infrastructure: Domains", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1583/001", "external_id": "T1583.001" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5b7a06ed-32c6-5260-95a8-8e82d3f41f1f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489631Z", "modified": "2026-10-01T19:54:20.489631Z", "name": "Acquire Infrastructure: VPS (bulletproof hosting)", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1583/003", "external_id": "T1583.003" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2897b2f1-408a-5653-857f-ba8d519a3780", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489708Z", "modified": "2026-10-01T19:54:20.489708Z", "name": "Data Destruction (adversary-side leak as punitive impact)", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1485", "external_id": "T1485" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--ea0cf03e-e0b2-5f37-abfe-bbecb74785e3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.489791Z", "modified": "2026-10-01T19:54:20.489791Z", "name": "shinyhunters-dls-91-215-85-22-20260417 infrastructure", "infrastructure_types": [ "command-and-control", "hosting" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--27b51760-2c35-5a7f-8362-52f56a195571", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490232Z", "modified": "2026-10-01T19:54:20.490232Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--8e773df3-b3cc-54bd-83db-4028fe946d79", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5352c2f4-8a1b-5c40-824a-ef22ac4ee753", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490318Z", "modified": "2026-10-01T19:54:20.490318Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--40b34036-0c2f-5429-b133-afcd52bb880c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--594f2b8e-ee39-579d-b877-38f32f4f4541", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490387Z", "modified": "2026-10-01T19:54:20.490387Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--d1d66d90-5aa7-5866-9753-179f8e1fdc18", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da0e2159-c0d0-5838-9c6b-e57de250f097", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490451Z", "modified": "2026-10-01T19:54:20.490451Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--f04532fb-150d-5d27-99b3-5392af504899", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ab3144a-bf20-5a46-a3c6-5be731aca57d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490513Z", "modified": "2026-10-01T19:54:20.490513Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--1076c468-8982-548b-9292-726a22f83ecb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--20a4d845-eea7-5452-be86-ec5956840ff3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490573Z", "modified": "2026-10-01T19:54:20.490573Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--e42939d6-6332-5a6c-8dac-6195c79081bc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58059be1-7984-5c90-b1e1-20c4b805bc96", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490634Z", "modified": "2026-10-01T19:54:20.490634Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--cda30ca1-c824-539f-932b-fb0809cbd444", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e03f5773-f720-5ae4-8786-d1488cfcbcfe", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490694Z", "modified": "2026-10-01T19:54:20.490694Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--ed69c65f-7bc6-5a49-accd-759abe8c1c1b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--189e2eea-cf34-5294-9af9-999c7e19de6b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490754Z", "modified": "2026-10-01T19:54:20.490754Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--59da7c4e-7e2c-5f17-91ff-584b0dbe282b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490819Z", "modified": "2026-10-01T19:54:20.490819Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--d81b46ce-ef63-5c04-a945-180b77ff6da7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--63aa7746-121b-5a65-979a-cc45d17014cb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.490879Z", "modified": "2026-10-01T19:54:20.490879Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--5b7a06ed-32c6-5260-95a8-8e82d3f41f1f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c464e416-d77a-57ea-8215-ea2b4972da5c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.49094Z", "modified": "2026-10-01T19:54:20.49094Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "attack-pattern--2897b2f1-408a-5653-857f-ba8d519a3780", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--287f29d8-aea5-5216-bccf-fc7a68a07464", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491Z", "modified": "2026-10-01T19:54:20.491Z", "relationship_type": "uses", "source_ref": "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "target_ref": "infrastructure--ea0cf03e-e0b2-5f37-abfe-bbecb74785e3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f28125e3-5d46-5299-8422-4ef0848fd15e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491064Z", "modified": "2026-10-01T19:54:20.491064Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--8e773df3-b3cc-54bd-83db-4028fe946d79", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5a2aac12-2470-5cc5-9b0d-9f56ea56c26b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491124Z", "modified": "2026-10-01T19:54:20.491124Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--40b34036-0c2f-5429-b133-afcd52bb880c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7449024c-67de-5a34-a66d-f7c2404dc2a9", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491183Z", "modified": "2026-10-01T19:54:20.491183Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--d1d66d90-5aa7-5866-9753-179f8e1fdc18", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ef3b6e3e-3225-5f25-b7b7-6d393a7e9eae", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491242Z", "modified": "2026-10-01T19:54:20.491242Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--f04532fb-150d-5d27-99b3-5392af504899", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3d1fa1ca-c6b2-5e76-a95a-6be0803c7348", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491301Z", "modified": "2026-10-01T19:54:20.491301Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--1076c468-8982-548b-9292-726a22f83ecb", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4ed35bff-3c5c-5acc-9293-d382020bd1bf", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491361Z", "modified": "2026-10-01T19:54:20.491361Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--e42939d6-6332-5a6c-8dac-6195c79081bc", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc014b6c-1d93-5750-9af2-1813a5986d2a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.49142Z", "modified": "2026-10-01T19:54:20.49142Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--cda30ca1-c824-539f-932b-fb0809cbd444", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--465a65c3-b69d-5d80-b6a5-6919f7f182ff", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491479Z", "modified": "2026-10-01T19:54:20.491479Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--ed69c65f-7bc6-5a49-accd-759abe8c1c1b", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b54d3d0d-62e4-57a7-b991-000df7aa31e5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491538Z", "modified": "2026-10-01T19:54:20.491538Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0f3e5117-d669-5659-b9c9-e7f761349c43", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.4916Z", "modified": "2026-10-01T19:54:20.4916Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--d81b46ce-ef63-5c04-a945-180b77ff6da7", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ec65e27-538e-5076-909a-8f3ae9cdf18a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491659Z", "modified": "2026-10-01T19:54:20.491659Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--5b7a06ed-32c6-5260-95a8-8e82d3f41f1f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8142fcf-c61b-5ff4-b9a1-a3287f91d78d", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491717Z", "modified": "2026-10-01T19:54:20.491717Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "attack-pattern--2897b2f1-408a-5653-857f-ba8d519a3780", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99d7fc30-ddda-5464-b0d0-afbd759d0a8c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.491777Z", "modified": "2026-10-01T19:54:20.491777Z", "relationship_type": "uses", "source_ref": "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "target_ref": "infrastructure--ea0cf03e-e0b2-5f37-abfe-bbecb74785e3", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--5ff1b5a0-5d02-5631-a253-1a04ccb6db3a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.49186Z", "modified": "2026-10-01T19:54:20.49186Z", "name": "ShinyHunters Data Leak Site at 91.215.85.22 — Infrastructure, Victims, and Attribution", "report_types": [ "threat-report" ], "published": "2026-04-17T00:00:00Z", "object_refs": [ "ipv4-addr--b0cc2f56-5c61-5c99-86d5-a844a89701bb", "indicator--1e96dc3e-a201-586c-a57b-2d344b893ce3", "ipv4-addr--85585027-108d-5823-87aa-f7482165e252", "indicator--57e9b5ea-6509-56d5-8a98-ba6b3f553142", "url--a8efc53b-5ed1-5770-ad9e-73064fb8d911", "indicator--334aa285-19b3-5633-87ae-20cb154dec1e", "url--d151e72f-ae01-586f-a2c7-e796da422dba", "indicator--4af72e9c-223c-502e-aefe-662a0ee3aff8", "url--a1fb9f46-66e0-5a22-874c-8cb621988ccd", "indicator--d848fd1c-47f9-5b7a-8277-2cc71c636c4e", "url--9935facd-f07c-510f-8214-3531539662f9", "indicator--031c3154-8923-5ae5-ac36-a04a5793041a", "url--c4730001-9c33-5dbe-8320-2023146876f6", "indicator--d7a63bf4-db56-5e57-b166-ab7e323698cb", "domain-name--55c8bc3b-747f-5faf-ace6-62501724eac1", "indicator--88e9262a-21c5-5858-8697-d9bd060ca835", "domain-name--f194d404-fa16-5700-bf0f-fa53f817e82d", "indicator--31d0fe4a-98c8-5e9a-b93b-b42731d8bc14", "domain-name--86d9bf1e-f6bb-5f30-bf82-141d2c4a17ca", "domain-name--0ded23c6-0cee-5010-8651-3fb5bfb86087", "indicator--db177dd3-3823-541f-ba0d-1adfaf07b99e", "indicator--5797fc71-1164-5c97-83a3-35ca9881119c", "indicator--f4f3b9ff-cfd2-597b-afc7-670ffffbfe8d", "indicator--5f6554f3-5bdd-505f-b876-be9d45b926c1", "indicator--e6fda706-60fb-5586-ac05-ed8904b01dc9", "indicator--49c8a353-a9ec-5f12-80d0-d13836c2080b", "indicator--19e9f2bd-5226-5e85-9207-87446ffb003d", "indicator--55e860b7-9fa6-5d06-ad26-dc85a0ec624b", "indicator--803e1ca2-38a5-5852-a30d-b2e3fbaaf9f9", "indicator--11d8f295-70d5-5d07-b159-7adfe1cfa658", "indicator--c529d344-80c2-5f51-830b-4e365eeccd9b", "malware--9f4260d7-9f11-52f2-ad26-814dac3b4afa", "malware--baca93a4-3ee5-57ca-9a08-8af8d3cd445e", "attack-pattern--8e773df3-b3cc-54bd-83db-4028fe946d79", "attack-pattern--40b34036-0c2f-5429-b133-afcd52bb880c", "attack-pattern--d1d66d90-5aa7-5866-9753-179f8e1fdc18", "attack-pattern--f04532fb-150d-5d27-99b3-5392af504899", "attack-pattern--1076c468-8982-548b-9292-726a22f83ecb", "attack-pattern--e42939d6-6332-5a6c-8dac-6195c79081bc", "attack-pattern--cda30ca1-c824-539f-932b-fb0809cbd444", "attack-pattern--ed69c65f-7bc6-5a49-accd-759abe8c1c1b", "attack-pattern--c4d23a10-7ecd-543e-af65-13160caed625", "attack-pattern--d81b46ce-ef63-5c04-a945-180b77ff6da7", "attack-pattern--5b7a06ed-32c6-5260-95a8-8e82d3f41f1f", "attack-pattern--2897b2f1-408a-5653-857f-ba8d519a3780", "infrastructure--ea0cf03e-e0b2-5f37-abfe-bbecb74785e3", "relationship--27b51760-2c35-5a7f-8362-52f56a195571", "relationship--5352c2f4-8a1b-5c40-824a-ef22ac4ee753", "relationship--594f2b8e-ee39-579d-b877-38f32f4f4541", "relationship--da0e2159-c0d0-5838-9c6b-e57de250f097", "relationship--1ab3144a-bf20-5a46-a3c6-5be731aca57d", "relationship--20a4d845-eea7-5452-be86-ec5956840ff3", "relationship--58059be1-7984-5c90-b1e1-20c4b805bc96", "relationship--e03f5773-f720-5ae4-8786-d1488cfcbcfe", "relationship--189e2eea-cf34-5294-9af9-999c7e19de6b", "relationship--59da7c4e-7e2c-5f17-91ff-584b0dbe282b", "relationship--63aa7746-121b-5a65-979a-cc45d17014cb", "relationship--c464e416-d77a-57ea-8215-ea2b4972da5c", "relationship--287f29d8-aea5-5216-bccf-fc7a68a07464", "relationship--f28125e3-5d46-5299-8422-4ef0848fd15e", "relationship--5a2aac12-2470-5cc5-9b0d-9f56ea56c26b", "relationship--7449024c-67de-5a34-a66d-f7c2404dc2a9", "relationship--ef3b6e3e-3225-5f25-b7b7-6d393a7e9eae", "relationship--3d1fa1ca-c6b2-5e76-a95a-6be0803c7348", "relationship--4ed35bff-3c5c-5acc-9293-d382020bd1bf", "relationship--fc014b6c-1d93-5750-9af2-1813a5986d2a", "relationship--465a65c3-b69d-5d80-b6a5-6919f7f182ff", "relationship--b54d3d0d-62e4-57a7-b991-000df7aa31e5", "relationship--0f3e5117-d669-5659-b9c9-e7f761349c43", "relationship--1ec65e27-538e-5076-909a-8f3ae9cdf18a", "relationship--c8142fcf-c61b-5ff4-b9a1-a3287f91d78d", "relationship--99d7fc30-ddda-5464-b0d0-afbd759d0a8c" ], "labels": [ "Exfil", "Cred Theft", "Open Dir", "Threat" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }