Google Cloud analysts have uncovered a significant escalation in activity linked to the ShinyHunters threat group, which is now using sophisticated social engineering and extortion methods against organizations’ cloud-based systems.
Attack Overview
- Threat Actor: ShinyHunters, tracked under clusters UNC6661, UNC6671, UNC6240.
- Primary Tactics:
- Voice phishing (vishing): Attackers impersonate IT staff over phone calls.
- Credential harvesting websites: Fake portals mimicking corporate login pages.
- Social engineering: Trick employees into entering single sign-on (SSO) credentials and MFA codes.
- Target Platforms: Expanded to include SharePoint, Salesforce, DocuSign, Slack, Google Workspace.
- Impact: Theft of sensitive corporate data → extortion demands.
Attack Mechanism
- Initial Access:
- Register fake domains (e.g., companynamesso.com, companynameinternal.com).
- Direct employees to fraudulent login portals via phone calls.
- Credential Capture:
- Steal SSO credentials and MFA codes.
- Register attacker-controlled authentication devices for persistence.
- Data Theft:
- Search cloud apps for sensitive terms: “confidential,” “internal,” “proposal,” “vpn”.
- Extract documents and communications.
- Stealth:
- Use tools like ToogleBox Recall to delete security notification emails in Google Workspace.
- Extortion:
- Send ransom emails demanding Bitcoin payments within 72 hours.
- Provide stolen data samples via file-sharing platforms to prove compromise.
- Aggressive Tactics:
- Harassment of employees.
- Denial-of-service (DoS) attacks against victim websites.
Key Observations
- No software vulnerabilities exploited – attacks rely entirely on human manipulation + technical deception.
- Persistence achieved by registering new authentication devices once credentials are stolen.
- Escalation in aggressiveness – harassment and DoS added to extortion playbook.
Defensive Recommendations
- Authentication Hardening:
- Adopt phishing-resistant MFA (FIDO2 security keys, passkeys).
- Avoid SMS or push-based MFA, which can be socially engineered.
- Domain Monitoring:
- Watch for lookalike domains impersonating corporate portals.
- Employee Awareness:
- Train staff to recognize vishing attempts and fraudulent login prompts.
- Cloud Security Controls:
- Monitor for unauthorized device registrations.
- Audit logs for suspicious deletions of security notifications.
- Incident Response:
- Rotate credentials immediately after suspected compromise.
- Isolate affected accounts and review cloud data access patterns.
Takeaway
ShinyHunters’ expansion shows how social engineering remains one of the most effective attack vectors. By combining voice phishing, fake portals, and persistence tactics, they bypass traditional defenses and directly exploit human trust. Organizations must shift toward phishing-resistant authentication and proactive monitoring to defend against this evolving extortion threat.
Leave a Reply