Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware

Date: 08/27/2024

Severity: Critical

Summary

During an incident response managed by Unit 42, the threat actor group Bling Libra (known for ShinyHunters ransomware) shifted from their usual method of selling or publishing stolen data to extorting victims. The engagement also revealed how the group obtains legitimate credentials from public repositories to gain initial access to an organization’s Amazon Web Services (AWS) environment.

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:

https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/#section-11-title