Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Guidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS Introduction Mandiant is tracking a significant expansion and escalation in the operations of threat clusters associated with ShinyHunters-branded extortion. As detailed in our companion report, 'Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft' , these campaigns leverage evolved voice phishing (vishing) and victim-branded credential harves…

https://cloud.google.com/blog/topics/threat-intelligence/defense-against-shinyhunters-cybercrime-saas

sha256:88405b8a77335a760b15fe65e154297255b4b592a45236782f187f727746ad62

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url0
ipv40
ipv60
sha10
domain71
sha2560
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	e.network.http	Open →
domain	e.target.application	Open →
domain	e.target.file	Open →
domain	re.capture	Open →
domain	strings.coalesce	Open →
domain	e.additional.fields	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports