On Tuesday, the cyber extortion group ShinyHunters publicly claimed it had compromised the U.S. Federal Bureau of Investigation, asserting it holds "very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job." As of this writing, the FBI has not confirmed a breach, and the claim remains unverified — a critical caveat we will return to. But even if this specific claim turns out to be exaggerated or fabricated, the defensive lessons are immediate and concrete.
ShinyHunters is not an opportunistic ransomware outfit. It is one of the most operationally mature data theft and extortion groups active in 2025–2026, responsible for the Snowflake customer data theft campaign, multiple Salesforce/Salesloft-connected intrusions, and a long string of SaaS-environment compromises built on stolen credentials, infostealer logs, and voice phishing. Their tradecraft is consistent, observable, and — critically — detectable before data leaves your environment.
Whether you protect a federal agency, a healthcare system, or a mid-market enterprise, the exposure model is identical: a trove of sensitive PII sitting in a SaaS application or database, reachable by a single set of stolen credentials without MFA. This post breaks down how ShinyHunters operates and gives your SOC concrete detections for their playbook.
Technical Analysis
The Threat Actor: ShinyHunters
ShinyHunters has operated since at least 2020 and has evolved from a data-broker crew selling stolen databases on criminal forums into a disciplined extortion operation. Key characteristics of their 2024–2026 campaigns:
- Initial access via stolen credentials, not exploits. Their hallmark campaigns (Snowflake in 2024, the Salesforce ecosystem intrusions in 2025) leveraged credentials harvested by infostealer malware months or years earlier. They do not burn zero-days when a $50 infostealer log gets them in.
- Targeting SaaS and cloud data stores at scale. Rather than deploying ransomware on endpoints, they authenticate directly to SaaS platforms (Snowflake, Salesforce, cloud databases) and run bulk queries/exports.
- Social engineering and vishing. The 2025 Salesforce campaign involved voice phishing employees into authorizing malicious connected apps or granting OAuth access, bypassing MFA-protected login flows entirely.
- Extortion without encryption. ShinyHunters monetizes via direct extortion and dark-web sales, often threatening publication of PII to maximize reputational pressure — exactly the pattern in this FBI claim.
The FBI Claim: What We Know and Don't Know
The group posted its claim on its dark web leak site, asserting possession of data on current and former employees and job applicants. No CVE is associated with this claim, and no technical intrusion details have been published. Three plausible scenarios exist:
- Direct compromise of an FBI system or connected contractor. Law enforcement data has repeatedly been exposed via third-party vendors — recall the 2023 D.C. Metropolitan Police leak via Babuk and prior FBI National Academy Associates data exposures.
- Data sourced from a third party or prior breach re-branded. Extortion groups routinely re-aggregate previously breached data and claim a fresh intrusion for leverage and notoriety.
- An outright fabricated claim. Groups like ShinyHunters have both real and exaggerated claims in their history; claiming "the FBI" generates enormous media attention regardless of veracity.
Defensive takeaway: Treat unverified claims about your organization as an incident until proven otherwise. The absence of a CVE or technical writeup does not mean the absence of risk — it means your detection must be behavior-based, not indicator-based.
The Attack Chain Defenders Must Detect
Because ShinyHunters' intrusions are credential- and SaaS-centric, the observable chain typically looks like this:
- Credential acquisition — infostealer infection on an endpoint, or vishing an employee into an adversary-in-the-middle (AiTM) phishing page or OAuth consent grant.
- Authentication to SaaS/cloud platform — often from unusual geographies, ASNs, or residential proxy/VPN infrastructure, frequently with legacy or non-MFA auth paths.
- Reconnaissance of the data store — enumeration of tables, objects, reports, or file repositories.
- Bulk query/export — large
SELECToperations, Salesforce bulk API jobs, SnowflakeCOPY INTOto external stage, or mass file downloads. - Exfiltration — data staged to attacker-controlled cloud storage (Mega, Backblaze, S3-compatible endpoints) or exfiltrated via the SaaS platform's own export mechanisms.
- Extortion — contact from the group, a leak-site post, or a public claim.
Every step before extortion is detectable. The organizations that learned this the hard way in the Snowflake campaign almost universally lacked MFA and lacked monitoring on bulk data access.
Detection & Response
The detections below target the behavioral core of the ShinyHunters playbook: credential theft on endpoints, anomalous SaaS/cloud authentication, and bulk data export/exfiltration. They are tuned to minimize noise — each requires multiple corroborating conditions before firing at high severity.
Sigma Rules
---
title: Mass Archive Creation Followed by Outbound Transfer Utility
tid: 550d9a23-0f72-4e3a-a8c5-9c2f7b1a3d01
status: experimental
description: Detects creation of compressed archives by built-in utilities followed within a short window by execution of common exfiltration tools (rclone, curl to file hosts), consistent with data staging before SaaS-extortion style exfiltration.
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.collection
- attack.exfiltration
- attack.t1560.001
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_archiver:
Image|endswith:
- '\rar.exe'
- '\7z.exe'
- '\7za.exe'
- '\winrar.exe'
CommandLine|contains:
- ' a '
- ' -a'
selection_exfil_tool:
Image|endswith:
- '\rclone.exe'
- '\megacmd.exe'
- '\curl.exe'
- '\wget.exe'
filter_admin_paths:
Image|startswith:
- 'C:\Program Files\Backup'
condition: selection_archiver and selection_exfil_tool and not filter_admin_paths
falsepositives:
- Legitimate backup and software packaging workflows; baseline backup windows and service accounts
level: high
---
title: Suspicious OAuth or Consent Grant Activity via Office Tooling Followed by Bulk Download
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects execution of scripting interpreters with parameters consistent with Salesforce/Snowflake bulk API abuse or data export utilities, a pattern used in ShinyHunters-adjacent SaaS data theft campaigns.
references:
- https://attack.mitre.org/techniques/T1218/
- https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.collection
- attack.t1530
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_interpreter:
Image|endswith:
- '\python.exe'
- '\pythonw.exe'
- '\powershell.exe'
- '\pwsh.exe'
selection_export_keywords:
CommandLine|contains:
- 'bulk api'
- 'bulkapi'
- 'COPY INTO @'
- 'sobjects/query'
- '/services/data/'
- 'queryAll'
filter_known_tools:
CommandLine|contains:
- 'chocolatey'
- 'sccm'
condition: selection_interpreter and selection_export_keywords and not filter_known_tools
falsepositives:
- Legitimate data engineering and ETL pipelines; whitelist approved service accounts and job hosts
level: high
---
title: Infostealer-Style Credential Store Access
tid: 9b2e4d17-6c83-4a21-bf90-4d7e2c8a5f19
status: experimental
description: Detects non-browser processes reading browser credential stores (Login Data, Cookies, Web Data), a common infostealer behavior that seeds the credential sets later used in SaaS extortion intrusions.
references:
- https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.credential_access
- attack.t1555.003
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- '\AppData\Local\Google\Chrome\User Data\'
- '\AppData\Local\Microsoft\Edge\User Data\'
- '\AppData\Roaming\Mozilla\Firefox\Profiles\'
selection_file:
TargetFilename|endswith:
- '\Login Data'
- '\Cookies'
- '\Web Data'
- '\logins.json'
filter_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
condition: selection_path and selection_file and not filter_browsers
falsepositives:
- Enterprise password managers and some EDR/backup agents; whitelist known binaries by hash
level: high
KQL (Microsoft Sentinel / Defender)
This hunt identifies SaaS-style bulk exfiltration patterns observable at the endpoint and network layers: a single device making high-volume outbound connections to consumer file-hosting or cloud storage infrastructure, combined with recent archive-tool execution — the staging-and-exfil pattern used in credential-based data theft campaigns.
let FileHosts = dynamic(["mega.nz", "mega.co.nz", "backblazeb2.com", "r2.dev", "wasabisys.com", "file.io", "transfer.sh", "anonfiles.com", "gofile.io"]);
let Window = 2h;
let ArchiveProcs =
DeviceProcessEvents
| where TimeGenerated > ago(Window)
| where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winrar.exe")
or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Compress-Archive"))
| project DeviceId, DeviceName, ArchiveTime=TimeGenerated, ProcessCommandLine;
let ExfilNet =
DeviceNetworkEvents
| where TimeGenerated > ago(Window)
| where RemoteUrl has_any (FileHosts) or RemoteUrl has "amazonaws.com"
| summarize TotalConnections=count(), DistinctHosts=dcount(RemoteUrl), Hosts=make_set(RemoteUrl) by DeviceId, DeviceName;
ArchiveProcs
| join kind=inner ExfilNet on DeviceId
| where TotalConnections > 25
| project DeviceName, ArchiveTime, ProcessCommandLine, TotalConnections, Hosts
| order by TotalConnections desc;
For authentication anomalies against SaaS platforms (ingested via Syslog/CEF from IdPs or CASB), hunt for successful authentications from unusual ASNs or countries followed by bulk export API verbs:
let Window = 24h;
CommonSecurityLog
| where TimeGenerated > ago(Window)
| where DeviceVendor in~ ("Okta", "Salesforce", "Snowflake", "Microsoft") or DeviceProduct has_any ("Salesforce", "Snowflake", "Okta")
| where Message has_any ("queryAll", "bulk", "COPY INTO", "export", "reportExport", "/services/data/")
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URIs=make_set(RequestURL) by SourceUserID, SourceIP, DeviceProduct
| where Events > 50
| order by Events desc;
Velociraptor VQL
Use this artifact to sweep endpoints for evidence of browser credential store access by non-browser processes (infostealer staging) and recently created large archives in user-writable directories — the two most common pre-exfiltration artifacts in credential-driven theft campaigns.
-- Hunt for infostealer credential-store access and staged exfiltration archives
LET browser_stores = SELECT FullPath, Size, Mtime,
parse_pe(file=FullPath) AS PE
FROM glob(globs=[
'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Login Data',
'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Login Data',
'C:/Users/*/AppData/Roaming/Mozilla/Firefox/Profiles/*/logins.json'
])
WHERE Mtime > now() - 86400*7
LET staged_archives = SELECT FullPath, Size, Mtime
FROM glob(globs=[
'C:/Users/*/AppData/Local/Temp/*.zip',
'C:/Users/*/AppData/Local/Temp/*.rar',
'C:/Users/*/AppData/Local/Temp/*.7z',
'C:/Users/*/Downloads/*.7z'
])
WHERE Size > 100000000 AND Mtime > now() - 86400*3
LET suspicious_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(rclone|megacmd|Compress-Archive|queryAll|COPY INTO|/services/data/)'
SELECT * FROM chain(a=browser_stores, b=staged_archives, c=suspicious_procs)
Remediation Script
This PowerShell script audits a Windows estate for the highest-risk preconditions of a ShinyHunters-style intrusion: infostealer credential-store exposure indicators, unsanctioned exfiltration tooling, and large staged archives. Run via your EDR/remote tooling across endpoints and servers.
#Requires -RunAsAdministrator
# ShinyHunters-Style Data Theft Readiness Audit - Security Arsenal
$report = @()
# 1. Check for unsanctioned exfiltration/sync tooling
$exfilTools = @('rclone.exe','megacmd.exe','winscp.exe','filezilla.exe')
foreach ($tool in $exfilTools) {
$found = Get-ChildItem -Path 'C:\Users' -Recurse -Filter $tool -ErrorAction SilentlyContinue | Select-Object -First 5
foreach ($f in $found) {
$report += [PSCustomObject]@{Check='ExfilTool'; Finding=$f.FullName; Risk='High'}
}
}
# 2. Detect large recently-created archives in user temp/download paths (staging)
$cutoff = (Get-Date).AddDays(-3)
$stagingPaths = @('C:\Users\*\AppData\Local\Temp','C:\Users\*\Downloads')
foreach ($p in $stagingPaths) {
Get-ChildItem -Path $p -Include *.zip,*.rar,*.7z -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Length -gt 100MB -and $_.CreationTime -gt $cutoff } |
ForEach-Object { $report += [PSCustomObject]@{Check='StagedArchive'; Finding="$($_.FullName) ($([math]::Round($_.Length/1MB))MB)"; Risk='High'} }
}
# 3. Verify LSA protection and WDigest (credential-theft hardening)
$lsa = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'RunAsPPL' -ErrorAction SilentlyContinue
if (-not $lsa -or $lsa.RunAsPPL -ne 1) {
$report += [PSCustomObject]@{Check='LSAProtection'; Finding='RunAsPPL not enabled - credential dumping exposure'; Risk='Medium'}
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'RunAsPPL' -Value 1 -Force
$report += [PSCustomObject]@{Check='LSAProtection'; Finding='RunAsPPL ENABLED (reboot required)'; Risk='Remediated'}
}
$wdigest = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name 'UseLogonCredential' -ErrorAction SilentlyContinue
if ($wdigest -and $wdigest.UseLogonCredential -ne 0) {
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest' -Name 'UseLogonCredential' -Value 0 -Force
$report += [PSCustomObject]@{Check='WDigest'; Finding='UseLogonCredential set to 0 (plaintext cred caching disabled)'; Risk='Remediated'}
}
$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\DataTheftReadinessAudit.csv" -NoTypeInformation
Write-Output "Audit complete. Results saved to $env:TEMP\DataTheftReadinessAudit.csv"
Remediation
There is no patch for this threat — it is a tradecraft problem, not a software flaw. Defensive priorities, in order:
-
Enforce phishing-resistant MFA on every SaaS and cloud data platform. The Snowflake campaign succeeded almost entirely because MFA was absent. Require FIDO2/security keys for administrators and any user with bulk-export privileges; disable legacy authentication paths entirely. Audit conditional access policies for gaps (service accounts, API clients, VPN exclusions).
-
Audit and restrict bulk data access. In Salesforce: monitor and alert on bulk API jobs, report exports, and connected-app authorizations. In Snowflake: alert on
COPY INTOto external stages and largeSELECTresult sets; enforce network policies restricting connections to known IP ranges. Apply least-privilege to export-capable roles. -
Hunt your identity provider logs now. Query IdP/CASB logs for the past 90 days for: successful logins from unusual countries or ASNs (especially residential proxies and known VPN exits), OAuth consent grants to unfamiliar connected apps, and any session-token reuse. Assume credentials from infostealer logs are already in circulation — ShinyHunters has used credentials harvested years earlier.
-
Force-rotate credentials with infostealer exposure. Subscribe to infostealer-log monitoring (your threat intel provider, Hudson Rock-style feeds, or dark-web monitoring) and immediately reset any corporate credential appearing in a stealer log, revoking active sessions at the IdP.
-
Treat extortion claims as incidents, not noise. If a group claims your organization's data: stand up your IR retainer, verify by validating any sample data against known sources, check for third-party/contractor exposure, preserve logs before they roll, and engage legal counsel on notification obligations early. Do not pay; payment to extortion groups funds the next campaign and provides no assurance of deletion.
-
Harden endpoints against credential theft. Enable LSA Protection (script above), deploy EDR with credential-theft detection, restrict browser password storage via policy, and move users to enterprise password managers so browser credential stores hold nothing of value.
If You Suspect You're Already Compromised
Contain first: revoke all active sessions and OAuth tokens at the IdP for affected accounts, disable suspicious connected apps, and block the exfiltration destinations at the proxy. Then scope: enumerate every data object the compromised identity could access, and determine what was actually read or exported — SaaS audit logs (Salesforce Event Monitoring, Snowflake Access History) are your ground truth. Do not wipe or rebuild anything until forensics has preserved the evidence needed for attribution and regulatory reporting.
The ShinyHunters FBI claim may or may not survive scrutiny. But the model — stolen credentials, unmonitored SaaS, bulk export, public extortion — is the single most consistently successful data-theft playbook of the past two years. If your detection strategy still assumes attackers need malware on your endpoints to steal your data, it is already out of date.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.