Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft Introduction Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-branded extortion operations. These operations primarily leverage sophisticated voice phishing (vishing) and victim-branded credential harvesting sites to gain initial access to corporate environments by obtaining single sign-on (SSO) cred…

https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft

sha256:b14b156d956dacce560fc1091c53dea89b93265629457b6bfa76160bf29f1c14

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url5
ipv419
ipv60
sha10
domain33
sha2560
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	example.com	Open →
ip	76.64.54.159	Open →
ip	73.135.228.98	Open →
ip	149.50.97.144	Open →
ip	24.242.93.122	Open →
ip	23.234.100.107	Open →
ip	23.234.100.235

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports