ShinyHunters Escalates Vishing Attacks to Steal SaaS Data

Google’s Mandiant security researchers are observing a surge in vishing attacks attributed to the ShinyHunters group and other associated threat clusters. These attacks, which have been active since at least last month, utilize sophisticated voice phishing tactics and credential harvesting sites to gain access to corporate environments. The attackers exploit stolen single sign-on (SSO) and multifactor authentication (MFA) codes to target software-as-a-service (SaaS) applications, exfiltrating sensitive data and internal communications.

The researchers are tracking three threat clusters: UNC6240 (ShinyHunters), UNC6661, and UNC6671, as they investigate how these groups may be interconnected. The attacks have expanded in scope, with ShinyHunters recently announcing the theft of 14 million records containing sensitive information from Panera Bread customers. This escalation in extortion tactics includes harassment of victim personnel, indicating a more aggressive approach.

Silent Push has also reported a massive identity-theft campaign targeting Okta SSO and other platforms across over 100 high-value enterprises. The tactics used in this campaign mirror those of an alliance between ShinyHunters and other threat groups, highlighting the human-led nature of these operations designed to bypass even robust MFA setups.

Recent reports indicate that custom phishing kits have been adapted for vishing campaigns, targeting major platforms like Google, Microsoft, and Okta. This adaptation raises concerns about the evolving nature of these attacks, as they become increasingly sophisticated and tailored to exploit vulnerabilities in identity providers.

The ShinyHunters group has shifted its tactics to compromise identity platforms through vishing-based SSO attacks, which have become a hallmark of their operations. This shift demonstrates that even strong security measures can be vulnerable to human-focused exploits, leading to significant risks for organizations.

Implications for Organizations

Organizations must be aware that these attacks are not merely isolated incidents but part of a broader strategy to collect ammunition for future attacks. The theft of personally identifiable information (PII) from millions of users can lead to new phishing attacks and further exploitation.

Companies should monitor for suspicious activity related to their SSO and MFA systems and educate employees about the risks of vishing. The tactics employed by groups like ShinyHunters reveal the importance of maintaining robust security practices and being vigilant against social engineering attempts.

• ShinyHunters: A cybercrime group known for extortion and data theft, recently involved in stealing records from Panera Bread.
• UNC6240: The designation for the ShinyHunters threat cluster tracked by Mandiant.
• UNC6661: Another threat cluster involved in vishing attacks, impersonating IT staff to harvest credentials.
• UNC6671: A threat group similar to UNC6661, using different tactics for credential harvesting and extortion.