Bling Libra’s Tactical Evolution: The Threat Actor Group Behind Shiny Hunters Ransomware
Summary: In a Unit 42 incident response engagement, the group Bling Libra, behind ShinyHunters ransomware, used AWS credentials found in a sensitive file exposed on the internet to enter an organization's AWS environment, where the credentials carried the AmazonS3FullAccess policy. The group ran discovery API calls, waited almost a month, then used WinSCP to view S3 buckets, deleted a handful of buckets, created new buckets named with variations of contact-shinycorp-tutanota-com-# within ten minutes, and sent an extortion email giving the victim one week to pay. Unit 42 reports that in 2024 the group shifted from selling stolen data to extorting victims and targeting cloud environments.
What you should know: CloudTrail S3 data logging and S3 server access logging were not enabled, so no logs existed showing what left the S3 buckets, and the ransom note's proof of data access was not specific enough to determine it. The group's one-week payment deadline arrived with the organization unable to establish from its own logs what data was taken.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026