{"id":6143,"date":"2025-08-14T10:03:38","date_gmt":"2025-08-14T10:03:38","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/08\/14\/shinyhunters-possibly-collaborates-with-scattered-spider-in-salesforce-attack-campaigns\/"},"modified":"2025-08-14T10:03:38","modified_gmt":"2025-08-14T10:03:38","slug":"shinyhunters-possibly-collaborates-with-scattered-spider-in-salesforce-attack-campaigns","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/08\/14\/shinyhunters-possibly-collaborates-with-scattered-spider-in-salesforce-attack-campaigns\/","title":{"rendered":"ShinyHunters Possibly Collaborates With Scattered Spider in Salesforce Attack Campaigns"},"content":{"rendered":"

ShinyHunters Possibly Collaborates With Scattered Spider in Salesforce Attack Campaigns
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The notorious ShinyHunters cybercriminal group has emerged from a year-long hiatus with a sophisticated new wave of attacks targeting Salesforce platforms across major organizations, including high-profile victims like Google.<\/p>\n

This resurgence marks a significant tactical evolution for the financially motivated threat actors, who have traditionally focused on database exploitation and credential theft rather than the complex social engineering schemes now being employed.<\/p>\n

What makes this campaign particularly alarming is its striking resemblance to operations typically attributed to the Scattered Spider hacking collective.<\/p>\n

The convergence of tactics suggests a potential collaboration between these two formidable threat groups, raising concerns about an escalating landscape of coordinated cybercriminal activity.<\/p>\n

The attacks have specifically targeted organizations across retail, aviation, and insurance sectors, with victims spanning luxury brands and technology service providers.<\/p>\n

\n
\"\"
ShinyHunters first gained notoriety by advertising 91 million Tokopedia user records for sale on \u201cEmpire Market\u201d in 2020 (Source \u2013 Reliaquest)<\/figcaption><\/figure>\n<\/div>\n

ReliaQuest analysts identified<\/a> compelling evidence supporting this collaboration theory through comprehensive domain analysis and infrastructure investigation.<\/p>\n

The research revealed coordinated ticket-themed phishing domains and Salesforce credential harvesting pages, indicating a systematic approach to victim targeting.<\/p>\n

Most notably, investigators discovered the emergence of a BreachForums user with the alias \u201cSp1d3rhunters\u201d\u2014a clever combination of both group names\u2014who was linked to previous ShinyHunters breaches and appeared to leak Ticketmaster data in July 2024.<\/p>\n

The technical sophistication of these attacks represents a significant departure from ShinyHunters\u2019 historical methods.<\/p>\n

The group has adopted Scattered Spider<\/a>\u2018s signature techniques, including highly targeted vishing campaigns where attackers impersonate IT support staff to manipulate victims into authorizing malicious \u201cconnected apps.\u201d<\/p>\n

These applications masquerade as legitimate Salesforce tools while enabling large-scale data exfiltration.<\/p>\n

Advanced Infrastructure and Evasion Techniques<\/strong><\/h2>\n

The campaign\u2019s infrastructure reveals meticulous planning and advanced evasion capabilities.<\/p>\n

Investigators uncovered multiple malicious domains registered between June 20-30, 2025, following consistent naming patterns such as ticket-lvmh.com<\/code>, ticket-dior.com<\/code>, and ticket-louisvuitton.com<\/code>.<\/p>\n

These domains shared common registry characteristics, including registration through GMO Internet using temporary email addresses like email@mailshan.com<\/code> and Cloudflare-masked nameservers for additional obfuscation<\/a>.<\/p>\n

\n
\"\"
Okta phishing page hosted at ticket-dior[.]com in June 2025 (Source \u2013 Reliaquest)<\/figcaption><\/figure>\n<\/div>\n

The attackers deployed sophisticated phishing kits hosting single sign-on (SSO) login pages, with domains like dashboard-salesforce.com<\/code> actively serving Okta-branded credential harvesting interfaces.<\/p>\n

\n
\"\"
Phishing page hosted at dashboard-salesforce[.]com (Source \u2013 Reliaquest)<\/figcaption><\/figure>\n<\/div>\n

The malicious infrastructure leveraged VPN obfuscation through Mullvad VPN services to perform data exfiltration<\/a> from compromised Salesforce instances.<\/p>\n

Particularly concerning is the rebranding of legitimate Salesforce \u201cData Loader\u201d applications as \u201cMy Ticket Portal\u201d during vishing campaigns, demonstrating the group\u2019s ability to weaponize familiar business tools against unsuspecting employees.<\/p>\n

This tactical evolution, combined with the synchronized targeting patterns observed across both ShinyHunters and Scattered Spider operations, suggests that financial services and technology providers should prepare for intensified attacks in the coming months.<\/p>\n

Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n

The post ShinyHunters Possibly Collaborates With Scattered Spider in Salesforce Attack Campaigns<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

ShinyHunters Possibly Collaborates With Scattered Spider in Salesforce Attack Campaigns The notorious ShinyHunters cybercriminal group has emerged from a year-long hiatus with a sophisticated new wave of attacks targeting Salesforce platforms across major organizations, including high-profile victims like Google. This resurgence marks a significant tactical evolution for the financially motivated threat actors, who have traditionally […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6143","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6143"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6143"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6143\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}