Behind the Panels: Validating ShinyHunters Cluster A Infrastructure Through Network Telemetry

MITRE Techniques

• [T1566 ] Phishing – Used convincing login pages and lure domains to capture credentials and MFA by directing victims to brand-themed pages (‘the victim is typically directed to a domain that looks like an internal identity, support, passkey, or SSO page’).
• [T1656 ] Credentials Phishing – Captured enterprise identity credentials through fake identity/provider pages (‘voice phishing with adversary-in-the-middle credential capture’).
• [T1567.004 ] Exfiltration to Cloud Storage – The campaign aimed to steal access for SaaS environments such as Salesforce, SharePoint, Slack, and DocuSign (‘once credentials and MFA are captured, the operator can attempt to access identity providers and pivot into connected SaaS environments’).
• [T1583.001 ] Acquire Infrastructure: Domains – Registered numerous lure domains with victim-themed naming patterns (‘domains observed on 149.50.97.174… mydisneysso.com… myupennmanager.com…’).
• [T1583.004 ] Acquire Infrastructure: Server – Hosted phishing infrastructure on Mevspace AS201814 and related servers (‘Mevspace AS201814 as the hosting provider for Cluster A’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Delivered phishing content over HTTP/HTTPS and Cloudflare-fronted infrastructure (‘Cloudflare CDN peers… on ports 80 and 443’).
• [T1090.002 ] Proxy: External Proxy – Used Cloudflare as fronting infrastructure to gate victim traffic (‘traffic reaching Cloudflare-fronted lure infrastructure’).
• [T1036 ] Masquerading – Disguised domains as internal or trusted brand services (‘myyalemanager.com’, ‘amazoninternal.com’, and other victim-themed names).
• [T1078 ] Valid Accounts – The objective was to steal and reuse credentials for SaaS and identity access (‘Once credentials and MFA are captured, the operator can attempt to access identity providers’).