{"id":219998,"date":"2025-08-13T04:15:25","date_gmt":"2025-08-13T09:15:25","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2025\/08\/cybercrime-groups-shinyhunters-scattered-spider-join-forces-in-extortion-attacks-on-businesses"},"modified":"2025-08-13T04:15:25","modified_gmt":"2025-08-13T09:15:25","slug":"cybercrime-groups-shinyhunters-scattered-spider-join-forces-in-extortion-attacks-on-businesses","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2025\/08\/cybercrime-groups-shinyhunters-scattered-spider-join-forces-in-extortion-attacks-on-businesses","title":{"rendered":"Cybercrime Groups ShinyHunters, Scattered Spider Join Forces in Extortion Attacks on Businesses"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/cybercrime-groups-shinyhunters-scattered-spider-join-forces-in-extortion-attacks-on-businesses2.jpg\"><\/a><\/p>\n<p>An ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show.<\/p>\n<p>\u201cThis latest wave of ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the group\u2019s previous credential theft and database exploitation,\u201d ReliaQuest <a href=\"https:\/\/reliaquest.com\/blog\/threat-spotlight-shinyhunters-data-breach-targets-salesforce-amid-scattered-spider-collaboration\/\" rel=\"noopener\" target=\"_blank\">said<\/a> in a report shared with The Hacker News.<\/p>\n<p>These include the use of adoption of tactics that mirror those of <a href=\"https:\/\/cyble.com\/blog\/scattered-spider-ransomware-in-2025-cyber-alert\/\" rel=\"noopener\" target=\"_blank\">Scattered Spider<\/a>, such as highly-targeted <a href=\"https:\/\/www.group-ib.com\/blog\/voice-deepfake-scams\/\" rel=\"noopener\" target=\"_blank\">vishing<\/a> (aka <a href=\"https:\/\/www.trellix.com\/blogs\/research\/the-growing-threat-of-vishing-how-cybercriminals-are-using-multimedia-to-target-you\/\" rel=\"noopener\" target=\"_blank\">voice phishing<\/a>) and social engineering attacks, leveraging apps that masquerade as legitimate tools, employing Okta-themed phishing pages to trick victims into entering credentials during vishing, and VPN obfuscation for data exfiltration.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show. \u201cThis latest wave of ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the group\u2019s previous credential theft and [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43,34,45],"tags":[],"class_list":["post-219998","post","type-post","status-publish","format-standard","hentry","category-business","category-cybercrime-malcode","category-finance"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/219998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=219998"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/219998\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=219998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=219998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=219998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}