Cybercrime Alliances: ShinyHunters and Scattered Spider Collaborate in Targeted Extortion Campaigns
August 12, 2025
Cybercrime / Financial Security
Recent developments reveal an alarming partnership in the cybercrime landscape, as the notorious groups ShinyHunters and Scattered Spider are joining forces to escalate extortion attacks specifically targeting businesses, including Salesforce customers. This collaboration signifies a significant evolution in the tactics employed by ShinyHunters, previously known for credential theft and database exploitation. According to a report by ReliaQuest, the shift in strategy indicates a new level of sophistication as the group integrates methods reminiscent of Scattered Spider’s operations.
The joint campaign appears poised to extend beyond its current focus on Salesforce clientele, with financial services and technology service providers potentially becoming the next targets. The collaboration has notably incorporated advanced techniques such as vishing—voice phishing—which employs social engineering tactics that exploit trust. The attackers are reportedly using counterfeit applications that mimic legitimate services to deceive victims. Moreover, they have integrated Okta-themed phishing pages designed to surreptitiously capture user credentials during these vishing calls, further enhancing their effectiveness.
This partnership underscores a worrying trend where cybercriminals are leveraging more refined approaches that blur the lines between traditional hacking methods and psychological manipulation. By adopting VPN obfuscation tactics, the groups aim to mask their data exfiltration processes, complicating detection efforts for organizations seeking to safeguard their sensitive information.
ShinyHunters, which emerged onto the cybercrime scene in 2020, is predominantly driven by financial motivations and has previously executed numerous high-profile data breaches targeting prominent organizations. The group’s adaptations could signify a wider shift in how extortion attacks are being executed across sectors.
Cybersecurity experts emphasize that organizations must remain vigilant against these emerging threats, especially as this collaboration is likely to yield even more sophisticated attacks. Drawing from the MITRE ATT&CK framework, potential adversary tactics employed in these attacks may include initial access through vishing, employing persistence techniques via compromised credentials, and privilege escalation to gain further access to sensitive systems.
The broadening scope of victim targeting—from Salesforce users to financial and tech service providers—raises immediate concerns for business owners regarding their cybersecurity posture. With such consortia evolving in the cybercrime ecosystem, organizations must enhance their defenses by educating employees about social engineering risks and investing in robust security measures to thwart these complex attacks.
As these threats continue to develop, the collaboration between ShinyHunters and Scattered Spider exemplifies the necessity for proactive cybersecurity strategies. Companies are urged to stay informed about the latest cyber threats and implement comprehensive protective measures to mitigate the risk of falling victim to such collaborative extortion campaigns.