ShinyHunters Wage Broad Corporate Extortion Spree

A cybercriminal group known as ShinyHunters has launched a broad extortion campaign, threatening to publish data stolen from dozens of Fortune 500 firms if victims do not pay, after siphoning what the piece describes as data from Salesforce customers earlier in the year. The attackers have tied a new extortion site to UNC6040 and claim responsibility for a Discord data breach and for stealing terabytes from Red Hat customer data via a GitLab server.

According to Google Threat Intelligence Group (GTIG), ShinyHunters was extorting victims over stolen Salesforce data and was poised to publish a data leak site to shame victim companies into paying. The Octo ber reports include Red Hat confirming a compromised GitLab server and Discord emailing users affected by a separate breach, with the group asserting it will publish data unless ransom demands are met by 10 October.

Separately, Oracle has acknowledged a zero‑day, CVE‑2025‑61882, exploited in August 2025 to access Oracle E‑Business Suite, with Mandiant noting the vulnerability’s use by the Clop gang. In the legal and enforcement arena, prosecutors in the U.K. have charged Scattered Spider members in relation to extortion campaigns, while other individuals linked to Scattered Spider and LAPSUS$ are facing U.S. charges for related intrusions.