New ‘shinysp1d3r’ Ransomware-as-a-Service Targets VMware ESXi in Ongoing Development

New ‘shinysp1d3r’ is described as a ransomware-as-a-service (RaaS) network that is currently in development and is designed to encrypt VMware ESXi environments, according to EclecticIQ analysts. The firm notes that ShinyHunters may recruit new affiliates and broaden extortion outputs by targeting high-value virtualization hosts and CI/CD ecosystems, with access often gained via compromised insider credentials or trusted insider channels.

Analysts observed that ShinyHunters is very likely using members of Scattered Spider and The Com to carry out voice phishing attacks targeting SSO platforms across industries such as retail, airline and telecoms. They also report that ShinyHunters’ leader, ShinyCorp, is actively selling stolen datasets for more than $1 million per company, and that the shinysp1d3r RaaS aims to encrypt VMware ESXi environments to facilitate affiliate deployment against hypervisor infrastructures.

The Telegram recruitment post on 31 August 2025 offered financial rewards to insiders in exchange for access to Okta, Microsoft SSO, Citrix VPN or Git platforms, underscoring the insider-risk element. The article cautions that once operational, the RaaS could significantly expand ShinyHunters’ ransomware reach and complicate enterprise recovery.