{ "count": 70, "indicators": [ { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/large-scale-cloud-extortion-operation\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-06 14:48:31" }, { "ioc_value": "https:\/\/www.crowdstrike.com\/blog\/double-trouble-ransomware-data-leak-extortion-part-1\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 8, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-06 14:48:31" }, { "ioc_value": "https:\/\/www.mandiant.com\/resources\/blog\/ransomware-extortion-ot-docs", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-06 14:48:31" }, { "ioc_value": "https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/unc5537-snowflake-data-theft-extortion", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/shinyhunters-ransomware-extortion\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/redcanary.com\/blog\/rclone-mega-extortion\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:30" }, { "ioc_value": "https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/10\/25\/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:29" }, { "ioc_value": "https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/voice-phishing-data-extortion", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-06 14:48:29" }, { "ioc_value": "https:\/\/dailydarkweb.net\/guangdong-caiding-market-group-faces-data-breach-after-extortion\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/from-callback-phishing-to-extortion-luna-moth-abuse-reamaze-helpdesk-and-rmm-tools-against-u.s.-legal-and-financial-sectors", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/krypt3ia.wordpress.com\/2026\/07\/13\/threat-intelligence-report-jadepuffer-agentic-ransomware-and-automated-extortion\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/businessinsights.bitdefender.com\/coinbase-cartel-ransomware-group-extortion-tactics", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/www.cyjax.com\/resources\/blog\/new-extortion-ransomware-group-linkc-emerges-what-you-need-to-know\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "https:\/\/cyberwarzone.com\/shinyhunters-22-year-old-member-pleads-guilty-to-cyber-extortion-causing-6-million-in-damage\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.crowdstrike.com\/blog\/double-trouble-ransomware-data-leak-extortion-part-2\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.advintel.io\/post\/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.crowdstrike.com\/blog\/double-trouble-ransomware-data-leak-extortion-part-1", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/statescoop.com\/baltimore-ransomware-crowdstrike-extortion\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/the-week-in-ransomware-november-13th-2020-extortion-gone-wild\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.cyjax.com\/resources\/blog\/an-elephant-in-kairos-data-leak-site-emerges-for-new-extortion-group\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.itsecurityguru.org\/2024\/06\/13\/guest-blog-proactive-application-security-learning-from-the-recent-github-extortion-campaigns\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/new-gitloker-attacks-wipe-github-repos-in-extortion-scheme\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-06 14:45:33" }, { "ioc_value": "https:\/\/krebsonsecurity.com\/2022\/03\/a-closer-look-at-the-lapsus-data-extortion-group\/", "ioc_type": "url", "category": "Mobile ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:09:20", "last_seen": "2026-08-06 14:41:54" }, { "ioc_value": "https:\/\/industrialcyber.co\/ransomware\/cyfirma-warns-of-gunra-ransomware-surge-targeting-critical-infrastructure-using-double-extortion", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.cyjax.com\/resources\/blog\/the-devil-and-the-termite-data-leak-sites-emerge-for-chort-and-termite-extortion-groups\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.cybertalk.org\/the-worst-outcomes-lorenz-ransomware-a-new-double-extortion-strategy", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.cyjax.com\/resources\/blog\/new-argonauts-extortion-group-emerges\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.sentinelone.com\/blog\/dragonforce-ransomware-gang-from-hacktivists-to-high-street-extortionists\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/20\/g\/nefilim-ransomware-shifts-to-double-extortion.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/blogs.blackberry.com\/en\/2021\/05\/threat-thursday-dr-revil-ransomware-strikes-again-employs-double-extortion-tactics", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/karakurt-data-extortion-group-linked-to-conti-ransomware-gang\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.justice.gov\/opa\/pr\/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/22\/f\/karakurt-data-extortion-group.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/cyware.com\/news\/new-0mega-ransomware-joins-the-double-extortion-threat-landscape-158fb321", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.zscaler.com\/blogs\/security-research\/everest-ransomware-extortion", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.zeit.de\/digital\/2021-06\/cybercrime-extortion-internet-spyware-ransomware-police-prosecution-hackers", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.accenture.com\/us-en\/blogs\/cyber-defense\/evolving-danger-ransomware-extortion", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/data-leak-marketplaces-aim-to-take-over-the-extortion-economy\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.zscaler.com\/blogs\/security-research\/atomsilo-ransomware-enters-league-double-extortion", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.advanced-intel.com\/post\/inside-revil-extortionist-machine-predictive-insights", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.advanced-intel.com\/post\/the-dark-web-of-intrigue-how-revil-used-the-underground-ecosystem-to-form-an-extortion-cartel", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.crypsisgroup.com\/insights\/ransomwares-new-trend-exfiltration-and-extortion", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.darktrace.com\/en\/blog\/the-double-extortion-business-conti-ransomware-gang-finds-new-avenues-of-negotiation\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/ransomware-by-the-numbers\/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/blogs.blackberry.com\/en\/2020\/12\/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/blog.sekoia.io\/vice-society-a-discreet-but-steady-double-extortion-ransomware-group", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.fireeye.com\/blog\/threat-research\/2021\/02\/accellion-fta-exploited-for-data-theft-and-extortion.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.zdnet.com\/article\/a-deep-dive-into-nefilim-a-double-extortion-ransomware-group", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-modern-ransomwares-double-extortion-tactics.pdf", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.speartip.com\/resources\/fbi-hellokitty-ransomware-adds-ddos-to-extortion-arsenal\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cybercrime-and-digital-threats\/ransomware-double-extortion-and-beyond-revil-clop-and-conti", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nShinyHunters", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nFigure", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nThreat", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nThese", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nEclecticIQ", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nFigure\\n\\n15", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\ntesting", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nmanufacturing", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\naffiliates", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nNew", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\n23[.]94[.]126[.]63\\n\\n198[.]244[.]224[.]200\\n\\nadmiring-shockley[.]196-251-83-162[.]plesk[.]page\\n\\nbless-invite[.]com\\n\\nget-carrot-zoom[.]com\\n\\nmodernatx-zoom[.]com\\n\\nrecurly-zoom[.]com\\n\\nEvilginx", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/shinyhunters-ransomware-\\n\\nextortion\/\\n\\n[2]\u00a0\u201cDefending", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nrecommendations\\n\\n[3]", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/voice-phishing-data-extortion\\n\\n[6]\u00a0\u201cTelegram:", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/blog.eclecticiq.com\/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications\\n\\nPage", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" } ] }