Why ShinyHunters attacks expose a growing data security risk

Credential abuse and trusted integrations are turning weak access controls into high-impact data breaches.

Key takeaways

• ShinyHunters attacks show how credential abuse and weak access controls can expose large volumes of sensitive data.
• Trusted third-party integrations can expand the attack surface and increase the impact of a breach.
• MFA is important, but it is not enough on its own when attackers can bypass or work around controls.
• Least privilege access, password hygiene, user training, monitoring, and segmentation help reduce the blast radius.
• Organizations should treat integrations as potential data exposure pathways and secure them accordingly.

While a lot of attention is being paid to a pending apocalypse of vulnerabilities that are being discovered by the latest generation of artificial intelligence (AI) models, a series of relatively simpler cyberattacks from a shadowy syndicate known as ShinyHunters are proving to be the most lethal.

The most recent cyberattack launched by this group was against Madison Square Garden (MSG), the parent organization of the New York Knicks and Liberty basketball teams and the New York Rangers hockey team. As fans of the Knicks were celebrating the team’s NBA championship, cybersecurity teams and the executive leadership of MSG were contending with the theft of 45 GB of corporate and customer data.

That data was later published after MSG declined to meet the ransom demands, but other organizations have acquiesced to the demands of a ransomware syndicate that has become notoriously prolific.

How do ShinyHunters attacks typically work?

The tactics and techniques employed by cybercriminals affiliated with ShinyHunters are fairly straight forward. They generally focus their efforts on organizations that once breached enable them to access massive amounts of data, much of which often resides in any number of third-party systems. In effect, they are exploiting the inherent trust that exists between organizations to discover, access and, ultimately, encrypt data.

One of the reasons that these cyberattacks persist is because ShinyHunters itself is highly decentralized. While there are definite patterns in the cyberattacks launched, the members of the syndicate are loosely affiliated. ShinyHunters in many ways is as much a brand as it is an organization through which cybercriminals collect cryptocurrency payments. More challenging still, many of its members operate from countries that lack extradition agreements with the countries where the headquarters of the companies that have been victimized are actually located.

What can organizations do to reduce risk?

As most cybersecurity professionals well know, any hope of thwarting these types of attacks requires deploying a combination of mult-factor authentication (MFA) coupled with strong enforcement of least privilege access policies. Other measures include regularly rotating passwords and, most importantly, training end users to both protect credentials better by, among other things, being able to recognize a phishing attack.

Unfortunately, humans remain the weakest cybersecurity link. There is always going to be some percentage of the workforce or customer base that has not adequately protected their credentials. More challenging still, cybercriminals are also becoming more adept at bypassing multifactor authentication (MFA) controls. As a consequence, cybercriminal syndicates such as ShinyHunters are for the foreseeable future going to remain the bane of cybersecurity existence.

In fact, the best thing most cybersecurity teams can do is assume a breach is inevitable. The challenge then becomes how to limit the scope of the blast radius by ensuring that the best segmentation practices are in place to limit the access any malicious actor gains to as little as possible. Cybersecurity teams need to constantly remind their counterparts that integration is not their friend. Unless integrations are absolutely secure, they are for all intents and purposes little more than a signpost that simply directs adversaries where to focus their efforts next after they gain initial access.

The paradox, of course, is that those integrations are also what enable organizations to get the most value out of their investments in IT. The fundamental challenge is that those integrations are also a border that all too often isn’t being especially well guarded.