ShinyHunters Ransomware Targeting Cloud Environments (Campaign)

Bling Libra (ShinyHunters) gained access to an organization's AWS environment by harvesting credentials from an exposed file in a public repository, used tools such as S3 Browser and WinSCP to enumerate and access S3 buckets (generating CloudTrail events like ListBuckets and GetObject), deleted selected buckets, created mock buckets via scripts, and issued a ransom demand; limited IAM permissions prevented full IAM discovery and made it impossible to determine the full extent of potential data exfiltration due to logging gaps.