Threat Group 'Bling Libra' Pivots to Extortion for Cloud Attacks

Unit 42 researchers report that the Bling Libra (ShinyHunters) group has evolved from selling stolen data to using double-extortion tactics against cloud environments: attackers harvest exposed or weak credentials (often lacking MFA), access AWS/S3 resources to exfiltrate and delete data, then threaten publication unless a ransom is paid; the report details an investigated incident, ties to large breaches (including Ticketmaster), and recommends MFA, least-privilege IAM, and enhanced logging and monitoring.