Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware

Unit 42 investigated a Bling Libra (ShinyHunters) incident in which the actor harvested exposed AWS access keys, used them to access and enumerate S3 buckets using AWS CLI, S3 Browser, and WinSCP, deleted a subset of buckets, and then sent an extortion demand; the report details the CloudTrail API calls produced by those tools, provides IoCs (user-agents and an email), and recommends AWS hardening measures (least privilege, logging, GuardDuty, Config, MFA for sensitive S3 actions).