Threat Intelligence Tarot
Vol. II · 104
Criminal (French and Moroccan nationals, suspected)
★★★★★
risk 3/5
✦ The Data Magpie ✦
ShinyHunters
ShinyCorp
Cloud storageSaaS platformsConsumer databasesTechnology companiesRetail
Active since 2020 · Data theft, Financial gain, Notoriety
The Data Magpie collects everything that glitters: records, credentials, session tokens. It does not hack for ideology or espionage but for the pure accumulation of data as currency, shiny things traded in dark markets.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆AT&T breach (2024, 73 million customer records)
- ◆Snowflake customer credential campaign compromising 165+ companies
- ◆Ticketmaster breach (560 million records)
- ◆500 million+ total records stolen across all operations
Defenses
- ▸MFA enforced on all cloud storage and SaaS platform accessNIST CSF: PR.AC ↗
- ▸Credential stuffing protection via IP reputation and velocity limiting on login endpointsCIS Control 6 ↗
- ▸Cloud Access Security Broker monitoring data egress from cloud storageCIS Control 13 ↗
- ▸Data minimization: retain only data required for business purposesNIST CSF: PR.DS ↗
Reversed: Their Weakness
Multi-factor authentication on cloud storage access would have prevented the Snowflake campaign entirely. Data minimization practices reduce the value of what is stolen when breaches occur.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.