[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOMQtCZjqMKsgP-VyGJYrTCBbZP8mfYd_kNAL9UHn7Oc":3},{"article":4,"iocs":35,"watch_terms":36,"solutions":37,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"2faebd27-afdc-4bcf-b89c-200ab0d27757","BCON Collective uncovers shared phishing infrastructure linked to ShinyHunters","bcon-collective-uncovers-shared-phishing-infrastructure-linked-to-shinyhunters-0d5713","Bridewell’s BCON Collective has uncovered an active phishing infrastructure spanning more than 100 malicious domains after investigating what initially appeared to be a routine blocked vishing attempt against one of its customers. The investigation found evidence suggesting the campaign is linked to the ShinyHunters cybercriminal group and revealed that the same phishing kit is being […] The post BCON Collective uncovers shared phishing infrastructure linked to ShinyHunters appeared first on IT Security Guru.","Bridewell's BCON Collective has uncovered a large-scale phishing infrastructure comprising over 100 malicious domains. Initially identified through a blocked vishing attempt, the investigation revealed connections to the ShinyHunters cybercriminal group, indicating a sophisticated and active phishing campaign.","BCON Collective finds ShinyHunters phishing infrastructure with over 100 domains.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F07\u002F31\u002Fbcon-collective-uncovers-shared-phishing-infrastructure-linked-to-shinyhunters\u002F?utm_source=rss&utm_medium=rss&utm_campaign=bcon-collective-uncovers-shared-phishing-infrastructure-linked-to-shinyhunters",null,"2026-07-31T08:48:48+00:00","2026-07-31T10:00:20.473056+00:00",7,[17,20],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":22},"BCON Collective","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":12,"name":25,"slug":26},"Threat Intelligence","threat-intelligence",[28,33],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":34},{"id":23,"icon":12,"name":25,"slug":26},[],[21],{"controls":38,"vendors":123},[39,67,94],{"slug":26,"name":40,"problem":41,"products":42},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[43,51,59],{"vendor_slug":44,"vendor_name":45,"vendor_logo":46,"product_slug":47,"product_name":48,"url":49,"description":50},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":68,"name":69,"problem":70,"products":71},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":89,"product_name":90,"url":92,"description":93},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"slug":95,"name":96,"problem":97,"products":98},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":141},"shinyhunters-phishing-infrastructure-100-malicious-domains-uncovered","ShinyHunters Phishing Infrastructure: 100+ Malicious Domains Uncovered","The BCON Collective's investigation reveals how a single blocked vishing attempt can be the tip of a much larger, coordinated phishing operation — in this case linked to the prolific ShinyHunters group operating over 100 malicious domains. The root cause lies in insufficient user awareness and detection capabilities that allow sophisticated social engineering campaigns to operate at scale before being identified. Phishing and vishing attacks exploit human trust, making them effective even against technically hardened organisations. The ShinyHunters connection underscores that modern phishing infrastructure is professionalised, reusable, and shared across criminal networks, amplifying its reach and impact. Early detection and threat intelligence sharing, as demonstrated here, are critical to disrupting these campaigns before significant harm occurs.",[129,130,131,132,133,134,135,136,137,138,139,140],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-50 – Building an Information Technology Security Awareness and Training Program","NIST PR.AT-1 – All users are informed and trained","NIST DE.CM-7 – Monitoring for unauthorized activity","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1598 – Phishing for Information (Vishing)","GDPR Article 32 – Security of Processing (obligation to implement appropriate technical measures)","ISO\u002FIEC 27001 A.6.3 – Information Security Awareness, Education and Training","ITIL – Problem Management (identifying root cause of recurring security incidents)",{}]