Threat Actor Characterization
shinyenigma
ID: 9baaa36288fc31fde8aad3fce380f16a02666| altshiny | shienigma | Sh****** | Sh********* |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
a1532a72862ef57d39753da10c242ef701894 | CROCUS RAT | Unknown | founder | Crimeware |
|
2cd1f633e008625ef383f152120eff0b69255 | DotStealer | Unknown | founder | Crimeware |
|
ad253209ab14560e6435956c924425c062843 | Millenium RAT | Unknown | founder | Crimeware |
|
2f2ce2f96b8f4264e72cedfd03572a3381555 | XWorm | Unknown | related | Crimeware |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
shinyenigma is an online handle associated with the promotion, sale, and likely maintenance of the Telegram-controlled Windows malware family Millenium RAT. Public evidence links the handle to GitHub repositories, a dedicated clearweb site, Telegram-based contact, and adjacent contact channels. The actor is best modeled as a malware-vendor persona rather than a conventional intrusion set.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1588.001 | Malware | TA0042 | |
| T1102.002 | Bidirectional Communication | TA0011 | |
| T1041 | Exfiltration Over C2 Channel | TA0010 | |
| T1555 | Credentials from Password Stores | TA0006 | |
| T1056.001 | Keylogging | TA0006 TA0009 | |
| T1547.001 | Registry Run Keys / Startup Folder | TA0003 TA0004 | |
| T1497 | Virtualization/Sandbox Evasion | TA0005 TA0007 | |
| T1622 | Debugger Evasion | TA0005 TA0007 | |
| T1059.001 | PowerShell | TA0002 | |
| T1005 | Data from Local System | TA0009 |
|
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Cybercrime / Malware development and distribution - Origin: Unknown
Author: iQBlack CTI Team
Executive Summary
shinyenigma is an online handle assessed to be closely associated with the development, promotion, sales, and support ecosystem of Millenium RAT, a Telegram-controlled Windows remote access trojan and stealer. Publicly available evidence ties the handle to GitHub repositories, a dedicated clearweb marketing site, Telegram-based contact and sales workflows, and ancillary contact points on Matrix/Element and Signal. Confidence is medium for the handle-to-malware linkage and low for any real-world identity or geography attribution.
Unlike a conventional intrusion set with well-documented victim campaigns, shinyenigma is better modeled as a persona/operator-vendor node inside a malware commercialization ecosystem. The actor’s visible footprint emphasizes builder distribution, feature marketing, versioning, support channels, and low-friction access for buyers rather than publicized extortion operations or mature intrusion reporting. This makes the actor operationally relevant even when direct victim reporting is comparatively thin.
