Ledger / 8 Sep 2026
ShinyHunters cluster UNC6240 used AI across SaaS extortion attacks
Confirmed
Google observed Gemini misuse mapped to the attack lifecycle.
The extortion cluster used AI at several lifecycle stages of its SaaS data theft operations.
“has also integrated AI tactics across various stages of the attack lifecycle”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: From Prompting to AutonomyGoogle Threat Intelligence Group · 8 Sep 2026 · primary source
- Disclosed
- 8 Sep 2026
- Activity
- 2026
- Actor
- UNC6240 (ShinyHunters) (criminal), as attributed by Google Threat Intelligence Group
- Targets
- SaaS customers
- What the AI did
- Ops automation, Data analysis
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Google reports.