14 Months of Warning: What Preemptive Threat Intelligence Reveals about the ShinyHunters Supply Chain Breaches

A Single Attacker, Two Targets, Hundreds of Victims

In August 2025, stolen access credentials were used to extract data from more than 760 of Salesloft’s customer companies, including Cloudflare, Palo Alto Networks, Qantas, and Allianz Life, in a single 10-day window. Salesloft’s Drift chat subsidiary was used as the entry point.

Around the same time, Instructure, the company behind Canvas, the learning management platform used by a significant proportion of higher education institutions globally, was compromised by the same group. The attack ultimately affected roughly 9,000 educational institutions and 275 million users, and the same attackers returned for a second campaign eight months later.

These were not two unrelated incidents that happened to occur close together. They were parallel campaigns run by the same threat actor, against multiple software vendors, at the same time. The insurance and reinsurance industry now has a formal name for this pattern: a Multi-Client Targeted Attack (MCTA) This is a category of breach defined by a shared vendor or supplier as the common thread linking a large number of simultaneous victims. The term was formalized in 2026 by an industry working group including Munich Re, Moody’s, AXIS, and Gallagher Re.

What Advanced Warning Looks Like

Traditional cyber risk tools show either what is happening inside a network, or what has already been published. By the time those tools fire an alert, the damage is often done.
Dark web monitoring operates differently. Rather than waiting for a breach to be detected, it watches the external activity that precedes and accompanies an attack: the reconnaissance, the credential trading, the traffic flowing to and from anonymous infrastructure. Specifically, the signals that matter include:

• Inbound attacker activity: anonymous connections probing a company’s external infrastructure for weaknesses
• Outbound exfiltration signals: traffic leaving a company’s network toward the same anonymous services attackers use
• Credential theft and trading: stolen access credentials appearing in dark web markets, traded to provide initial access to a victim organization
• Threat actor discussion: chatter in forums and private channels which can indicate targeting and active campaigns

When several of these signals activate for the same organization within a short window, the statistical risk of a material breach in the following 90 days rises sharply. When they activate for multiple connected organisations at once, you are looking at something more organized: a supply chain attack in preparation.

Why Supply Chain Risk Is Different

Most security programs are built around a single perimeter: your network, your assets, your credentials. Supply chain risk breaks that model. The focus moves away from simply whether your organization is secure, to assessing whether every vendor you depend on is secure, and if one of them is compromised, how exposed you are.

The Salesloft and Instructure incidents illustrate the scale of what that exposure can look like. Hundreds of organizations, many of them sophisticated enterprises with mature security postures, were caught by a breach they had no direct visibility into, because the entry point was a trusted third party. The attacker did not need to breach each victim individually. Breaching the vendor was enough.

This is increasingly how large-scale cyber campaigns operate. A single vulnerability in a widely-used SaaS platform, a single set of stolen credentials for a cloud provider, a single compromise of a software update mechanism. Any of these can become the entry point for a cascading event that affects an entire ecosystem of downstream customers simultaneously.