ShinyHunters insists it is “fine” after FBI arrests alleged leader
“Our operations remain completely fine as it should be and WILL be.”
Image by Cybernews
Follow us
- ShinyHunters says its operations remain intact after the FBI identified an arrested Dutch man as an alleged leader.
- The FBI says ShinyHunters and associates breached more than 140 organizations and collected at least $70 million.
- ShinyHunters denies the arrested man is linked to the group and calls FBI claims disinformation.
- The gang recently claimed an FBI data breach, then described the episode as a marketing campaign.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
ShinyHunters desperately wants everyone to know that it’s not falling apart.
The notorious cybercrime group has just published a statement on its dark web leak site, insisting that its operations and infrastructure remain intact despite recent turbulence.
“Due to certain disinformation spreading once again,” ShinyHunters said, “we are releasing this statement to confirm we are okay, our operations and infrastructure remains completely fine as it should be and WILL be.” The group said, organizations that believe ShinyHunters is “falling apart” are “WRONG.”
The message appears to be aimed particularly at organizations currently negotiating with the group over allegedly stolen data, but it does not specify which organization exactly.
“To those organizations speaking to us, your data is still in our possession and at risk of being published,” the group said, adding that there is still an opportunity to prevent publication by returning to “being serious” in negotiations.
However, the statement feels odd and may be a sign of panic following the recent arrest of the gang's alleged leadership.
ShinyHunters’ leader allegedly arrested, but gang denies it
The statement arrives at a particularly awkward moment for the notorious extortionists. On September 15th, Dutch authorities arrested a 24-year-old Amsterdam man suspected of being involved with ShinyHunters.
The FBI later publicly identified the suspect as one of the group's alleged leaders. FBI Cyber Division Assistant Director Brett Leatherman said the group and its associates had allegedly breached more than 140 organizations and collected at least $70 million in extortion payments since last year.
Leatherman directly addressed the remaining ShinyHunters members after the Dutch arrest, saying investigators believed the arrest would provide information about who remains involved. The FBI has also encouraged members of the group to make contact with authorities.
Dutch authorities have also said information found on the suspect's laptop led them to investigate allegations that he had arranged 2 murders abroad. So far, the allegations are separate from the cybercrime case.
ShinyHunters, however, has rejected the claims that the man is part of its operation.
“That individual has no association with us. Frankly, we are laughing,” the group previously told Cybernews, while dismissing Dutch police as “unskilled and incompetent.”
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
ShinyHunters FBI data breach was a PR stunt
The arrest happened only days before ShinyHunters claimed to have compromised multiple FBI systems.
On September 22nd, the group claimed it had stolen data relating to FBI employees and applicants and defaced the FBI's jobs website. The alleged haul was said to include highly sensitive personal information on almost all FBI agents, employees, and job applicants.
The FBI confirmed it was investigating the incident, but has not independently confirmed the full scope of ShinyHunters' claims.
The group initially gave the FBI an ultimatum, demanding that the agency correct or retract statements about ShinyHunters. However, once the deadline approached, the gang abruptly reframed the entire narrative.
The gang told Cybernews the FBI data would never be published, insisting that there was no ransom nor actual threat.
Instead, the group described the entire episode as a “marketing campaign” designed to draw attention to what it claimed was disinformation from the FBI.
“We'd have been ignored and disregarded,” ShinyHunters said.
“However, now everyone knows what the issue is and what we’re doing.”
ShinyHunters is known for high-profile targets
On Friday, ShinyHunters appeared to be back to its regular operations, launching a renewed mass-exploitation campaign targeting Oracle’s PeopleSoft human resources management system.
ShinyHunters is known to be behind a spree of social engineering attacks targeting employees by impersonating IT support staff. The attacks phish for Okta access, targeting companies worldwide.
In the past months, the gang claimed to be behind attacks on Hims&Hers, cybersecurity firm ReliaQuest, CyrusOne, Sysco, and Ralph Lauren.
Previously this year, the gang hit Dutch telecommunications giant Odido and the European Commission.