FBI urges ShinyHunters members to surrender after Dutch arrest of alleged leader; group escalates with FBI portal breach and Cl0p extortion

Linha do tempo

1. bitdefender.com ↗ · pub. 01/10/2026 07:53 · coletado 19/10 17:56

   FBI urges ShinyHunters members to surrender after Dutch arrest of alleged leader; group escalates with FBI portal breach and Cl0p extortion

   The article adds the FBI's public appeal, via a video from Brett Leatherman, for remaining ShinyHunters members to turn themselves in. It also notes that Dutch police describe the arrested 24-year-old only as having played a role, whereas the FBI calls him an alleged leader. New detail on the Cl0p incident: ShinyHunters claims to have stolen source code, CMS plugins, Tor private keys and member IP logs, and threatens to publish which companies paid ransoms and how much. The article also says the arrest came about a week before the FBI breach became public.

   ler a análise desta fonte ocultar

   The article adds the FBI's public appeal, via a video from Brett Leatherman, for remaining ShinyHunters members to turn themselves in. It also notes that Dutch police describe the arrested 24-year-old only as having played a role, whereas the FBI calls him an alleged leader. New detail on the Cl0p incident: ShinyHunters claims to have stolen source code, CMS plugins, Tor private keys and member IP logs, and threatens to publish which companies paid ransoms and how much. The article also says the arrest came about a week before the FBI breach became public.

   The FBI has publicly called on remaining ShinyHunters members to surrender. Cyber division assistant director Brett Leatherman released a video thanking Dutch police for arresting a 24-year-old in Amsterdam. The FBI calls him "one of the alleged leaders" of the group, while Dutch police say only that he played a role. He is also suspected of attempting to arrange two murders. Leatherman said the arrest changes the situation and could encourage others to share information with authorities. The arrest preceded the public disclosure of the FBI breach by about a week, and observers link a change of leadership to the group's sharp escalation afterwards.

   Technical Details

   • ShinyHunters compromised the FBI's job application portal. The theft included Social Security numbers and personal details of about 5,000 FBI staff, some of whom worked on sensitive China and Russia investigations. Some files held medical and psychiatric records.
   • According to ShinyHunters, initial access came from exploiting the recently patched flaw CVE-2026-35273 in Oracle PeopleSoft PeopleTools. This is the group's claim and the article does not independently confirm it.
   • In mid-September the group claimed to have stolen source code, CMS plugins, Tor private keys and logs (said to reveal member IP addresses) from the Cl0p leak site. It threatened to publish which companies paid Cl0p ransoms, and how much, unless it was paid.

   Remediation

   • The article gives no technical remediation. Defenders running Oracle PeopleSoft should ensure the fix for CVE-2026-35273 is applied.
2. krebsonsecurity.com ↗ · pub. 07/10/2026 10:48 · coletado 19/10 17:55 primeiro registro

   ShinyHunters Member 'Rey' Detained in Jordan Mid-Extortion of Boeing Spin-off Jeppesen ForeFlight; PeopleSoft CVE-2026-35273 Mass-Exploited

   ler a análise desta fonte ocultar

   A teenage suspect from Amman, Jordan, using the handle Rey (identified as Saif Al-din Khader), has reportedly been detained by Jordanian authorities and is cooperating with the FBI to identify other ShinyHunters members. According to KrebsOnSecurity sources, ShinyHunters was extorting Jeppesen ForeFlight, a navigation and digital aviation unit Boeing sold to Thoma Bravo in November 2025, when Rey was apprehended. The stolen data is said to include sensitive information that could pose operational safety risks. Boeing acknowledged the claims, while Jeppesen ForeFlight said its operations and products were not affected. The case follows the 15 September arrest in the Netherlands of Pepijn van der Stap (alias "Umbreon"), after which Rey took over the ShinyHunters brand and claimed hacks of the FBI and Cl0p.

   Technical Details

   • ShinyHunters began exploiting CVE-2026-35273 in Oracle PeopleSoft as a zero-day in June 2026. Oracle later issued a fix, and Mandiant published WAF rules as a stopgap.
   • In recent weeks the group bypassed Mandiant's suggested WAF rules with a well-known URL-encoding trick.
   • A 25 September Mandiant/GTIG report confirmed mass exploitation against dozens of systems in higher education, technology, healthcare, agriculture, transportation and government.
   • The compromised FBI recruitment website exposed data on more than 5,000 FBI personnel, including unit, specialization, and medical and psychiatric records. Reuters reported that the FBI removed an Accenture contractor for failing to patch it.
   • Sources say the FBI is now focused on a handful of freelancers and affiliates who supply stolen credentials for SaaS platforms in exchange for a share of ransoms.
   • ShinyHunters now operates as a franchise, and the people using the name differ from its original, largely French, core members.
   • Rey's family computer was previously infected with password-stealing malware, which exposed credentials his father used for Royal Jordanian Airlines portals. This is background only, and no link to the Boeing intrusion is stated.
   • The Dutch press reports that investigators suspect Van der Stap of trying to orchestrate at least two murders abroad. Neo Security, his employer, has found no evidence he acted against it or its clients.

   Remediation

   • Apply the Oracle patch for CVE-2026-35273 on all PeopleSoft instances. WAF rules alone are insufficient because of the URL-encoding bypass.
   • Review PeopleSoft and SaaS logs for exploitation since June 2026, and rotate credentials for exposed SaaS and portal accounts.
   • Do not reuse credentials across portals, and monitor for extortion contact and harassment aimed at employees and families.