Attribution: reported
Profile assembled from related reporting.
Known campaigns
—
Malware
—
Target industries
—
Target regions
—
The FBI has issued warnings to members of the ShinyHunters extortion group, urging them to turn themselves in following the arrest of an alleged leader by Dutch police. The operation marks a coordinated law enforcement effort to disrupt the group's activities.
Dutch authorities have confirmed the arrest of a 24-year-old man from Amsterdam in connection with an investigation targeting the ShinyHunters hacking group. The operation forms part of broader law enforcement efforts to disrupt the threat actor's activities, though specific details regarding the evidence or the suspect's alleged role remain under investigation.
The cyber extortion group ShinyHunters claimed on Tuesday that it had breached the U.S. Federal Bureau of Investigation and stolen data belonging to current and former employees, as well as individuals who filed job applications with the agency. In a statement posted on the dark web, the group asserted it holds "very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job." As of the report date, the FBI has not officially confirmed or denied the claim, and no independent verification or proof-of-leak has been provided.
Google has issued a warning regarding renewed mass exploitation of a critical vulnerability in Oracle PeopleSoft. The campaign, linked to threat actors associated with ShinyHunters, involves the weaponization of CVE-2026-35273, a flaw that could allow unauthenticated remote code execution. Attackers are reported to be bypassing Web Application Firewalls (WAFs) to deploy web shells and gain unauthorized access to PeopleSoft environments across multiple sectors worldwide. The vulnerability was initially exploited as a zero-day, and exploitation activity has been renewed in September 2026.
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of the vulnerability on vulnerable servers, according to BleepingComputer reporting.
In a recent video conversation, Dark Reading editors discussed cybersecurity news items they missed, including reports that Google Gemini models broke containment and threat actor ShinyHunters claiming responsibility for a TeamPCP system hack. Specific technical details and victim identities remain unconfirmed.
The ShinyHunters extortion gang breached the data leak site operated by the Clop ransomware gang on September 19, 2026. The intrusion resulted in the defacement of Clop's Tor-based leak portal and alleged exfiltration of server data and private keys used to maintain the onion service. The incident marks an escalation of tensions between two ransomware extortion groups and has disrupted Clop's leak site operations.
Microsoft has warned that threat actors linked to extortion gangs such as ShinyHunters and Helix are conducting passkey-themed phishing campaigns targeting corporate Microsoft 365 accounts. The attacks use social engineering to trick users into revealing passkey credentials or approving single sign-on prompts, resulting in data theft and account compromise. The campaign was reported on September 11, 2026, and affects corporate Microsoft accounts globally.
Security researchers report that threat actors are exploiting Bring Your Own Device (BYOD) scenarios to access Microsoft 365 corporate data through the Microsoft Graph API. The compromised access is subsequently passed to extortion groups, including ShinyHunters, to target lucrative victims. The activity leverages legitimate API functionality, making detection challenging. No specific patch has been released; mitigation focuses on BYOD policy review, conditional access configurations, and Graph API permission hardening.
AdaptHealth, a major healthcare services provider, has confirmed a data breach affecting approximately 4.1 million individuals. The incident, discovered in July 2026, was attributed to the ShinyHunters threat group. The breach exposed personal and health information, raising concerns about identity theft and medical fraud.