ShinyHunters calls its FBI ultimatum a marketing campaign

The only source for the zero-day is the group's own account of how it got in ^[4]. Hackread's report does not include a CVE number, an Oracle advisory or technical detail on the flaw ^[4]. What is public is not enough to rate how exploitable it is. The group's plans for the FBI files have no bearing on whether the flaw works, or on whether anyone else is using it ^[1].

According to the group, it made the ultimatum ambiguous on purpose. Its original message said its threats and claims were real and "never a bluff," and denied that the action was financially motivated or an extortion attempt ^[10]. It did not say what would happen when the week ran out ^[10]. "We worded our statements very carefully and we never clarified nor specifically stated what we would do if the victim entity did not comply within what the public interpreted as a 'deadline'," the group told Hackread.com ^[11]. It said it deliberately declined to answer journalists who asked, and never called the week a deadline itself ^[15].

The group put its motive in commercial terms. It said the whole thing was a marketing campaign to protect its business and actively combat disinformation, and that a normal statement would never have drawn such widespread attention to its words and intentions ^[12]. What it calls disinformation is the FBI's account of its methods, which describes harassment that includes threatening victims and their family members, and swatting ^[16]. The group denies using those tactics and rejects any association with "The Com" ^[16].

It also conceded that its record of operations involving stolen corporate data explains why people expected the FBI files to be published or sold ^[14]. "This was not a threat. It may have been worded like a threat, but ultimately the public has driven this story out of context and made their own wild assumptions and speculations," the group said ^[13].