Security1 publisher2 min readPublished
FBI presses ShinyHunters members to surrender after Dutch police hold an alleged leader
FBI's Brett Leatherman urged ShinyHunters members to surrender after the Dutch arrest of an alleged leader of a group tied to $70 million in extortion. Dutch police have not ruled out more arrests, though the public record so far shows one suspect in custody.
The Watch · Security desk
What happened
- Dutch police said the suspect is a 24-year-old man from Amsterdam who was arrested on September 15.
- Police said his laptop held details of two murders that were to be committed abroad, and that there are indications he gave the order for them.
- The FBI says ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since last year.
- The FBI's warning came shortly after ShinyHunters claimed to have taken two to three terabytes of data from the bureau's own systems.
- Dutch police said the man was not detained as part of their investigation into the ShinyHunters breach of Dutch telecom provider Odido.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Organizations reachable through corporate SSO accounts, third-party vendors or SaaS tenants such as Salesforce and Snowflake still face the members the FBI is addressing, since one arrest in Amsterdam does not close those routes in.
- exposure FBI staff are exposed while the bureau pursues the group: 404 Media reported Remote Operations Unit names in the stolen data, and Reuters said some exposed staff worked China and Russia cases.
- contradiction ShinyHunters says the FBI breach was never meant for extortion or publication, yet it provided about 5,000 FBI personnel records to media, so its stated intent and its conduct point different ways.
The leadership label comes from the FBI. "Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world," FBI Cyber Division Assistant Director Brett Leatherman said in a video released Tuesday [2]. By saying "one of the alleged leaders", he implies the bureau counts more than one [2]. The Dutch police account, as BleepingComputer reported it, describes a suspected role within the group and participation in a criminal organization [4]. The Rotterdam District Court ruled Tuesday that he stays in pre-trial detention for at least another 90 days [7].
The rest of the video spoke to the members still free. BleepingComputer called it a more public approach from the bureau, with Leatherman addressing the remaining members directly [19]. "You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not," Leatherman said [20]. He cited other groups: "Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left." [21] He ended with an offer. "The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours." [23]
On the public record, the FBI's pressure has one arrest behind it. Leatherman said investigators are still gathering information on the group and that its members are actively being targeted [22]. The record does not yet show a second arrest, a US charge against the Amsterdam suspect, or evidence tying him to the intrusion ShinyHunters claims against the FBI. Until one of those appears, the view that investigators are working through the group's leadership rests on the FBI's description of one detainee [1].
ShinyHunters told BleepingComputer that the FBI intrusion ran through an Oracle PeopleSoft zero-day [12]. The method and the volume both come from the group [12][13]. It said the purpose was to dispute an FBI advisory [18]. That advisory states ShinyHunters actors may exaggerate their access to sensitive information, harass victims and their relatives, conduct swatting attacks and falsely claim to possess compromising material [18].
What to watch
- Whether Dutch police announce a second arrest, or the Rotterdam court extends the suspect's detention when the current order expires.
- Whether US prosecutors file charges against the Amsterdam suspect or seek his extradition.
- Whether the FBI confirms or disputes ShinyHunters' account of a PeopleSoft zero-day and a two-to-three-terabyte theft.