Loading story…
Dutch police arrested 23-year-old convicted cybercriminal Pepijn van der Stap, known as Umbreon, on suspicion of supporting ShinyHunters-linked data theft and extortion. The investigation follows a February social-engineering intrusion at Dutch telecom provider Odido, where attackers allegedly stole data belonging to more than 6.2 million people. Reporting attributes parts of the operation to a Jordanian teenager known as Rey, associated with the ScatteredLapsussHunters collective, who may have taken control of the ShinyHunters brand and used Umbreon imagery in an FBI job-application-site defacement to implicate or taunt van der Stap amid an internal dispute.
Following the reported arrest, ShinyHunters claimed compromises of the FBI recruitment portal and the Clop ransomware group's Tor leak site. The Clop intrusion was attributed to unauthenticated Grav CMS path traversal vulnerability CVE-2026-42608 in an outdated Grav 1.7.43 deployment; ShinyHunters claimed to have taken source code, plugins, logs, and Tor onion-service private keys, prompting Clop to move its leak site. The group has also allegedly mass-exploited Oracle PeopleSoft flaw CVE-2026-35273 against dozens of organizations, according to Mandiant and Google Threat Intelligence Group. Organizations using Grav 1.7 should upgrade to the patched 1.7.53.4 release, while PeopleSoft operators should urgently assess exposure to the Oracle vulnerability and investigate for compromise.
See which actors are running it and whether you're in range.
19 events from the most recent confirmed update back to the earliest known activity.
Pepijn van der Stap, reportedly arrested in the Dutch ShinyHunters investigation, appeared before Rotterdam District Court. Police had searched his Amsterdam home and seized electronic devices on September 15; public reporting stated that his connection to ShinyHunters and the Odido breach remained unproven.
Mandiant and Google Threat Intelligence Group reported that ShinyHunters had mass-exploited CVE-2026-35273 to steal data from dozens of organizations. Reported victims spanned education, technology, healthcare, agriculture, transportation, and government sectors.
Dutch authorities arrested van der Stap on suspicion of assisting ShinyHunters-linked data theft and extortion, and held him for questioning. At the time, he was reportedly employed as an offensive-security lead at Neo Security.
ShinyHunters breached Clop’s Tor data-leak site, first uploading a text file and later replacing it with an Umbreon-themed defacement. The group claimed to have stolen the site source code, Grav plugins, server logs, and Tor onion-service private keys, while Clop disputed that the server contained valuable operational or financial data.
ShinyHunters reportedly began exploiting CVE-2026-35273 in Oracle PeopleSoft as a zero-day. Oracle subsequently released a patch, while the group reportedly used URL encoding to bypass proposed Mandiant web-application-firewall mitigations.
Grav published an advisory for CVE-2026-42608, an unauthenticated path-traversal vulnerability in Grav core form-upload handling. The 2.x remediation added identifier validation through a sanitizeId() allowlist.
A Dutch-speaking ShinyHunters member allegedly directed an Odido employee to a spoofed website, obtained access, and stole data concerning more than 6.2 million people. Dutch police later sought help identifying the caller, and ShinyHunters confirmed the recorded caller was a group member.
Grav privately fixed CVE-2026-42608 in Grav 2.0.0-beta.2. The flaw allowed unauthenticated path traversal through form-upload handling and affected legacy Grav 1.7 deployments that had not received a backport.
Pepijn van der Stap was released from prison after serving part of his sentence for prior data theft and extortion activity.
Dutch cybercriminal Pepijn van der Stap, known online as “Umbreon,” was convicted of data theft and extortion offenses that prosecutors said generated €1.5 million to €2.7 million. He received a four-year prison sentence, with one year suspended.
Troy Hunt’s weekly update reported that Saif was arrested in Jordan in connection with ShinyHunters. The report did not specify charges, the arresting agency, or the arrest date.
Following the compromise and defacement of its prior server, Clop moved its leak site to a new Tor onion address. It said the old address would remain temporarily accessible before retirement.
Grav confirmed that ShinyHunters exploited CVE-2026-42608 against Clop’s outdated Grav 1.7.43 installation. After receiving exploitation details, Grav backported the fix to the legacy branch and released Grav 1.7.53.4, urging 1.7 users to upgrade.
Following the arrest of alleged leader Pepijn van der Stap and the FBI’s appeal for members to contact investigators, ShinyHunters said recent events had not affected its operations or infrastructure. The group continued to threaten victim organizations with publication of stolen data unless they negotiated payments.
The FBI publicly urged remaining ShinyHunters members to contact investigators following the Netherlands arrest of an alleged leader. FBI Cyber Division Assistant Director Brett Leatherman said the group and its alleged co-conspirators had breached more than 140 organizations since 2025 and collected at least $70 million in extortion payments.
A Rotterdam court ordered the ShinyHunters suspect identified by journalist Brian Krebs as Pepijn van der Stap to remain detained pending trial for at least 90 days. Dutch police also said forensic evidence from his laptop included information related to two murders he allegedly ordered abroad.
ShinyHunters said its reported intrusion against the FBI was intended to counter what it called misinformation after the FBI publicly associated it with The Com. The group said the operation was not an extortion attempt and that it did not intend to publish allegedly stolen data.
Reporting indicated that ShinyHunters likely used a modified exploit for Oracle PeopleSoft vulnerability CVE-2026-35273 to compromise the FBI job-application site. The site was also defaced with an oversized Umbreon image.
Soon after van der Stap’s reported detention, ShinyHunters claimed it compromised the FBI job-application website, apply.fbijobs.gov; the FBI confirmed the site was hacked. Reporting said the exposed material included Social Security numbers and other personal information for more than 5,000 officials, including psychiatric and medical records.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
28 references tracked. Mallory keeps watching after this page renders.
troyhunt.com
Open sourcexakep.ru
Open sourcebitdefender.com
Open sourcebitdefender.com
Open sourcekrebsonsecurity.com
Open sourcebleepingcomputer.com
Open sourcenltimes.nl
Open sourcepolitie.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters allegedly breached and defaced the Tor-based data-leak site of the Clop/Cl0p ransomware operation following a dispute between the cybercrime groups. The group said it exploited an unauthenticated file-upload flaw in Grav CMS, first placing a taunting text file on the site and then replacing it with an Umbreon-themed defacement page. ShinyHunters claimed it obtained full server access and stole Clop source code, Grav CMS plugins, logs, server data, and private keys for the operation's onion service. It has threatened to extort Clop using the purportedly stolen material; however, the asserted access and data theft have not been independently verified. The conflict is reportedly tied to Clop's alleged threats and its 2025 Oracle E-Business Suite extortion campaign involving `CVE-2025-61882`.
Sep 22, 2026
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026