kyber.today

daily cyber × ai intelligence

← index

tagged

[shinyhunters]

51 editions · 56 items

October 14, 2026

  • The ShinyHunters name is now contested by multiple factions. A new actor calling itself Hasanbr0ker claims leadership after the previous figurehead's arrest, a "ShinyEquationCartel" claims a core drawn from ShinyHunters, LAPSUS$, HellCat and LockBit, and a group using the name is advertising a RaaS programme with an 80/20 split and a $1,000 joining fee. All claims are unverified (Catalin Cimpanu, FalconFeeds). · Threat Activity

in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN

October 13, 2026

Malware That Lives Off the Victim's AI Tooling

Unit 42 documented C2Agent, Windows malware operated by an LLM that drives post-exploitation through MCP and the victim's installed AI coding tools. GitLab shipped a CVSS 10.0 unauthenticated RCE fix for its CI/CD regex compiler, while Bricksforge plugin exploits are active in the wild with a working polyglot-upload bypass. Blinder Tunnel malware now uses Cloudflare Workers relays and GitHub C2 with per-victim credential rotation hidden in HTML comments, evading all VirusTotal detections six weeks after submission. French supermarket chains suffered a coordinated cyberattack that remotely triggered defrost cycles on Danfoss refrigeration controls, destroying stock across 300+ Intermarché/Netto and Coopérative U stores overnight.

October 10, 2026

  • The FBI arrested the founder of a ransomware negotiation firm over alleged ShinyHunters involvement. Canadian national Edward Dubrovsky was picked up in Pennsylvania on cyber extortion and conspiracy charges, with the main complaint still sealed (KrebsOnSecurity); Director Patel frames him as a co-conspirator in the FBIJobs.gov intrusion on a third-party-managed platform (BleepingComputer), the latest in a run of arrests (earlier coverage). · Ransomware & Law Enforcement

in Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys

October 8, 2026

  • The detained ShinyHunters leader was mid-extortion of a Boeing spin-off when arrested. Krebs identifies "Rey" as Saif Al-din Khader of Amman, detained while the group was extorting Jeppesen ForeFlight, and reports he is cooperating with the FBI; the group's access route remains mass exploitation of PeopleSoft flaw CVE-2026-35273, used as a zero-day from June (KrebsOnSecurity). Denmark's CERT notes the FBI has confirmed further arrests in the case (CERT.dk). (earlier coverage) (discussion) · Arrests & Enforcement

in Two Hours From Public Detail to Exploit Attempts Against Atlassian

October 6, 2026

  • The FBI removed an Accenture contractor after a missed patch was linked to its employment-portal breach. Reuters says, citing two sources, that the affected third-party platform was Oracle PeopleSoft and ShinyHunters claimed it exploited the system last month. Sensitive data belonging to thousands of FBI employees was exposed, although the bureau has not publicly named either company or platform. · Cloud, Identity & Data Exposure

in A Trusted Company Connection Exposes 8.8 Million Danish CPR Records

October 1, 2026

  • ShinyHunters is publicly defiant after the Amsterdam arrest, claiming it never intended to publish the FBI data and demanding the bureau retract an earlier advisory. Danish CERT notes the arrest happened on 15 September — before the claimed FBI breach — and that investigators seized devices holding data tied to two planned killings abroad (SecurityWeek, CERT.dk) (earlier coverage). · Threat Intelligence

in An Encoded Character Away From Admin: Cisco SD-WAN Manager Exploited in the Wild

September 30, 2026

  • ShinyHunters' alleged leader arrested in the Netherlands. Dutch police arrested a 24-year-old Amsterdam man on 15 September; the FBI's Cyber Division AD Brett Leatherman publicly called him one of the group's alleged leaders and told remaining members to turn themselves in. A Rotterdam court extended pre-trial detention by at least 90 days on 29 September, and police say further arrests are not ruled out. The FBI puts the group at 140+ organizations breached since last year and at least $70 million in extortion payments, typically via corporate SSO, third-party vendors and SaaS platforms like Salesforce and Snowflake. Dutch police add that material recovered from the suspect's laptop concerns two murders to be committed abroad, with indications he gave the order (BleepingComputer, Politie) (earlier coverage). The group has since put out a statement claiming its operations and infrastructure remain "completely fine" (Dark Web Informer), and CERT.dk notes it has resumed Oracle PeopleSoft CVE-2026-35273 attacks (CERT.dk). · Threat Activity

in Mandiant Names the NetScaler Post-Exploitation Kit as Patch Rates Stay Under 10%

September 29, 2026

  • ShinyHunters restarted mass exploitation of Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8), and Mandiant says the group specifically adapted to published defensive guidance, targeting organisations that applied the workarounds but never installed the June 10 patch. Webshells landed on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation and government; Mandiant urges reviewing database logs for queries against HR, payroll and student-records tables (The Record, The Hacker News). · Threat Activity
  • Dutch police confirmed an arrest in the ShinyHunters investigation: a 24-year-old Amsterdam man, named by RTL as Pepijn van der S., detained around 16 September and appearing before the Rotterdam court on 29 September. He was convicted in 2023 of hacking and extortion and released earlier this year. ShinyHunters told RTL the person "has no connection to us" (RTL Nieuws, KrebsOnSecurity). · Threat Activity

in PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch

September 27, 2026

  • ShinyHunters (UNC6240) resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273 with a one-character WAF bypass: requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAF and reverse-proxy rules match the literal path before URL decoding while the PeopleSoft app server decodes and routes to the vulnerable servlet — meaning operators who believed their WAF rules mitigated exposure are still reachable. Mandiant/GTIG report web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation and government, and stress WAF rules are not a substitute for the June out-of-band patch. Hunt for percent-encoded variants in PIA WebLogic access logs and inspect PSEMHUB.war/ for x.jsp, u.jsp, tunnel.jsp, tunnel.jspx and Ple64.exe — the last signed with a valid EV certificate via Sectigo (Google Cloud, BleepingComputer). (earlier coverage) · Threat Activity

in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week

September 26, 2026

  • ShinyHunters (UNC6240) has resumed mass exploitation of CVE-2026-35273, the unauthenticated RCE in Oracle PeopleSoft PeopleTools (CVSS 9.8, emergency patch 10 June), with a summary of Mandiant/Google Threat Intelligence findings saying the new wave specifically targets organisations that deployed WAF rules as mitigation but never installed the patch — and bypasses those rules trivially (@DarkWebInformer). The group separately told The Register it hacked the FBI to "protect our business" (The Register). · Emergency Advisories & Active Exploitation
  • Cl0p has moved its leak site to a new onion address and confirmed the old server ran Grav CMS 1.7.43 with an un-updated plugin; BleepingComputer reports the bug used is an unauthenticated path traversal, and Grav's developers confirmed ShinyHunters' technical description was accurate (BleepingComputer). Cl0p denies any relationship with ShinyHunters and disputes that operational or financial data was taken — though it has since been quietly removed from ShinyHunters' leak site (earlier coverage). · Emergency Advisories & Active Exploitation

in Kiteworks Orders a Global Shutdown on a Zero-Day Warning

September 24, 2026

  • FBI confirms it is investigating the ShinyHunters claim. The group defaced FBIjobs.gov on Tuesday with its Pokémon mascot and posted a leak-site statement demanding the bureau retract a May public service announcement — issued after the Instructure attack — within a week or it will publish data on every agent and applicant. It supplied 5,000 sample agent records to 404 Media and other outlets, which confirmed their legitimacy; the special agent application portal remained offline Wednesday morning. The group claims 2–3 TB via a zero-day and denies swatting, sextortion and membership of The Com (The Record, SecurityWeek) (earlier coverage). · Threat Activity

in The Exploit Is Public, the Ubuntu Patch Isn't

September 23, 2026

  • ShinyHunters says it breached the FBI through an unpatched Oracle PeopleSoft zero-day on the bureau's jobs site, claiming pre-auth RCE, lateral movement onto FBI-managed servers in AWS GovCloud, and 2–3TB of data on current, former and prospective employees — allegedly touching HR, MedLink and CJIS. The group defaced fbijobs.gov, which is now offline "for maintenance," and says it wants no money: it is demanding the FBI retract a 15 May bulletin within a week. The FBI has not confirmed the breach, and neither Oracle nor AWS responded to inquiries (The Register, BleepingComputer). The group also named German dialysis firm Fresenius Medical Care as a victim (@DarkWebInformer); its Cl0p leak-site hijack ran in earlier coverage. · Threat Activity & Breaches

in Attack Chains That Run Themselves

September 22, 2026

  • ShinyHunters escalated its extortion of Cl0p: a 21 September message on the hijacked leak site says demands rise every 24 hours without engagement, adds a public apology to the terms, and threatens to publish which companies paid Cl0p, how much, and the receiving Bitcoin addresses — Cl0p replied, and Shiny replied again (earlier coverage). Dark Reading's angle is the one that matters for defenders: organisations that quietly paid may now face renewed extortion from a second crew. The Record, Dark Reading · Threat Activity

in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance

September 21, 2026

  • ShinyHunters has compromised and defaced the Cl0p leak site, replacing the page behind Cl0p's CAPTCHA with its own Umbreon-branded imagery, per DarkFeed's Ido Cohen (earlier coverage). What's new today is the demand: an updated 20 September message addressed to "Likhogray & Tarasov" demands all proceeds from the Oracle EBS campaign "plus more AND WITH INTEREST," threatening to publish which companies paid, how much, and to which Bitcoin addresses, with 66 hours on the clock (Dark Web Informer). Catalin Cimpanu frames it as ShinyHunters demanding the money Cl0p made from EBS. · Threat Activity
  • Google had an undercover Mandiant analyst inside TeamPCP's inner circle, disclosed by GTIG researcher Austin Larsen at LABScon. The persona had spent months building trust with an actor who was later invited into the group, meaning "almost day one, Mandiant was watching everything behind the scenes" — letting Google warn victims and disrupt exploitation during a campaign that tainted hundreds of open-source packages, used a Dune-themed self-spreading worm, and breached more than a thousand companies (Ars Technica, earlier coverage). Two Australians in their early 20s were arrested last month and described by the AFP as principal participants. Larsen also says internal chat visibility showed someone in the core circle using an AI tool to develop a zero-day against a widely used login product, aimed at bypassing its 2FA. Google additionally received intelligence from ShinyHunters, which had partnered with TeamPCP before turning on it. · Threat Activity

in ShinyHunters Takes Cl0p's Leak Site Hostage

September 20, 2026

  • ShinyHunters breached and defaced the Cl0p ransomware gang's Tor leak site, then demanded an eight-figure payment. The intrusion started Friday night via what ShinyHunters claims is an unauthenticated file upload flaw in Grav CMS, used to plant a text file ("Maybe don't try to threaten us next time") on Cl0p's server; hours later the site was replaced with the group's Umbreon ASCII art. ShinyHunters told BleepingComputer it took source code, Grav plugins, everything under /var/log, and the private keys for Cl0p's onion service — which would let it rehost the same .onion address. BleepingComputer confirmed the defacement and the uploaded file but has not verified the data-theft or key claims. BleepingComputer, DarkWebInformer · Threat Activity

in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks

September 14, 2026

  • Stolen police credentials opened Florida’s DAVID driver database. Florida says attackers used credentials taken from an officer’s personal device, The Record reports. BleepingComputer identifies the compromised account as belonging to a police-department employee with access to the FLHSMV system. ShinyHunters claims more than 2.8 million driver records, but the state’s confirmation establishes the access route, not necessarily the group’s full claimed scope. · Identity & Data Exposure

in Hermes Logs Reveal Unattended AI Post-Exploitation

September 13, 2026

  • Anthropic's 154-page report gains actor-level detail. The Russian state-sponsored cluster it calls GTG-20006 — sharing tradecraft with Midnight Blizzard/APT29 — built an AI-assisted workflow to rebuild malware after detection, in a campaign against more than 20 government, intelligence, diplomatic and defence organisations (The Hacker News, The Record). GTG-50014 (aka MeowSHA), a French-speaking suspected ShinyHunters affiliate, ran 10 AWS EC2 workers that pulled 1.8 million distinct Android APKs, scanned them with TruffleHog and pushed verified secrets to Telegram; a second ShinyHunters affiliate hit SaaS vendors to reach roughly 50 downstream organisations and maintained an autonomous vulnerability-research programme producing working exploits for unknown flaws in network and security appliances (The Hacker News, earlier coverage). Anthropic also describes users in Houthi-held Yemen attempting weapons development, including a failed guided-rocket test, without fielding an operational device (SecurityWeek). Worth reading the caveats: @cyb3rops notes the "sandbox escape" was internet access enabled by a misconfiguration, not a VM or container escape, and the "safety monitor" was another LLM reviewing transcripts after the fact. · AI-Enabled Threat Activity

in Artifactory Chains Give Attackers Admin in Under Five Minutes

September 11, 2026

  • Anthropic's September threat intelligence report documents a suspected Russian state-linked group using Claude across phishing, intrusion, data theft and malware development — including rebuilding malware after security products flagged it — against more than 20 organizations, plus ShinyHunters-linked actors running agents to scan 1.8 million Android apps. The framing is that AI is moving from advice into the operational loop: recon, exploitation, credential theft, persistence and victim-data triage (Anthropic). Practitioners are not uniformly sold: @keyth0s argues Anthropic's classifiers are "pretty bad for cyber dual use things" and easy to trip without real evidence (discussion). · Offensive AI in the Wild
  • AdaptHealth put the count at 4,115,802 individuals in its HHS filing. Entry was on 5 June through social engineering that compromised a third-party contractor's privileged account; a ransom demand followed on 15 June. ShinyHunters was named by HIPAA Journal, though the company's entry has since vanished from the group's portal (BleepingComputer). · Breaches

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

September 8, 2026

  • ShinyHunters claims a breach of the Florida DMV, using Jeffrey Epstein's driver's licence record as the public proof sample on its pay-or-leak site (vx-underground); Dark Web Informer suggests the licence data may have been bought from the Nexus market actor rather than stolen directly. In the Netherlands, police broadcast the Odido vishing suspect's voice on Opsporing Verzocht on 7 September: a Dutch-speaking man phoned customer service posing as an IT-department colleague and an employee unintentionally granted him access to an internal system, exposing data on more than six million customers. A voice expert concluded it is a real human voice, not AI-generated, and noted the caller's fluent English IT jargon suggests helpdesk experience (Dutch National Police). A ~100 GB Odido dataset is now being distributed publicly rather than sold (Daily Dark Web). · Threat Activity
  • Mathspace says 1,079,819 students, staff and parents in Australia and New Zealand had data stolen after attackers exploited a vulnerability in its self-hosted Metabase install to gain administrator access without a login. Access began 10 August, the Australian reporting database was downloaded 27 August, and the theft was confirmed 3 September; no academic records, password hashes, tokens or SSO credentials were exposed (BleepingComputer) — the latest in the run of Metabase SQL injection zero-day intrusions linked to ShinyHunters. · Breaches

in N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited

July 27, 2026

  • ShinyHunters leak data is fueling a $2,000 sextortion campaign. Scammers are mining email addresses from previously dumped datasets — attributed to Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill — to send targeted-looking Bitcoin demands; BleepingComputer confirmed some recipients appeared in the referenced dumps (BleepingComputer). · Threat Activity

in Two Live Exploits and a Bench of Fresh Offensive Tooling

July 7, 2026

A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary

A 16-year-old KVM hypervisor vulnerability (CVE-2026-53359) enabling guest-to-host escape is under public exploitation, with panic PoCs already available. Adobe ColdFusion CVE-2026-48282 (CVSS 10.0) is being actively exploited in the wild within hours of disclosure, with unauthenticated remote code execution possible. AI-powered coding agents are now a live attack surface, with researchers demonstrating agent hijacking, malicious skill injection, and data exfiltration through prompt injection in creator tools like YouTube's Ask Studio. Iran-linked hackers are deploying a new modular C2 framework called Cavern against Israeli targets, while ClickFix malware operators are leveraging blockchain as a resilient command infrastructure.

June 18, 2026

  • Oracle PeopleSoft CVE-2026-35273 unauthenticated RCE is under active exploitation by ShinyHunters (aka Bling Libra), with the education sector hit hardest since at least late May. Horizon3 confirmed exploitation predating disclosure, and Unit 42 corroborates the campaign against universities. watchTowr warns that "vibecoded" PoCs circulating are only the first-stage SSRF, not the full chain — treat public exploits skeptically (watchTowr). · Vulnerabilities & Exploits
  • Kodak confirmed a data breach claimed by ShinyHunters, working with external responders; scope not yet verified (BleepingComputer, SecurityWeek). · Data Breaches (Nordic emphasis)

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel

June 17, 2026

  • Instructure Canvas breach hit 275 million students: ShinyHunters exploited stored XSS in the support-ticket system, enabled by poor content isolation and shared infrastructure. Scott Helme. · Data Breaches & Extortion
  • ShinyHunters added American Tower, JCPenney, Madison Square Garden Sports, Ralph Lauren, and Nexstar to its leak site (claims unverified), and separately claims a PeopleSoft zero-day heist of ~297GB from the Council of Europe. Kodak and Infinite Campus (137K school staff via Salesforce) also confirmed/were named in ShinyHunters incidents. Daily Dark Web, SecurityWeek, BleepingComputer. · Data Breaches & Extortion

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists