Actor Profile

ShinyHunters is a prolific cybercrime group known for large-scale data theft and extortion operations. The group operates as a collective with multiple members across jurisdictions. Dutch authorities arrested Pepijn van der Stap (aka "Umbreon"), a 24-year-old convicted cybercriminal from the Netherlands, on suspicion of aiding ShinyHunters in data thefts and extortions. Van der Stap was previously convicted in 2023 for cybercrime activity that earned between €1.5-2.7 million, sentenced to four years (one suspended), and released in December 2025. He had worked as a software engineer at cybersecurity firms while simultaneously conducting criminal operations. Following the arrest around September 16, 2026, remaining ShinyHunters members dramatically escalated their attacks, targeting high-profile victims including the FBI and the Russian ransomware group Cl0p. The group demonstrated sophisticated social engineering capabilities and rapid exploitation of zero-day vulnerabilities, showing operational resilience despite law enforcement pressure.

TTPs (Tactics, Techniques, Procedures)

ShinyHunters employs social engineering techniques to gain initial access, as demonstrated in the February 2026 Odido breach where they tricked an employee into logging into a spoofed website to harvest credentials. The group rapidly weaponizes zero-day vulnerabilities, exploiting CVE-2026-35273 in Oracle PeopleSoft starting in June 2026 before patches were available. They demonstrated evasion capabilities by using URL-encoding techniques to bypass web application firewall rules released by Mandiant. Their operations focus on data theft and extortion, targeting sensitive information including Social Security numbers, medical records, psychiatric files, and personal data of government officials and telecommunications customers. The group maintains operational security through distributed membership across multiple countries and provides financial and legal support to arrested members. They leverage English-language underground forums (historically RaidForums and Breached) for data sales and communications.

Targets & Patterns

ShinyHunters targets organizations holding large volumes of sensitive personal data, with a focus on high-value and high-profile victims. Primary targets include telecommunications providers (Odido - 6.2 million Dutch citizens' data), government agencies (FBI job application site - 5,000+ officials including special agents and cyber threat investigators), and paradoxically, other cybercrime groups (Russian ransomware group Cl0p). The group appears to prioritize targets in the Netherlands, United States, and Russia based on recent activity. Their victim selection demonstrates both financial motivation (data suitable for extortion and sale) and potentially retaliatory or attention-seeking behavior, particularly the dramatic escalation following the arrest of a suspected member. The FBI breach specifically targeted sensitive information including Social Security numbers, job titles, team assignments, psychiatric records, and medical files - data with significant intelligence and extortion value. The targeting of Cl0p suggests inter-criminal conflict or opportunistic exploitation within the cybercrime ecosystem.

Historical Context

Pepijn van der Stap operated under the alias "Umbreon" and was active on now-defunct forums RaidForums and Breached, where he sold stolen databases including 2.3 million Dutch citizens' records in September 2021. His 2023 conviction covered a string of data thefts and extortions generating €1.5-2.7 million. Van der Stap maintained a dual identity, working legitimately as a software engineer at Amsterdam cybersecurity startup Hadrian and volunteering at the Dutch Institute for Vulnerability Disclosure (DIVD) while simultaneously conducting cybercrime. After his December 2025 prison release, he claimed to be reformed and was employed as offensive security lead at Neo Security. His suspected re-arrest in September 2026 for aiding ShinyHunters indicates either continued involvement or relapse into criminal activity. The group's February 2026 Odido breach affecting 6.2 million people preceded the current escalation. ShinyHunters' post-arrest statement to Dutch media demonstrated defiance and threatened further attacks, suggesting the group views law enforcement action as provocation rather than deterrent.

Defensive Recommendations

  • Immediately patch CVE-2026-35273 in Oracle PeopleSoft deployments; if patching is delayed, implement web application firewall rules with awareness that URL-encoding can bypass basic filters
  • Implement multi-factor authentication resistant to phishing (FIDO2/WebAuthn) for all employee access to sensitive systems, particularly HR and recruitment platforms
  • Conduct security awareness training focused on social engineering tactics, including credential harvesting via spoofed login pages and vishing (voice phishing) techniques used in the Odido breach
  • Monitor for anomalous access patterns to HR systems and job application portals, particularly bulk data extraction or access to sensitive employee medical/psychiatric records
  • Implement insider threat monitoring for employees with dual roles in offensive security or vulnerability research, including behavioral analysis and access logging to detect potential abuse of privileged access

---

# Geopolitical Context

Geopolitical Context

The arrest of a suspected ShinyHunters affiliate in the Netherlands has triggered a significant escalation in the group's operations, with attacks now targeting both U.S. federal law enforcement infrastructure and Russian-linked cybercriminal entities. This pattern suggests ShinyHunters operates as a financially motivated collective with sufficient operational resilience to continue high-impact intrusions despite law enforcement pressure. The targeting of both Western government institutions and Russian ransomware groups indicates the actor maintains ideological flexibility and prioritizes financial gain over geopolitical alignment. The group's public defiance of Dutch authorities and provision of legal/financial support to detained members demonstrates organizational cohesion and may signal an attempt to deter future cooperation with law enforcement by arrested affiliates.

State Actor Alignment

ShinyHunters appears to operate as a financially motivated cybercriminal collective without clear state sponsorship. The group's willingness to target both U.S. federal agencies (FBI) and Russian-linked ransomware operations (Cl0p) suggests independence from major state actors. The suspect, Pepijn van der Stap, was previously convicted in 2023 for data theft and extortion activities that generated between €1.5 million and €2.7 million, consistent with profit-driven cybercrime rather than state-directed espionage. Dutch law enforcement cooperation with international partners on this case reflects ongoing Western efforts to disrupt transnational cybercrime networks. The group's exploitation of a PeopleSoft zero-day vulnerability (CVE-2026-35273) against multiple victims demonstrates sophisticated technical capability but does not necessarily indicate state-level resources or tasking.

Business Impacty pro region

The breach of FBI personnel data, including Social Security numbers, psychiatric records, and information on over 5,000 officials—some involved in cyber threat investigations—represents a significant counterintelligence risk for U.S. law enforcement operations. Compromised details on agents investigating foreign state-backed cyber threats could enable adversary intelligence services to identify, target, or compromise ongoing investigations. For Europe, the Odido breach affecting 6.2 million Dutch citizens and the group's explicit threats of further attacks in the Netherlands underscore persistent vulnerabilities in critical telecommunications infrastructure. The suspect's employment history at cybersecurity firms (Hadrian, Neo Security) and volunteer work with the Dutch Institute for Vulnerability Disclosure raises concerns about insider threat risks within the European cybersecurity sector. ShinyHunters' targeting of Cl0p—a ransomware group previously linked to Russian-speaking cybercriminal ecosystems—may indicate shifting dynamics within underground markets or retaliatory actions between competing criminal enterprises.

Forecast

If ShinyHunters continues exploiting the PeopleSoft vulnerability or similar enterprise HR platform weaknesses, additional breaches of government and corporate personnel systems are likely in the near term, particularly among organizations slow to patch CVE-2026-35273 or implement effective web application firewall rules. If the arrested suspect provides intelligence to Dutch authorities, law enforcement may gain actionable insights into ShinyHunters' infrastructure and membership, potentially enabling further arrests or disruptions—though the group's demonstrated operational continuity suggests a distributed structure resilient to individual member losses. If the compromised FBI personnel data is weaponized by hostile intelligence services or sold to state-aligned actors, U.S. counterintelligence operations may face heightened risks of agent identification and targeting. If ShinyHunters follows through on threats of escalated attacks in the Netherlands, Dutch critical infrastructure and telecommunications providers should anticipate renewed social engineering and technical intrusion attempts in the coming weeks to months.