ShinyHunters Group Faces Double Arrests; FBI Targets Operations

What Happened

Two ShinyHunters operatives were detained—16‑year‑old Saif al‑Din Khader in Jordan and 24‑year‑old Pepijn van der Stap in the Netherlands—after the FBI announced its intent to pursue the group.

Who Is Affected

ShinyHunters, an umbrella for Scattered Spider, LAPSUS$ and the original ShinyHunters, has targeted enterprises such as Kodak, McKesson, Instructure (Canvas) and even the FBI. Their attacks combine social engineering with software exploits, notably a PeopleSoft vulnerability that exposed terabytes of HR data.

Impact on Defenders

Defenders should review recent PeopleSoft advisories, verify that all HR and third‑party applications are patched, and monitor for unusual outbound traffic to known ShinyHunters infrastructure. The group’s recent compromise of Clop and the FBI indicates they will target high‑profile victims and may use stolen credentials to pivot into other systems.

Immediate Actions

• Validate and apply the latest PeopleSoft security patches.
• Implement multi‑factor authentication on all third‑party service accounts.
• Deploy threat‑intel feeds that flag ShinyHunters IP ranges and domain names.
• Conduct a rapid forensic review of any recent data exfiltration or credential compromise.
• Coordinate with law enforcement if you suspect a ShinyHunters intrusion.

Long‑Term Measures

Invest in continuous monitoring of privileged accounts, enforce least‑privilege principles, and conduct regular phishing simulations to harden staff against social‑engineering tactics.