AI-generated · no human review · verify critical claims against the linked source.how it works →
ScatteredLapsussHunters
actor
· actor:scatteredlapsusshunters
Cybercrime collective multiple sources describe as an amalgamation of Scattered Spider, LAPSUS$ and ShinyHunters. Krebs on Security (2026-09-28, citing multiple sources) reports the collective, headed by a Jordan-based teenage cybercriminal known as 'Rey', has effectively taken control of the ShinyHunters brand and driven its 2026 pivot toward high-risk, non-financially-motivated operations, including the FBI breach and the extortion of rival ransomware group Cl0p.
Krebs on Security (2026-09-28): sources say ShinyHunters' 2026 operations are now effectively directed by 'Rey' of ScatteredLapsussHunters (SLSH), which experts say is 'an amalgamation of three hacking groups, Scattered Spider, LAPSUS$ and ShinyHunters.'
3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
Initial AccessExploit Public-Facing Application
CollectionData from Cloud Storage
ImpactDefacement: External Defacement
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda. External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.
The extortion group ShinyHunters claims it breached the FBI's own recruitment infrastructure using a new Oracle PeopleSoft zero-day (BleepingComputer, 2026-09-22). PeopleSoft is often used by human resources and recruiters to store job applicants' personal information (TechCrunch, 2026-09-22). "The threat actors told BleepingComputer the vulnerability allows remote code execution and that they used it Monday night to access FBI systems before moving laterally into FBI-managed AWS GovCloud infrastructure" (BleepingComputer, 2026-09-22). ShinyHunters claims it stole between 2TB and 3TB of data spanning current and former FBI employees and job applicants, and that it compromised additional internal services including Criminal Justice, HR and Medlink systems along the way (BleepingComputer, 2026-09-22). It told Axios the data includes names, agent statuses, emails, phone numbers, home addresses and in some cases spouses' information including Social Security numbers, a claim Axios reports as more than 2 terabytes (Axios, 2026-09-22). According to the group, which shared a screenshot, it defaced the FBI's careers site, apply.fbijobs.gov, with its Umbreon Pokémon logo and a message claiming the theft (BleepingComputer, 2026-09-22); the site was down on 2026-09-22 (TechCrunch, 2026-09-22) and remained offline on 2026-09-28 (CyberScoop, 2026-09-28). The FBI's first response was a single statement: "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating," (FBI, quoted by BleepingComputer, 2026-09-22), and "BleepingComputer has not independently verified the alleged zero-day, lateral movement, or amount of stolen data" (BleepingComputer, 2026-09-22). The FBI did not then confirm whether its systems were breached or data was stolen (BleepingComputer, 2026-09-22). Its statement of 2026-09-23, titled "FBI Statement on Compromise of fbijobs.gov Portal and Alleged Impact to FBI Employee PII", says it is aware of a group "claiming a compromise" of the portal, that "the point of breach is still undetermined" between a third party and the FBI's own enterprise, and that it is investigating with the third-party providers that support fbijobs.gov (FBI, 2026-09-23); on 2026-10-06 its cyber chief placed the cause at a third-party-managed platform and a contractor's unapplied patch (see the update of 2026-10-07). Contradiction: Krebs on Security describes that release as a brief statement "confirming the hack" (Krebs on Security, 2026-09-28), while CyberScoop reports that the FBI "hasn't confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly" (CyberScoop, 2026-09-28) and BleepingComputer, recapping the FBI's first response, that it "did not confirm that its systems had been breached or that data was stolen" (BleepingComputer, 2026-09-26).
404 Media first reported the claim after receiving a sample of roughly 5,000 alleged FBI personnel records; "the publication said it verified that some information in the sample was accurate, including phone numbers corresponding to people with the same names and numbers associated with US Department of Justice personnel" (BleepingComputer, relaying 404 Media, 2026-09-22), which supports that some genuine personnel data changed hands without confirming the exploitation mechanism or the full claimed volume. ShinyHunters' own account of the vulnerability is unusually specific but still entirely self-reported: "The Oracle product we exploited the 0day in is PeopleSoft. We found another one yesterday and immediately exploited it on the FBI," (ShinyHunters, quoted by BleepingComputer, 2026-09-22) and the group says it is now exploiting the same alleged flaw against other organizations, including Fortune 500 companies, after previously targeting the education sector with a PeopleSoft campaign (BleepingComputer, 2026-09-22). ShinyHunters frames the FBI intrusion as retaliation for a May 2026 FBI/IC3 flash report naming the group, demanding a correction within one week rather than a ransom and claiming the demand is not financially motivated (BleepingComputer, 2026-09-22). The week before, ShinyHunters separately defaced the ransomware group Clop's own Tor leak site over an unrelated dispute, using it to extort Clop directly (BleepingComputer, 2026-09-19).
The threat actors told BleepingComputer the vulnerability allows remote code execution and that they used it Monday night to access FBI systems before moving laterally into FBI-managed AWS GovCloud infrastructure.
The publication said it verified that some information in the sample was accurate, including phone numbers corresponding to people with the same names and numbers associated with US Department of Justice personnel.
BleepingComputer, relaying 404 Media's own verification
ShinyHunters told Axios in an email that the stolen data includes names, FBI agent statuses, emails, phone numbers, home addresses and "sometimes even spouse information," including their Social Security numbers.
ShinyHunters has confirmed to BleepingComputer that they used this WAF bypass against FBI Jobs, but continue to claim that they also exploited "NEW unknown vulnerability in the same PSEMHUB component."
The FBI confirmed that it was investigating claims of unauthorized activity affecting FBIjobs.gov but did not confirm that its systems had been breached or that data was stolen.
The FBI hasn't confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly. The agency said it is "actively and aggressively investigating" the incident, the root cause and its alleged impact to FBI employees' personally identifiable data in a statement Wednesday.
Limited samples of the stolen data contain FBI agents' personal contact information, details on family members, office and duty assignments and, in some cases, information on agency personnel specialties, multiple sources said.
In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p.
Since the very beginning we had made our decision that we would never publish this data. We have never intended to nor have we ever planned to
ShinyHunters, quoted by Nextgov/FCW
Reuters reported Friday that records circulated by the hackers included psychiatric and medical evaluations. The BBC also reported seeing blood and urine test results.
The FBI is aware of a cybercriminal enterprise group claiming a compromise of the fbijobs.gov portal and alleged impact to FBI employee personally identifiable information (PII).
ShinyHunters has now given a partial answer of its own to the central open question, whether its claimed FBI-specific zero-day was real. Mandiant/GTIG's report on a separate, wider mass-exploitation wave against the already-known CVE-2026-35273 documents a URL-encoded WAF-bypass technique (requesting /%50SEMHUB/ in place of /PSEMHUB/), and BleepingComputer reports: "ShinyHunters has confirmed to BleepingComputer that they used this WAF bypass against FBI Jobs, but continue to claim that they also exploited "NEW unknown vulnerability in the same PSEMHUB component."" (BleepingComputer, 2026-09-26). By the group's own account, at least part of the FBI Jobs intrusion used a known technique against a known CVE rather than the wholly undisclosed zero-day it first claimed, though ShinyHunters still claims an additional, still-unconfirmed vulnerability was also involved. The FBI has not confirmed that its systems were breached or that data was stolen (BleepingComputer, 2026-09-26), and no party has confirmed or denied either technical claim.
The FBI has issued a further statement on the fbijobs.gov incident (FBI, 2026-09-23). CyberScoop reports: "The FBI hasn't confirmed the type or amount of data compromised or attributed the breach
to ShinyHunters directly. The agency said it is 'actively and aggressively investigating' the incident, the
root cause and its alleged impact to FBI employees' personally identifiable data in a statement Wednesday"
(CyberScoop, 2026-09-28). Nextgov/FCW
reports that Reuters found the circulated records included psychiatric and medical evaluations, and that the
BBC separately reported seeing blood and urine test results: "Reuters reported Friday that records circulated
by the hackers included psychiatric and medical evaluations. The BBC also reported seeing blood and urine test
results"
(Nextgov/FCW, 2026-09-28).
The group separately provided Nextgov/FCW a roughly 5,000-entry sample of names, home addresses, phone numbers
and relatives' information, and Nextgov/FCW's earlier reporting, citing two people familiar with the matter, says the exposed data covers intelligence analysts working on Russia, China, Hezbollah and cartel matters, plus personnel in the Bureau's Remote Operations Unit, which develops tools to target computers and networks
(Nextgov/FCW, 2026-09-24).
CyberScoop separately reports: "Limited samples of the stolen data contain FBI agents'
personal contact information, details on family members, office and duty assignments and, in some cases,
information on agency personnel specialties, multiple sources said"
(CyberScoop, 2026-09-28). Security
researchers Jon DiMaggio (Arkem Cyber) and Cynthia Kaiser (a former FBI official, now at Halcyon) warn the
exposure creates counterintelligence and physical-safety risk for agents on sensitive cases, and that data
already shared with journalists as proof samples is irretrievably disseminated regardless of any later takedown.
ShinyHunters told Nextgov/FCW it will not publish the stolen data: "Since the very beginning we had made our
decision that we would never publish this data. We have never intended to nor have we ever planned to"
(Nextgov/FCW, 2026-09-28).
The group had earlier said the attack was retaliation for the FBI's May 2026 advisory on its operations (PSA260515), gave the FBI one week to correct or remove it while calling the demand neither financially motivated nor extortion, rejected claims that it is part of "The Com", and disputed the advisory's claims that it harasses victims and their relatives, conducts swatting attacks and falsely claims to hold compromising material (BleepingComputer, 2026-09-22). In its later statement to Nextgov/FCW, it called the confrontation "a marketing campaign to protect our business and actively combat disinformation", said "This was not a threat. It may have been worded like a threat", and claimed it had never expected compliance (Nextgov/FCW, 2026-09-28).
Dutch police separately confirmed, via a statement on X on 2026-09-28, the arrest of a 24-year-old suspect connected to the ShinyHunters investigation (Krebs on Security, 2026-09-28). Dutch police are separately asking
the public to help identify a voice in a recorded February 2026 call in which a ShinyHunters member
social-engineered access into Odido, the country's largest mobile carrier; Krebs states it remains unclear
whether police have matched that voice to a confirmed identity, so the Odido case should not be read as resolved or connected to the September arrest. Krebs reports: "In the days immediately following the suspect's arrest,
remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the
FBI and extorting the Russian ransomware group Cl0p"
(Krebs on Security, 2026-09-28).
Multiple sources cited by Krebs describe a teenage cybercriminal known as "Rey," who operates as part of a collective calling itself ScatteredLapsussHunters, as having taken effective control of ShinyHunters' operations
and driven what they call "a major pivot away from the more measured tenor of the hacking gang's operations", toward high-risk targets including the FBI and Cl0p; sources say the FBI defacement reused artwork associated with the arrested suspect, possibly to pin the FBI intrusion on him rather than on the group's current operators. CyberScoop separately
quotes DiMaggio's independent assessment that "ShinyHunters" today operates as a criminal brand used by a fluid
network rather than a single fixed group, corroborating the brand-fragmentation picture without itself
confirming the ScatteredLapsussHunters/Rey narrative.
ShinyHunters told BleepingComputer it used the URL-encoded WAF bypass against FBI Jobs, and it still claims a further unknown flaw in the same PSEMHUB component (BleepingComputer, 2026-09-26). That bypass is the technique used against CVE-2026-35273, which CISA listed as exploited on 2026-06-12 (CISA KEV catalog, 2026-06-12). The takeaway previously said no CVE was involved. The CVE link is the group's own account, and the FBI said on 2026-09-23 that the point of breach, a third party or its own enterprise, was still undetermined (FBI, 2026-09-23).
The FBI's statement of 2026-09-23 is titled as a statement on the "Compromise of fbijobs.gov Portal" but says a group is "claiming a compromise" (FBI, 2026-09-23). Krebs on Security reads it as confirming the hack (Krebs on Security, 2026-09-28), while CyberScoop reports that the FBI has not confirmed the type or amount of data or attributed the breach to ShinyHunters (CyberScoop, 2026-09-28). The 2026-09-29 update presented the statement as a confirmation without noting that this reading is disputed, and is corrected in place.
The 2026-09-29 update also called the group's motive coercive rather than financial. The group had framed its demand that the FBI correct or remove its May advisory as neither financially motivated nor extortion (BleepingComputer, 2026-09-22), and later told Nextgov/FCW the confrontation was "a marketing campaign" and "not a threat", claiming it had never expected compliance (Nextgov/FCW, 2026-09-28).
FBI cybersecurity chief Brett Leatherman gave Nextgov/FCW the bureau's clearest account of the cause so far: "the incident occurred as the result of a security failure of a platform managed by a third-party organization", because "a contractor failed to implement a security patch explicitly issued to secure the platform", and the FBI has removed the contractor (Nextgov/FCW, 2026-10-06). A person with knowledge of the matter told Nextgov/FCW that Accenture is responsible for software patch management and maintaining custom code at the FBI, and that Oracle, whose PeopleSoft platform ShinyHunters claimed as the initial access point, provided the security patches that were not integrated (Nextgov/FCW, 2026-10-06). SecurityWeek, citing Reuters' sources, says the system is Oracle's PeopleSoft human resources platform and the outside organization is Accenture; Accenture did not answer questions about the patching failure and said only that it is proud to support the mission of the FBI (SecurityWeek, 2026-10-06).
This replaces the FBI's statement of 2026-09-23 that the point of breach, a third party or its own enterprise, was undetermined: the failure is now placed at a third-party-managed platform. The FBI's statement names neither the product, the contractor nor a CVE, and Nextgov/FCW notes it does not say why the patch was missed (Nextgov/FCW, 2026-10-06). The link to CVE-2026-35273 stays ShinyHunters' account, given to BleepingComputer (BleepingComputer, 2026-09-26).
Nextgov/FCW relays Reuters' report of 2026-10-03 that a suspected ShinyHunters member had been detained in Jordan and was helping investigators (Nextgov/FCW, 2026-10-06). SecurityWeek says this is the member known as Rey (SecurityWeek, 2026-10-06). An FBI spokesperson told The Register on 2026-10-05 that the bureau has "already worked with partners to arrest multiple subjects" while declining to comment on specific arrests (The Register, 2026-10-05). SecurityWeek adds that a post urging organizations to pay has been removed from the group's site while its most recent victim post is dated 2026-09-22 (SecurityWeek, 2026-10-06).