FBI presses ShinyHunters members to surrender after Dutch police hold an alleged leader

Dutch police said the suspect is a 24-year-old man from Amsterdam who was arrested on September 15.

Dutch police said the suspect is suspected of playing a role within ShinyHunters and participating in a criminal organization.

"Following his arrest on September 15, a large amount of information was found on his laptop, including details about two murders that were to be committed abroad," the Dutch police announced.

The FBI says ShinyHunters and its alleged co-conspirators have collected at least $70 million in extortion payments.

ShinyHunters claimed responsibility for a data breach at the FBI and told BleepingComputer the breach involved exploitation of an Oracle PeopleSoft zero-day; the FBI's warning came shortly after that claim.

ShinyHunters claimed to have stolen between two and three terabytes of data from FBI systems, including information connected to multiple internal services.

The group provided a sample of about 5,000 FBI personnel records to media organizations, including BleepingComputer, which declined the offer.

The Rotterdam District Court ruled Tuesday that the suspect will remain in pre-trial detention for at least another 90 days.

Dutch police said further arrests have not been ruled out.

ShinyHunters told BleepingComputer the FBI attack was never financially motivated, an extortion attempt, or intended to publish the data.

ShinyHunters claims the FBI attack was done to dispute an FBI advisory stating ShinyHunters actors may exaggerate access to sensitive information, harass victims and their relatives, conduct swatting attacks, and falsely claim to possess compromising material.

ShinyHunters frequently targets corporate SSO accounts, third-party vendors, and cloud-based SaaS platforms such as Salesforce and Snowflake to steal sensitive data before extorting victims with threats to publish it.

404 Media reported that the stolen information exposed names and personal data belonging to members of the FBI's Remote Operations Unit, a team involved in hacking operations.

Reuters reported that some of the exposed personnel were assigned to investigations involving China and Russia.

BleepingComputer reported the FBI is taking a more public approach against the group, with Leatherman directly addressing the remaining ShinyHunters members in Tuesday's video.

"You've heard about the arrest of your colleague. We're confident you've seen or heard things in recent days that the public has not," Leatherman said.

"Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left."

Leatherman warned that investigators are continuing to gather information about those involved in the group and that they are actively being targeted.

"The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours."

Dutch police clarified Tuesday that the arrested suspect was not detained as part of the investigation into the ShinyHunters breach of Dutch telecom provider Odido.

"Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world," FBI Cyber Division Assistant Director Brett Leatherman said in a video released Tuesday.