FBI Director Kash Patel says agents arrested another ShinyHunters suspect, at least the third detained in two weeks since the FBIjobs.gov breach. The group says it is leaving Telegram as members are arrested, and it has promised not to publish the FBI staff data it stole.
Perspective Coverage
14 publishers
- Builder
- Builder 23%
- Operator
- Operator 57%
- Investor
- Investor 20%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+22
- Incentives68
- Confidence64
Japan detained a Russian national alleged to be a core Qilin ransomware member in Osaka in May and has extradited him to Germany. Qilin went on listing victims while he was held, more than 450 since June by BleepingComputer's count.
Perspective Coverage
5 publishers
- Builder
- Builder 7%
- Operator
- Operator 59%
- Investor
- Investor 34%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+18
- Incentives
- Not scored
- Confidence72
Alleged ShinyHunters member Saif al-Din Khader, detained in Jordan on Tuesday, is helping the FBI find other members, two sources told Reuters. A new ShinyHunters leak site went up two days later, suggesting other members still run the extortion.
Perspective Coverage
13 publishers
- Builder
- Builder 14%
- Operator
- Operator 74%
- Investor
- Investor 12%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence62
US authorities arrested Anibal Alexander Canelon Aguirre, alleged developer of Ploutus ATM malware, over $5.4 million stolen in 117 jackpottings. Prosecutors say jackpotting earned money for Tren de Aragua and hit ATMs in 47 states.
Perspective Coverage
3 publishers
- Builder
- Builder 18%
- Operator
- Operator 69%
- Investor
- Investor 13%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence65
PeopleSoft zero-day claim behind the FBI breach rests on ShinyHunters' word alone
ShinyHunters says a second PeopleSoft zero-day let it steal data on every FBI employee, a claim neither the FBI nor Oracle has confirmed. Two suspects have since been arrested, and PeopleSoft customers are still judging their own exposure from analysts' advice.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+40
- Incentives60
- Confidence35
Eurojust says a 16-year-old is the suspected main operator of KillSec, a group it blames for almost 1,000 data-theft extortion attacks since 2024. Both published accounts say its favoured way in was poorly secured access to victims' cloud storage.
Perspective Coverage
14 publishers
- Builder
- Builder 16%
- Operator
- Operator 75%
- Investor
- Investor 9%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+25
- Incentives45
- Confidence76
buildOne report1 publisher Investigators say KillSec got in through weak cloud storage, unpatched software and bought logins
Investigators say KillSec, tied to about 1,000 suspected attacks, got in through software flaws, weak cloud storage and logins bought on the dark web. Those gaps sit in victims' own systems, beyond the reach of any server seizure.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence40
FBI's Brett Leatherman urged ShinyHunters members to surrender after the Dutch arrest of an alleged leader of a group tied to $70 million in extortion. Dutch police have not ruled out more arrests, though the public record so far shows one suspect in custody.
Perspective Coverage
9 publishers
- Builder
- Builder 17%
- Operator
- Operator 68%
- Investor
- Investor 15%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence64
Dutch police detained an alleged ShinyHunters leader on September 15, seven days before the group defaced the FBI's jobs website. The FBI says it is still chasing the rest of the group, so the vendor services and web portals it has used to get in remain the exposure to manage.
Perspective Coverage
3 publishers
- Builder
- Builder 13%
- Operator
- Operator 69%
- Investor
- Investor 18%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence58
Police seized 3,336 computers and 5,200 SIM cards along with scripts and victim databases that some crews sold to each other. The seat count matters more than the arrest count.
Perspective Coverage
3 publishers
- Builder
- Builder 18%
- Operator
- Operator 72%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence64
German and Brazilian police made seven arrests over a four-day raid on online banking accounts in November 2023. The BKA says the entry point was a supplier's flaw, and that supplier still has no name.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 55%
- Investor
- Investor 17%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence72
The four-pillar document published September 9 promises dismantled infrastructure, seized cryptocurrency and faster victim notification, with no deadline or metric attached. For victims, the nearest-term change is who picks up the phone.
Reality
- Evidence60
- Adoption30
- Hype gap+35
- Incentives55
- Confidence65
The Justice Department seized this service's original domain in December 2022 and arrested six people. The FBI has now taken two more of its domains, and the warrant affidavit counts hundreds of thousands of attacks since 2022.
Perspective Coverage
6 publishers
- Builder
- Builder 18%
- Operator
- Operator 74%
- Investor
- Investor 8%
Reality
- Evidence70
- Adoption60
- Hype gap+25
- Incentives40
- Confidence70
Google's undercover analyst watched TeamPCP poison packages from inside its core chat
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence55
Latvian police say one man with an automated scanner and an anonymous mailbox turned two mid-sized company websites into an extortion business. Investigators linked the two cases on similarities in the methods used.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 65%
- Investor
- Investor 12%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+8
- Incentives45
- Confidence72
AFP charges two Perth men over malicious open-source packages that reached 1,000 organisations
The AFP says a syndicate planted code in an open-source repository and harvested more than 500,000 credentials, with remediation running into the hundreds of millions, while the charge sheet names no package and no registry.
Publishers:afp.gov.au
Reality
- Evidence52
- Adoption34
- Hype gap+26
- Incentives74
- Confidence58
AFP charges two men near Perth over the self-spreading worm behind the TeamPCP compromises
Two suspects in Western Australia are in custody over the supply-chain worm that hit Trivy, KICS, LiteLLM and Telnyx. The 500,000 credentials it harvested stay valid until someone rotates them. Only 78,000 have surfaced publicly.
Reality
- Evidence50
- Adoption62
- Hype gap+14
- Incentives45
- Confidence52
Jackal IV's 58 arrests cover under a third of the suspects INTERPOL identified
A week of takedowns removed people and froze assets across five separate actions, while the kit that manufactures the stolen Microsoft 365 sessions those crews depend on still sells on Telegram for $320 a month.
Reality
- Evidence28
- Adoption52
- Hype gap+30
- Incentives58
- Confidence36
Flare traced TeamPCP's GitHub handle to a HackerOne profile carrying a real name
Australian Federal Police arrested two men over malicious code the agency estimates reached more than 1,000 organisations. What identified the alleged leader was a screen name he kept using on other platforms.
Reality
- Evidence45
- Adoption52
- Hype gap+18
- Incentives62
- Confidence55