ShinyHunters cybercriminal group activities

A public feud erupted between the cybercriminal groups ShinyHunters and Clop in September 2026. The conflict intensified when ShinyHunters defaced Clop’s leak site by exploiting a flaw in the Grav content management system. The dispute reportedly involves a disagreement over a server-side request forgery vulnerability, with ShinyHunters claiming Clop used their exploit in attacks against Oracle’s E-Business Suite. During this period, ShinyHunters also claimed to have breached FBI systems, alleging possession of data on all FBI employees.

By October 2026, investigations shifted toward potential collusion between the hacking group and ransomware negotiation firms. Federal authorities are examining allegations that executives in the United States and Canada maintained close ties with ShinyHunters. Specifically, a US-based executive is suspected of helping operate a victim-extortion website that hosted pages for nearly 100 organizations.

Following the arrest of Pepijn van der Stap in the Netherlands, investigators gained access to communications via Signal. This led to the arrest of Canadian cybersecurity executive Edward Dubrovsky in Pennsylvania on federal cyber extortion and conspiracy charges. Investigators suspect these negotiators may have received information regarding new ShinyHunters breaches before the targeted companies were notified of the compromises.