From Pokémon Avatars to Global Extortion: The Rise, Fall, and Retaliation of the ShinyHunters Cybercrime Syndicate

Introduction

In the intricate, shadowy ecosystem of international cybercrime, few names evoke as much immediate chaos and disruption as the collective known as ShinyHunters. Operating at the intersection of high-stakes corporate extortion, massive database heists, and brazen geopolitical targeting, the group has long been a thorn in the side of global cybersecurity agencies.

However, a dramatic series of events centering on the Netherlands, Jordan, and the United States has thrust the syndicate back into the global spotlight. Following the high-profile arrest of a 24-year-old convicted Dutch cybercriminal linked to the group, remaining ShinyHunters members escalated their operations with unprecedented aggression. Their targets included not only major corporate entities and telecommunications giants, but also the United States Federal Bureau of Investigation (FBI) and the Russian-speaking ransomware syndicate Cl0p.

This deep-dive report examines the anatomy of these recent breaches, the complex web of shifting alliances and betrayals within the cybercriminal underground, and the profound implications for international cybersecurity.

Main Facts

The latest wave of cyber-attacks and law enforcement actions centers on a convergence of identity, institutional vulnerability, and escalating geopolitical friction.

• The Suspect: Dutch authorities arrested Pepijn van der Stap, a 24-year-old convicted cybercriminal from Almere and Lelystad, Netherlands. Formerly operating under the hacker handle "Umbreon"—named after the Pokémon character—van der Stap lived a double life as a professional software engineer by day and an extortionist by night.
• The Charges and Arrest: Van der Stap was taken into custody around September 16, 2026, on suspicion of aiding data thefts and extortion campaigns orchestrated by ShinyHunters. Compounding these charges, Dutch investigative media outlet RTL reported that investigators also suspect van der Stap of attempting to orchestrate at least two murders abroad.
• The FBI Breach: Days after van der Stap’s detention, ShinyHunters claimed responsibility for a brazen cyberattack against the FBI’s job application portal (apply.fbijobs.gov). The breach compromised Social Security numbers and personal identifiable information (PII)—including sensitive psychiatric and medical files—belonging to more than 5,000 FBI personnel, special agents, and cyber threat analysts.
• The Zero-Day Exploitation: The syndicate achieved access to the FBI portal and dozens of other enterprise systems by exploiting a vulnerability (CVE-2026-35273) in Oracle PeopleSoft, utilizing advanced URL-encoding techniques to bypass web application firewall (WAF) mitigations issued by Mandiant.
• Leadership Dynamics: Intelligence from cybersecurity firms KELA, Mandiant, and the Google Threat Intelligence Group (GTIG) indicates that ShinyHunters experienced an internal leadership shift, falling under the control of a teenage hacker from Amman, Jordan, known as "Rey." Rey operates within an amalgamated cybercrime collective dubbed ScatteredLapsussHunters (SLSH).

Chronology of Events

Understanding the rapid escalation of cyberattacks requires a detailed timeline of how a local arrest in Europe cascaded into a global security crisis.

2021–2023: The Rise of "Umbreon"

• September 2021: Operating as "Umbreon," Pepijn van der Stap sells massive databases—including records on 2.3 million Dutch citizens—on English-language underground forums like RaidForums.
• Late 2023: Van der Stap is arrested, prosecuted, and convicted in the Netherlands for a string of data thefts and extortions yielding between €1.5 million and €2.7 million. During his trial, he admits to his crimes, citing psychological struggles and a compulsion for data collection. He is sentenced to four years in prison (with one year suspended).

December 2025 – September 2026: The "Reformed" Hacker

• December 2025: Van der Stap is released from prison. He attempts to rebrand himself as a reformed security professional, eventually securing employment as an offensive security lead at Dutch firm Neo Security while previously volunteering for the Dutch Institute for Vulnerability Disclosure (DIVD).
• February 2026: A native Dutch-speaking ShinyHunters operative successfully executes a social engineering attack against Odido, the Netherlands’ largest mobile telecommunications provider, compromising data belonging to 6.2 million people. Dutch police subsequently release audio clips seeking public assistance to identify the voice.
• September 9, 2026: Van der Stap grants an interview to KrebsOnSecurity, portraying himself as a man trying to make amends and resolve ongoing civil restitution cases. Shortly after, he abruptly ceases all communication.

Mid-September 2026: Arrests and Retaliation

• September 16, 2026: Dutch authorities officially arrest van der Stap. Witnesses report police removing items from his residence.
• Mid-September 2026: Sensing the arrest of an associate (or targeted by rival factions seeking to frame him), ShinyHunters launches a wave of disruptive attacks. They leave behind defacement messages on the hacked FBI job site featuring prominent ASCII art of the Pokémon character Umbreon—an apparent effort by rival faction leader "Rey" to pin the blame squarely on the imprisoned Dutchman.
• September 25, 2026: Mandiant and GTIG release a comprehensive threat report detailing how ShinyHunters mass-exploited the Oracle PeopleSoft vulnerability across diverse industries, utilizing WAF bypass tricks.
• September 29, 2026: Dutch media outlet RTL reveals that investigators suspect van der Stap of commissioning murders abroad. Meanwhile, the Dutch police officially confirm the arrest of a 24-year-old suspect slated to appear before the Rotterdam District Court.

Supporting Data and Technical Analysis

The mechanics behind the ShinyHunters campaigns highlight a high degree of technical sophistication, combining traditional social engineering with zero-day exploitation and supply-chain infiltration.

The Oracle PeopleSoft Zero-Day (CVE-2026-35273)

The cornerstone of ShinyHunters’ 2026 campaign relied on a critical vulnerability in Oracle’s PeopleSoft platform, a widely deployed human resources, benefits, and payroll management software-as-a-service (SaaS) solution.

• Exploitation Vector: Although Oracle issued patches for CVE-2026-35273 following initial exploitation in June, organizations struggled to apply updates uniformly.
• WAF Bypass: When security firms like Mandiant issued web application firewall (WAF) mitigation rules to block exploitation attempts, ShinyHunters deployed URL-encoding obfuscation tricks to successfully bypass these defenses, leading to mass data exfiltration across government, healthcare, technology, and higher education sectors.

Underground Friction and the TeamPCP Fallout

The aggressive posture adopted by ShinyHunters was exacerbated by severe internal conflict. According to intelligence compiled by Wired, Mandiant, and KELA, ShinyHunters had briefly partnered earlier in the year with TeamPCP, a supply-chain-focused hacking group.

• The Double-Cross: TeamPCP successfully compromised code supply chains but struggled to monetize their stolen credentials. When ShinyHunters partnered with them, they went rogue—exfiltrating data and extorting victims using TeamPCP’s credentials without sharing the financial yields.
• The Mandiant Intervention: Unbeknownst to the cybercriminals, Mandiant analysts had infiltrated TeamPCP and were actively burning the stolen credentials by feeding them directly to major cloud providers (such as Amazon and Microsoft) to invalidate session keys. This mutual distrust ignited a bitter turf war, ultimately driving the group under the control of "Rey" and the ScatteredLapsussHunters (SLSH) coalition.

Official Responses and Law Enforcement Statements

Law enforcement agencies and corporate victims have responded to the crisis with a mixture of public disclosures, direct warnings, and international cooperation.

• The FBI’s Position: Following the compromise of apply.fbijobs.gov, the bureau issued a formal statement acknowledging the breach of employee PII. In a subsequent video address, Brett Leatherman, Assistant Director of the FBI’s Cyber Division, praised Dutch law enforcement for their decisive action and directly warned remaining syndicate members:
  

  "Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."

• Dutch Authorities: The Dutch National Police confirmed the detention of the 24-year-old suspect, scheduling court appearances in the Rotterdam District Court. Investigators continue to probe both his cybercrime activities and the startling allegations regarding international murder-for-hire plots.
• ShinyHunters’ Defiant Rhetoric: Demonstrating an unusual degree of psychological warfare, ShinyHunters issued scathing statements mocking Dutch law enforcement capabilities while simultaneously threatening further high-profile domestic attacks. Their public communications emphasized financial and legal support for arrested members, attempting to project organizational resilience even as internal betrayals fractured their ranks.

Implications for Global Cybersecurity

The saga surrounding Pepijn van der Stap, the ShinyHunters syndicate, and the SLSH coalition carries significant ramifications for the future of digital defense and international law enforcement.

1. The Convergence of Insider Threats and Ex-Convicts: The case underscores the persistent challenge of reintegrating convicted cybercriminals. Van der Stap’s ability to transition from a convicted felon into a corporate offensive security lead highlights vulnerabilities in vetting practices within the cybersecurity industry.
2. Weaponization of Internal Infighting: Law enforcement agencies increasingly leverage underground rivalries. As demonstrated by the framing of "Umbreon" via Pokémon iconography during the FBI breach, factional paranoia within groups like SLSH and ShinyHunters creates operational friction that multinational task forces can exploit to accelerate identification and arrests.
3. Supply Chain Fragility: The successful mass-exploitation of Oracle PeopleSoft—despite existing mitigations—illustrates the immense peril posed by zero-day vulnerabilities in enterprise HR and payroll systems. Because these platforms store deep-seated personal and financial records, they remain prime targets for state-sponsored and financially motivated syndicates alike.
4. A Shift Toward High-Risk Geopolitical Targets: By targeting the FBI and rival ransomware cartels like Cl0p, ShinyHunters has signaled a dangerous departure from purely financially motivated extortion toward high-visibility disruption. This escalation virtually guarantees a prioritized, relentless international manhunt that will continue to reshape the contours of underground cybercrime syndicates for years to come.