{"id":1014,"date":"2026-10-08T22:51:21","date_gmt":"2026-10-08T22:51:21","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=1014"},"modified":"2026-10-08T22:51:21","modified_gmt":"2026-10-08T22:51:21","slug":"dutch-authorities-arrest-convicted-cybercriminal-linked-to-shinyhunters-as-group-escalates-high-profile-attacks","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=1014","title":{"rendered":"Dutch Authorities Arrest Convicted Cybercriminal Linked to ShinyHunters as Group Escalates High-Profile Attacks"},"content":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-stakes extortions carried out by the prolific hacker collective known as ShinyHunters. The detention has sent shockwaves through the cybercrime underworld, prompting remaining members of the group to dramatically escalate their campaign. In the days immediately following the arrest, the syndicate launched aggressive retaliatory cyber operations, stealing sensitive data from the Federal Bureau of Investigation (FBI) and turning its sights on the Russian ransomware group Cl0p.<\/p>\n

According to three sources familiar with the matter, the Dutch man taken into custody by law enforcement is Pepijn van der Stap, a convicted cybercriminal who previously operated out of Almere and Lelystad in the Netherlands. Van der Stap was convicted in late 2023 for his involvement in an extensive string of corporate data thefts and digital extortions. Dutch prosecutors estimated that criminal enterprise generated between \u20ac1.5 million and \u20ac2.7 million in illicit proceeds.<\/p>\n

During his 2023 trial, van der Stap admitted to living a double life. While maintaining a public persona, he secretly operated under the hacker handle \u201cUmbreon,\u201d using the moniker to extort corporate victims and dump stolen proprietary data onto English-language cybercrime forums, including the now-defunct RaidForums and Breached. By day, however, van der Stap worked professionally as a software engineer at Hadrian, an Amsterdam-based cybersecurity startup. He also volunteered his technical skills with the Dutch Institute for Vulnerability Disclosure (DIVD), a well-known nonprofit security research organization dedicated to finding and patching software flaws.<\/p>\n

Van der Stap openly confessed to his cybercrime activities during proceedings and was ultimately sentenced to four years in prison, with one year suspended. In a somewhat unusual move during his legal proceedings, van der Stap opted to remain in custody rather than return home, stating that he could not find adequate medical or psychological treatment on the outside for his ongoing mental health struggles, which he claimed included post-traumatic stress disorder stemming from childhood trauma. He was subsequently released from prison in December 2025.<\/p>\n

In an interview with KrebsOnSecurity on September 9, 2026, van der Stap portrayed himself as a completely reformed individual who was actively trying to rebuild his life and make a positive, constructive contribution to society. At the time of the interview, he was employed as an offensive security lead at Neo Security, a Dutch cybersecurity firm that did not respond to requests for public comment regarding the unfolding situation. <\/p>\n

During that same conversation, van der Stap noted that he was still grappling with ongoing civil lawsuits and financial restitution demands tied to his past cybercrime victims, emphasizing that he was doing his best to make meaningful amends. However, shortly after that interview concluded, the Dutch hacker abruptly stopped responding to digital messages. Individuals close to him confirmed that efforts to contact him repeatedly failed over a two-week period.<\/p>\n

According to two sources with direct knowledge of the investigation, van der Stap was arrested by Dutch authorities on or around September 16 and has since been held in custody for intensive questioning. One source reported that a colleague personally witnessed law enforcement officers carrying boxes and electronic equipment out of van der Stap\u2019s residence during the raid.<\/p>\n

Dutch law enforcement agencies have spent months pursuing leads in connection with ShinyHunters. Earlier in September, authorities launched a public appeal asking for assistance in identifying a voice recorded during a telephone call from February 2026. In that audio, a native Dutch-speaking member of ShinyHunters used sophisticated social engineering techniques to compromise Odido, the largest mobile telecommunications provider in the Netherlands. During the intrusion, the hacker tricked an Odido employee into authenticating on a spoofed phishing website, utilizing that unauthorized access to steal sensitive personal data belonging to more than 6.2 million Dutch citizens.<\/p>\n

\"Dutch<\/figure>\n

Responding to inquiries from Dutch media outlets, ShinyHunters publicly confirmed that the suspect heard in the police audio clip is indeed a core member of their collective. In a statement shared with the NL Times, the group adopted a defiant tone regarding their detained associate. <\/p>\n

\u201cOur team member has our full support \u2014 emotionally, mentally, and financially,\u201d the hackers stated. \u201cEverything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them.\u201d <\/p>\n

The statement also launched a blistering verbal assault against Dutch law enforcement. \u201cThe Dutch police will need all the luck in the world \u2014 and everyone\u2019s prayers \u2014 if they want to catch him before we carry out another large-scale data theft in the Netherlands. Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless.\u201d<\/p>\n

Despite the bravado, the investigation continued to close in. On September 29, Dutch news outlet RTL reported that investigators now suspect van der Stap may have attempted to orchestrate at least two murders. According to RTL, these alleged crimes were planned to take place abroad, and investigators have uncovered indications that the suspect issued orders for the executions. Later that same day, the Dutch police officially confirmed the arrest of a 24-year-old man in connection with the ongoing ShinyHunters investigation, stating that he would appear before the chambers of the Rotterdam District Court.<\/p>\n

FBI and CL0P Hacks<\/h2>\n

Just days after sources indicate van der Stap was detained by Dutch authorities, ShinyHunters claimed responsibility for an extraordinarily brazen breach targeting the FBI\u2019s recruitment portal, apply.fbijobs.gov. Reporting from 404 Media revealed that the stolen data included Social Security numbers and deeply personal background information concerning more than 5,000 Bureau employees and officials.<\/p>\n

Examinations by 404 Media and Reuters showed that the compromised records detailed specific job titles and operational assignments, including special agents, threat intake examiners, and personnel assigned to major cybercrimes units and foreign state-backed threat divisions. Furthermore, Reuters reviewed sample documents provided by the hackers, confirming they contained sensitive psychiatric and medical files belonging to FBI personnel. The FBI subsequently issued a formal statement acknowledging the compromise of the recruitment portal.<\/p>\n

According to threat intelligence analysts, ShinyHunters gained access to the FBI portal and numerous other corporate systems by weaponizing a recently patched vulnerability, tracked as CVE-2026-35273, affecting PeopleSoft. PeopleSoft is a widespread enterprise software-as-a-service platform developed by Oracle and heavily utilized by major organizations for human resources, payroll, and recruitment management. Oracle rapidly issued a security patch after discovering that ShinyHunters had been actively exploiting the flaw as a zero-day since June. Concurrently, Mandiant released defensive web application firewall (WAF) rules to assist organizations unable to immediately apply the vendor update.<\/p>\n

However, security firm BleepingComputer reported that ShinyHunters managed to bypass Mandiant\u2019s mitigation rules by employing a clever URL-encoding trick. In a comprehensive threat report released on September 25, analysts from Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters executed a mass-exploitation campaign against the PeopleSoft vulnerability, successfully extracting proprietary data from dozens of organizations spanning higher education, technology, healthcare, agriculture, transportation, and government sectors.<\/p>\n

\"Dutch<\/figure>\n

Van der Stap’s former hacker alias, Umbreon, appeared to be hidden in plain sight across the digital footprints left by ShinyHunters during the FBI breach. The digital defacement banner left on the compromised FBI jobs portal featured an intricate ASCII art rendition of the Pok\u00e9mon character Umbreon. At the top of the banner, a message read: \u201cThis site has been seized by ShinyHunters. rooting your systems since \u201919 ;)\u201d Security analysts noted that the imagery was identical to a defacement banner deployed by ShinyHunters during their 2020 compromise of the English-language cybercrime forum Hackforums.<\/p>\n

Sources close to the ongoing international investigation suggest that the group’s recent, highly aggressive attacks against high-value targets like the FBI and a prominent Russian ransomware syndicate represent a distinct departure from their traditional operational style. Investigators attribute this sudden strategic pivot to a leadership change within the collective. Control of ShinyHunters reportedly shifted to a teenage cybercriminal from Amman, Jordan, who operates under the moniker \u201cRey\u201d as a key figure within a hybrid cybercrime consortium known as ScatteredLapsussHunters (SLSH). Security experts explain that SLSH represents an amalgamation of three notorious hacking factions: Scattered Spider, LAPSUS$, and ShinyHunters.<\/p>\n

According to intelligence sources, Rey harbored an ongoing feud with van der Stap over control of the ShinyHunters brand and its vast repository of stolen data. The prominent inclusion of the Umbreon Pok\u00e9mon imagery in the FBI site defacement was interpreted by analysts as an intentional effort by Rey to frame the Dutch hacker for the high-profile intrusion.<\/p>\n

Rey was first publicly unmasked by cybersecurity firm KELA in March 2025. Ahead of a profile published by KrebsOnSecurity later that year, reporters contacted Rey\u2019s father to request an interview with the teenager. The father forwarded the communication directly to his son, who subsequently admitted to participating in various ransomware operations while claiming he was attempting to disassociate himself from the SLSH collective.<\/p>\n

Blaming Umbreon<\/h2>\n

Immediately following widespread media coverage of the FBI jobs site breach, Rey used his primary social media accounts on X (formerly Twitter) to taunt both the FBI and the Cl0p ransomware syndicate. One widely circulated meme posted by Rey depicted the FBI breach and ongoing tensions with Cl0p through crude imagery comparing them to significant historical disasters, with a giant floating representation of the Umbreon Pok\u00e9mon character looming in the foreground.<\/p>\n

On September 24, reporters again reached out to Rey\u2019s father to request an interview regarding his son’s rising prominence within ShinyHunters. Just hours after that inquiry was sent, Rey deleted his long-standing social media accounts. Meanwhile, Rey\u2019s father, an employee of Royal Jordanian Airlines, failed to respond to multiple requests for comment concerning his son\u2019s alleged criminal activities.<\/p>\n

The underlying hostility between SLSH and traditional ShinyHunters factions appears rooted in a brief, volatile partnership earlier in the year. According to a report by Wired, members of ShinyHunters and SLSH briefly joined forces to better monetize high-value corporate credentials harvested by TeamPCP. TeamPCP was an emerging threat group that specialized in compromising global code supply chains with malicious software, though its members reportedly struggled to convert their stolen data into substantial profits. (Two alleged leaders of TeamPCP were arrested in Australia, with one claiming the group netted a meager $20,000 from their efforts.)<\/p>\n

Wired detailed how Mandiant had covertly infiltrated TeamPCP and was secretly responsible for burning the group’s stolen credentials by feeding valid session keys directly to major cloud providers such as Amazon and Microsoft, which quickly invalidated them. As the compromised credentials lost their utility, the allied hacker factions began pointing fingers and blaming one another for the operational failures.<\/p>\n

\"Dutch<\/figure>\n

Wired reporter Andy Greenberg noted that shortly after the partnership dissolved, ShinyHunters went rogue, independently leveraging TeamPCP’s compromised credentials to execute lucrative corporate extortions without cutting in their former partners. Mandiant researcher Austin Larsen told KrebsOnSecurity that ShinyHunters has experienced an exceptionally profitable extortion streak, putting the collective on track to pull in nearly $100 million in extortion payments throughout 2026.<\/p>\n

In contrast to financially driven syndicates, van der Stap previously maintained that his actions were never primarily about money. Speaking with Bloomberg in 2024, he described his criminal motivation as an obsessive compulsion to amass the world’s most comprehensive digital archive of stolen databases. <\/p>\n

\u201cThe hacking was very easy for me, and it wasn’t a compulsion,\u201d van der Stap told Bloomberg at the time. \u201cMy habit was collecting. Collecting data, organizing data, downloading data, creating folders.\u201d<\/p>\n

Meanwhile, the Dutch Institute for Vulnerability Disclosure (DIVD), where van der Stap once volunteered, disclosed an internal cybersecurity incident involving the potential malicious use of artificial intelligence. While DIVD released few specifics regarding the event, a spokesperson confirmed that the incident appeared entirely unrelated to ShinyHunters and showed no indications of involvement by any former volunteers.<\/p>\n

In the wake of these developments, law enforcement agencies have signaled increased international cooperation. The FBI released a video message from Brett Leatherman, assistant director of the FBI\u2019s cyber division, thanking Dutch law enforcement partners for their critical assistance and warning remaining members of ShinyHunters that the net is tightening.<\/p>\n

\u201cArrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who\u2019s left,\u201d Leatherman said. \u201cThe longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in massive data thefts and high-stakes extortions carried out by the prolific hacker collective known as ShinyHunters. The detention has sent shockwaves through the cybercrime underworld, prompting remaining members of the group to dramatically escalate their campaign. In the days immediately<\/p>\n","protected":false},"author":27,"featured_media":1013,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[142],"tags":[149,423,595,893,894,143,146,147,1082,176,144,83,216,1059,169,145],"class_list":["post-1014","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news","tag-arrest","tag-attacks","tag-authorities","tag-convicted","tag-cybercriminal","tag-cybersecurity","tag-defense","tag-dutch","tag-escalates","tag-group","tag-hacking","tag-high","tag-linked","tag-profile","tag-shinyhunters","tag-threats"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1014"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1014\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1013"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}