Second ShinyHunters Suspect Reportedly Arrested in Jordan
Summary
Reuters reported that 16-year-old Saif al-Din Khader, described as a ShinyHunters member, was arrested in Jordan and is in FBI custody. The article also recounts the group’s alleged attacks and a claimed breach of an FBI jobs site.
Key points
- Reuters reported that Saif al-Din Khader, 16, was arrested in Jordan and is in FBI custody.
- The arrest follows the September arrest in the Netherlands of another person reported to be a ShinyHunters member.
- ShinyHunters has been active since at least 2019 and is described as using social engineering and software flaws to steal data and extort victims.
- The article links the group to attacks involving Instructure, Clop, and an FBI jobs site; some details are attributed to the group or other reports.
- ShinyHunters claimed the FBI jobs-site breach exposed extensive employee and medical information, but the article does not independently confirm the full scope.
- The FBI reportedly removed an Accenture contractor after a security patch for third-party software identified as PeopleSoft was not applied.
Article Details
- Event Type
- Reported arrests of suspected ShinyHunters members in Jordan and the Netherlands.
- Impact
- The arrests place two people in custody, according to the article. Separately, ShinyHunters claimed it breached the FBI’s jobs site and obtained sensitive employee information; the scale and contents of the breach are reported claims, not independently confirmed in the article.
People
Brett LeathermanFBI Cyber Division Assistant Director who warned ShinyHunters members that the FBI was pursuing them.Brian KrebsSecurity blogger who reported on Khader’s alleged role in Scattered LAPSUS$ Hunters.Pepijn van der StapThird-party reports named him as the 24-year-old arrested in the Netherlands in September and described him as an offensive security lead at Neo Security.Saif al-Din KhaderReuters reported that the 16-year-old had been arrested in Jordan and was in FBI custody. Brian Krebs said Khader goes by the nickname “Rey.”
Threat Actors
ClopDescribed as a rival cybercrime group that ShinyHunters compromised and whose leak site it defaced.LAPSUS$Named by Brian Krebs as one of the groups comprising Scattered LAPSUS$ Hunters.Scattered LAPSUS$ HuntersBrian Krebs described it as an amalgamation of Scattered Spider, LAPSUS$, and ShinyHunters, with Khader as its technical operator and public face.Scattered SpiderNamed by Brian Krebs as one of the groups comprising Scattered LAPSUS$ Hunters.ShinyHuntersCybercrime group described as engaging in data theft and extortion; the article also attributes several cyberattacks to the group.
Vendors
Instructurea May FBI advisory about its activities. That announcement followed ShinyHunters’ own cyberattack on Instructure, which runs the Canvas online educational system.Oraclethe agency’s jobs site, and is said to have exploited a vulnerability in PeopleSoft, HR software owned by Oracle. The data breach, which ShinyHunters claimed amounted to Terabytes, is said to have included a wide array
Products
Canvasits activities. That announcement followed ShinyHunters’ own cyberattack on Instructure, which runs the Canvas online educational system.PeopleSoftThe FBI attack targeted the agency’s jobs site, and is said to have exploited a vulnerability in PeopleSoft, HR software owned by Oracle. The data breach, which ShinyHunters claimed amounted to Terabytes, is said to
Countries
JordanOn Saturday, Reuters said that 16 year-old Saif al-Din Khader had been arrested in Jordan and was in FBI custody. This follows the arrest earlier in September of another member in the Netherlands. Third party reportsNetherlandsJordan and was in FBI custody. This follows the arrest earlier in September of another member in the Netherlands. Third party reports named him as 24 year-old Pepijn van der Stap, an offensive security lead at Dutch
Industries
EducationHealthcareVictims of the ShinyHunters group include Kodak, along with American healthcare and pharmaceuticals distributor McKesson. The gang also recently compromised rival cybercrime group Clop and defaced its leak site.PharmaceuticalsVictims of the ShinyHunters group include Kodak, along with American healthcare and pharmaceuticals distributor McKesson. The gang also recently compromised rival cybercrime group Clop and defaced its leak site.