Skip to content
CertGPS

ShinyHunters Hacker Detained in Jordan

A suspected ShinyHunters hacking group member, known online as 'Rey', has been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group.

Severity awaiting reviewData breach
J
Jennifer
Incident date
Published
Read time
5 min
View source
On this page

Related certifications

Tags

  • security-news
  • data-breach
  • cybersecurity

Source

bleepingcomputer.com

Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.

Executive Summary

The ShinyHunters hacker group has been making headlines with their high-profile data breaches, including a recent incident where a suspected member was detained in Jordan. The group has been linked to breaches of the FBI, Google, Cisco, PornHub, Instructure Canvas, and Salesforce, with an estimated 2TB to 3TB of data affected. The incident highlights the importance of robust security measures and the need for organizations to stay vigilant in the face of evolving threats.

The ShinyHunters group has been using an alleged Oracle PeopleSoft zero-day vulnerability to breach systems, with lateral movement into FBI-managed AWS GovCloud systems and the use of stolen authentication tokens to access connected SaaS environments. The group's extortion operation has been disrupted, with signs of disruption appearing within the ShinyHunters operation, including the shutdown of an alleged affiliate's online messaging account and the ShinyHunters data leak site going offline.

The incident serves as a reminder of the importance of security awareness and the need for organizations to invest in robust security measures, including regular vulnerability assessments and penetration testing.

What Happened: Timeline

✅ Verified Facts

  • September: ShinyHunters breached FBI systems using an alleged Oracle PeopleSoft zero-day vulnerability.
  • September 15: Dutch police arrested a 24-year-old Amsterdam man, identified as Pepijn van der Stap, as part of an investigation into ShinyHunters.
  • October 3, 2026 03:09 PM: A suspected ShinyHunters hacking group member known online as 'Rey' was reportedly detained in Jordan and is cooperating with the FBI.
  • Tuesday: Signs of disruption began appearing within the ShinyHunters operation, including the shutdown of an alleged ShinyHunters affiliate's online messaging account and the ShinyHunters data leak site going offline.
  • Thursday: A new ShinyHunters data leak site went online, suggesting other members continue to run the extortion operation.

Technical Deep Dive

Understanding Oracle PeopleSoft Zero-Day Vulnerability

What is it? An Oracle PeopleSoft zero-day vulnerability is a previously unknown vulnerability in the Oracle PeopleSoft software that allows an attacker to exploit it without any prior knowledge of the vulnerability. Zero-day vulnerabilities are particularly dangerous because they can be exploited before a patch is available.

How does it work? The vulnerability is typically exploited through a malicious code injection attack, where the attacker injects malicious code into the software. The malicious code is then executed by the software, allowing the attacker to gain unauthorized access to the system.

Security considerations The use of zero-day vulnerabilities highlights the importance of regular vulnerability assessments and penetration testing to identify and address potential vulnerabilities before they can be exploited.

AWS GovCloud is a cloud computing platform designed for government agencies and organizations that require high levels of security and compliance. The platform provides a secure and isolated environment for sensitive data and applications.

SaaS (Software as a Service) environments are cloud-based software applications that are accessed over the internet. SaaS environments are often used by organizations to access software applications without the need for local installation and maintenance.

Analysis: What Went Wrong

📊 Professional Analysis

Technical Root Cause

The technical root cause of the incident appears to be the exploitation of the alleged Oracle PeopleSoft zero-day vulnerability. The vulnerability allowed the attackers to gain unauthorized access to the FBI-managed AWS GovCloud systems and access connected SaaS environments.

Contributing Factors

The contributing factors to the incident include the lack of robust security measures, including regular vulnerability assessments and penetration testing, and the use of stolen authentication tokens to access connected SaaS environments.

Lessons for Security Professionals

Key Takeaways

  1. Regular vulnerability assessments and penetration testing are essential to identify and address potential vulnerabilities before they can be exploited.
  2. The use of stolen authentication tokens to access connected SaaS environments highlights the importance of implementing robust authentication and authorization controls.
  3. The incident serves as a reminder of the importance of security awareness and the need for organizations to invest in robust security measures.

Prevention & Detection

How to Prevent

  • Implement regular vulnerability assessments and penetration testing to identify and address potential vulnerabilities.
  • Implement robust authentication and authorization controls to prevent the use of stolen authentication tokens.
  • Use secure coding practices to prevent the exploitation of zero-day vulnerabilities.

How to Detect

  • Monitor for signs of disruption within the organization's operation, including the shutdown of online messaging accounts and data leak sites.
  • Implement intrusion detection and prevention systems to detect and prevent malicious activity.
  • Use threat intelligence to stay informed about emerging threats and vulnerabilities.
View related certification topics

Security+ (CompTIA)

  • Domain 1.0: Network Security
  • Domain 2.0: Compliance and Operational Security
  • Domain 3.0: Threats and Vulnerabilities

CEH (EC-Council)

  • Domain 1: Network Security
  • Domain 2: Vulnerability Assessment
  • Domain 3: Malware Analysis

CISSP (ISC2)

  • Domain 1: Security and Risk Management
  • Domain 2: Asset Security
  • Domain 3: Security Engineering

OSCP (Offensive Security)

  • Domain 1: Network Exploitation
  • Domain 2: Web Application Exploitation
  • Domain 3: Cryptography

CISM (ISACA)

  • Domain 1: Information Security Governance
  • Domain 2: Information Risk Management
  • Domain 3: Information Security Program Management

CySA+ (CompTIA)

  • Domain 1.0: Security and Risk Management
  • Domain 2.0: Vulnerability Management
  • Domain 3.0: Incident Response

AWS Security (AWS)

  • Domain 1: Security Fundamentals
  • Domain 2: Identity and Access Management
  • Domain 3: Data Security

Source

This analysis is based on: https://www.bleepingcomputer.com/news/security/shinyhunters-hacker-reportedly-detained-in-jordan-aiding-fbi/

This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.