FBI Director Kash Patel announced Friday that federal agents have taken into custody another individual suspected of participating in the ShinyHunters extortion operation, which authorities believe orchestrated the recent intrusion into FBI infrastructure.

Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent http://FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor.

FBI Director Kash Patel

Patel added that "This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly."

The FBI has withheld the suspect's identity and the location of the arrest from public disclosure. According to reporting by The New York Times, the individual is a Canadian national apprehended in Pennsylvania and is regarded as a key co-conspirator in the breach.

Law enforcement has not released the suspect's name or details regarding the charges filed against him.

This apprehension represents the most recent step in an intensifying campaign against ShinyHunters following the group's breach of FBI systems last month. The threat actors initially gained access by exploiting what they described as an unpatched Oracle PeopleSoft vulnerability, subsequently moving through FBI-controlled AWS GovCloud systems.

ShinyHunters claimed to have exfiltrated between 2TB and 3TB of information, encompassing records of current and former employees, job candidates, medical and psychiatric documentation, and operational records. Data samples verified by security researchers and journalists confirmed the exposure of employee addresses, Social Security numbers, sensitive position details, family member information, and additional personal data.

An internal FBI memo, as reported by The New York Times, indicated that the agency determined the breach potentially affected its entire workforce. The FBI subsequently attributed the incident to a third-party contractor responsible for the platform, which failed to deploy an available security patch.

Law enforcement activity targeting the group has intensified markedly since the FBIjobs incident. On September 15, authorities in the Netherlands arrested a 24-year-old Amsterdam resident identified as Pepijn van der Stap, known online as "Umbreon," as part of the investigation into ShinyHunters.

ShinyHunters publicly rejected any connection to van der Stap, stating to BleepingComputer: "That individual has no association with us. Frankly, we are laughing."

Following van der Stap's arrest, the FBI took the unusual step of issuing a public appeal to ShinyHunters members, urging them to surrender themselves and warning that investigators were continuing to identify individuals involved with the operation.

Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.

FBI Cyber Division Assistant Director Brett Leatherman

Shortly thereafter, an individual operating under the online handle "Rey" was reportedly detained in Jordan and began providing assistance to the FBI and international law enforcement. Reuters identified Rey as Saif al-Din Khader and reported that sources indicated he was cooperating with investigators to identify additional alleged group members.

Concurrent with these arrests, visible signs of operational disruption emerged within ShinyHunters. The group's primary representative, who had maintained regular contact with BleepingComputer and other media organizations and possessed detailed knowledge of ShinyHunters activities over the preceding two years, ceased responding on Telegram last Tuesday. That account has since been deleted.

The representative had continued communicating with BleepingComputer even after van der Stap's arrest, indicating that van der Stap was not the person managing the account.

Around the same period as Rey's detention, another alleged ShinyHunters associate with substantial knowledge of the FBI breach deactivated an online messaging account, and the group's data leak platform went offline. A replacement leak site subsequently appeared online, suggesting that at least some operational members remained engaged.

Whether the departure of the group's main representative correlates with any of the recent arrests remains unclear.

We will continue to work closely with our partners to disrupt what's left of the ShinyHunters group and their associates, no matter where they operate.

FBI Director Kash Patel

Background on ShinyHunters

ShinyHunters operates as an extortion-focused criminal group specializing in data theft from web applications and cloud-based SaaS platforms. The group demands ransom payments from targeted organizations under threat of publishing stolen information.

The ShinyHunters designation has been connected to multiple threat actors responsible for data breaches extending back to at least 2018. Over the past two years, individuals using the ShinyHunters name have intensified their operations, executing data theft and extortion schemes against organizations across the globe.

Recent operations have focused on Salesforce and other cloud SaaS environments. The threat actors have been linked to breaches affecting Google, Cisco, PornHub, and Match Group, the online dating conglomerate.

In certain campaigns, the group has compromised third-party integration vendors and obtained authentication tokens that enabled attackers to penetrate connected SaaS environments and exfiltrate customer information.

More recently, ShinyHunters has deployed voice phishing operations targeting Okta, Microsoft, and Google single sign-on accounts. These campaigns involve impersonating IT support staff to manipulate employees into submitting credentials and multi-factor authentication codes to fraudulent sites.

The group has additionally employed device code phishing attacks to obtain Microsoft account authentication tokens, as initially reported by BleepingComputer.

Once attackers secure credentials and authentication codes, they leverage compromised SSO accounts to gain access to connected enterprise systems including Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, and Dropbox.

ShinyHunters orchestrated a significant data-theft campaign against Instructure Canvas in May that resulted in substantial platform disruptions. Instructure subsequently reached an "agreement" with the threat actors to prevent disclosure of the stolen information.

Beyond conducting independent breaches, ShinyHunters has functioned as an extortion-as-a-service provider, assisting other criminal actors in extorting organizations they had already compromised.

Law enforcement has arrested numerous individuals across multiple years in cases connected to the ShinyHunters name, including suspects linked to Snowflake data-theft operations, PowerSchool breaches, and administration of the Breached v2 hacking forum.

Despite these enforcement actions, cybercriminals have persisted in operating under the ShinyHunters name while conducting data theft and extortion operations targeting organizations worldwide.