Dutch police arrest a suspect in the ShinyHunters investigation as the group's attacks escalate
Police in the Netherlands confirmed a 24-year-old Amsterdam man was arrested in September in an investigation into ShinyHunters, the extortion group behind help-desk vishing and PeopleSoft exploitation this year. The group denies any link.
Dutch police confirmed that a 24-year-old man from Amsterdam, arrested on September 15, was detained in an investigation into the ShinyHunters extortion group. Tactical officers searched his home and seized devices, and a court appearance was set for September 29. BleepingComputer and KrebsOnSecurity report the suspect was convicted in 2023 of hacking and extorting more than a dozen companies. Police have not said which breaches he is suspected of, and a ShinyHunters representative denied any connection. The group's activity has not slowed. It was linked this year to the Odido telecom breach, where a help-desk employee was phoned by someone posing as IT and entered credentials into a fake login page, and it has been exploiting Oracle PeopleSoft flaw CVE-2026-35273 using a URL-encoding trick that slips past web application firewall rules.
Why it matters
One arrest does not retire a brand that operates as a loose collective, and ShinyHunters has repeatedly continued after members were detained. The practical takeaway is its method, which barely changes from campaign to campaign: a phone call to someone who can reset or enter credentials, a convincing login page, and then the data. That is the pattern behind help-desk social engineering, the EY claim in July, and the Scattered Spider playbook it overlaps with.
The PeopleSoft detail carries a second lesson. Organizations that had not applied Oracle's June patch were relying on a WAF rule matching the literal path, and the attackers simply percent-encoded one character. A WAF rule is a stopgap for an unpatched system, not a control, and it fails the moment the attacker encodes around it. If PeopleSoft is in your estate, Mandiant's advice is to patch, then search WebLogic logs for /PSEMHUB/ requests and their encoded variants.
Source: BleepingComputer
Related on Start with Identity
- Blog1.6 million RingCentral records leaked, and the entry point was one phone call
ShinyHunters voice-phished a RingCentral employee out of their password in July, took 623GB, and dumped 280GB after the company refused to pay. Have I Been Pwne
- BlogArctic Wolf counts 400-plus fake IT help desk intrusions over Teams external chat
Arctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Team
- BlogASOS breach began with an employee tricked out of their login
ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.
- ExpertCo-chair, OpenID Shared Signals working group
Annabelle Backman is a principal security engineer on AWS Identity and co-chairs the OpenID Shared Signals and Events working group. She edited RFC 8935 and RFC
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla