ShinyHunters hacks FBI, challenges agency over “unfounded allegations”

“Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI, During [sic] Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended,” ShinyHunters said in a September 22 darkweb post.

“We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to ‘disrupt’ our operations, an effort that ultimately proved unsuccessful.”

The FBI regularly publishes FLASH reports to share the tactics, techniques, and procedures of criminal actors.

In what the hackers are calling a ‘public service announcement’ (complete with the Trump-style sign-off “Thank you for your attention to this matter”), the group takes offence as being charged with swatting, threatening family members, or lying about the data in their possession.

“We wish to state unequivocally our threats and claims are very real. Not exaggerated and never a bluff. This PSA today is living evidence of that,” ShinyHunters said.

“We wish to state unequivocally we have NEVER conducted swatting attacks against corporate victims personnel nor have we ever texted victims personnel family members any threats. We wish to state unequivocally we have NEVER claimed to have sensitive or compromising information, including embarrassing photographs and videos of victims. WE ARE NOT SEXTORTIONISTS.”

VIEW ALL

The group goes on to expound upon its First Amendment rights, claims The Com hacking collective is “propaganda started by the Information Security Industry,” and said that if the FBI fails to withdraw its “defamatory statements,” ShinyHunters will be “forced to respond in a civil manner with a commensurate and forceful defence of our reputation”.

By way of a demonstration, the group told Reuters it had defaced the FBI’s careers website, a screenshot of which was shared by Darkweb Informer. As of the time of writing, the portal carries a statement declaring the system is currently down.

“Apply.fbijobs.gov and the Special Agent Applicant Portal are currently unavailable,” the FBI said.

“For urgent scheduling issues, please reach out to your Applicant Coordinator. We apologise for the inconvenience.”

While ShinyHunters’ claims may seem fanciful, and the defence of its actions almost comical, analysts at cyber security firm Flashpoint consider the group’s claims to be highly credible.

“ShinyHunters has overstated the importance of stolen data before, but it is an established, legitimate threat,” Flashpoint’s people said.

“The defacement and the verified samples back up this claim.”

The group’s motives in this instance are also far from the usual effort for financial gain, according to Flashpoint.

“Reputation, not ransom, is the likely motive. The FBI publicly advises victims not to pay ransoms, so it's unlikely to pay one. What the group gains is standing as a credible threat,” Flashpoint said.

“The group is fighting the FBI's narrative for business reasons. ShinyHunters calls the PSA an attempt to ‘hinder clients' trust’ so that ‘nobody pays us.’ Taking on the FBI directly may be meant to convince future victims that paying still makes sense.

“By publicly taking on the agency, ShinyHunters is trying to rebuild its credibility and push future victims back toward the negotiating table. Since the FBI will likely not engage with ShinyHunters, we expect the group to follow the same playbook it uses against corporate victims and leak the stolen data.”