Brett Leatherman, assistant director of the FBI, has delivered a stark warning to the ShinyHunters cyber extortion group.
Leatherman took to YouTube to announce the arrest of a Dutch national alleged to be one of the leaders of the hacking collective, after which he addressed the group’s “remaining members”.
“You’ve heard about the arrest of your colleague. We’re confident you’ve seen or heard things in recent days that the public is not,” Leatherman (pictured) said in the 29 September video.
“Other groups believed anonymity, or their friends, would protect them, and they were wrong. Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left.
“The longer you stay in this, the more we learn about you. You know how to find us and we know how to find you. I suggest you reach out first while the choice is still yours.”
Leatherman’s challenge is the latest move between the law enforcement agency and ShinyHunters, since the hackers boasted of breaching an FBI careers website and compromising the data of current and potential agents.
“Dear Assistant Director Brett Leatherman of the FBI Cyber Division & Director Kash Patel of the FBI, During [sic] Quarter Two of this year the Federal Bureau of Investigation (FBI) made substantial false allegations regarding our organisation in a FLASH report. We have been severely offended,” ShinyHunters said in a 22 September dark web post.
The FBI regularly publishes FLASH reports to share the tactics, techniques and procedures of criminal actors.
“We wish to state unequivocally we have NEVER conducted swatting attacks against corporate victims personnel nor have we ever texted victims personnel family members any threats. We wish to state unequivocally we have NEVER claimed to have sensitive or compromising information, including embarrassing photographs and videos of victims. WE ARE NOT SEXTORTIONISTS.”
ShinyHunters has since told 404 Media that it has no intention of publishing the FBI data.
“This was all a marketing campaign to protect our business and actively combat disinformation. If we made this statement normally then this much attention to our words and intentions would’ve never been this widespread,” the hackers told the outlet earlier this week.
“We’d have been ignored and disregarded. However, now everyone knows what the issue is and what we are doing. Everyone is reading about it. We proved our points on several occasions. We do not care what the public says and we are not affected by it nor do we cloud our judgement by external opinions and thoughts.”
The FBI said it was “working around the clock” to investigate the incident.
Meanwhile, the arrest of the Dutch national – 24-year-old Pepijn van der Stap – is a drama all its own. van der Stap had previously been convicted in relation to several data breaches and spent three years in jail after confessing to the crimes.
He had previously claimed that he was now reformed, telling KrebsOnSecurity earlier this month that he was “trying to turn his life around”.
“van der Stap said he was still dealing with civil lawsuits and restitution related to his previous cyber crime victims, and that he was trying his best to make amends,” KrebsOnSecurity wrote on 28 September.
“But not long after that interview, the Dutch hacker abruptly stopped replying to messages. Efforts by others close to him also repeatedly failed to elicit a response for the past two weeks.”
van der Stap was arrested on 16 September and has since been allegedly linked to attempts to arrange at least two murders.
“The two murders were allegedly to be committed abroad. There are indications that the suspect gave the order for this, the police report,” Dutch media outlet NTL said overnight (translated from the original).
“That suspicion is separate from the investigation into ShinyHunters.”
For its part, ShinyHunters has shared a statement saying it is operating as usual despite the disruptions.
“Due to certain disinformation spreading once again, we are releasing this statement to confirm we are okay, our operations and infrastructure remains completely fine as it should be and WILL be,” ShinyHunters said in one of the latest updates on its darknet leak site.
“The organisations who have been in negotiations with us who believe we are falling apart is WRONG! We are eagerly waiting to make examples of those organisations who think they may have gotten a free pass into not paying us few tens of millions of dollars. To those organisations speaking to us, your data is still in our possession and at risk of being published, there is still an option to prevent that from happening, go back to being serious again in our discussions. Thank you for your attention to this matter.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
