The Edge of the Cyber World See the latest
Cybercrime experts are stunned as ShinyHunters risks agent safety and intense federal heat in a bizarre attempt to force the retraction of an agency advisory. The post ShinyHunters trades financial extortion for a reckless war of ego with the FBI appeared first on CyberScoop.
The "agentic threat actor" may have used exposed credentials to access resources and delete cloud-based storage, applications, and databases.
Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect’s arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p.
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168, has called it an evolution of the threat actor’s tradecraft. The attack took place in early June 2026 over a period of about 18…
The FBI confirmed on September 26, 2026 that it is dealing with what the bureau called a “cybersecurity incident,” following claims from the extortion group ShinyHunters that it stole more than two terabytes of employee data from the FBI’s own jobs portal, FBIJobs.gov. The confirmation, first reported by NewsNation and picked up by outlets including…
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant…
CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778. CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received…
Four months after Oracle patched a critical remote-code-execution hole in PeopleSoft, the attackers who broke in through it are back. Google’s Threat Intelligence Group and its Mandiant incident-response unit say the extortion crew tracked as ShinyHunters, internally designated UNC6240, has resumed widespread exploitation of CVE-2026-35273 by disguising its attack traffic so that web application firewalls…
Three days after the extortion group ShinyHunters first claimed it had breached Federal Bureau of Investigation systems, the story has shifted from a raw numbers game (how many terabytes, how many agents) to something more pointed: motive. According to The Register, the group says the intrusion was retaliation against the Bureau, not a money grab.…
Security teams spend a strange amount of their week decoding things: a Base64 blob pasted from a phishing email, a hex-encoded PowerShell command pulled from an EDR alert, a JWT that someone swears is legitimate. Most of that work happens in a single browser tab running CyberChef, the “Cyber Swiss Army Knife” built and maintained…
