Threats & Adversaries · Ransomware

Dutch arrest splits ShinyHunters leadership story

Dutch police confirmed they arrested a 24-year-old Amsterdam man in the ShinyHunters investigation, and the reporting now separates him from the group’s current teenage leader. The arrest advances the probe, but it does not read like a clean disruption of the crew’s present operation.

The reporting ties the case to ShinyHunters’ recent FBI job-site defacement and to Oracle PeopleSoft exploitation, but the leadership picture is already fractured: one figure is under arrest while another, younger leader is said to be driving the group. That means an arrest can change attribution without ending the campaign.

For teams watching ShinyHunters, the durable lesson is that law-enforcement action may narrow the roster without stopping the branding or the exploitation pattern. If your incident timeline depends on one named operator being the whole story, that assumption may not survive the next update.

13 sources · Sep 30

CVE-2026-35273

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Known ransomware campaign use. EPSS 97% (100th percentile).

CISA federal remediation date Jun 15 · date passed

Timeline

Sep 30 Reported by Risky Biz News
Sep 29 Reported by SecurityWeek
Sep 28 Reported by The Record from Recorded Future
Sep 26 Reported by Mandiant
Sep 24 Reported by Ars Technica Security
Sep 22 Reported by TechCrunch Security
Jun 15 CISA federal deadline for CVE-2026-35273 passed
Jun 12 CVE-2026-35273 added to CISA KEV

Sources

Sep 30 Risky Biz News
ShinyHunters suspect arrested in the Netherlands
A ShinyHunters suspect has been arrested in the Netherlands, Apple fixes an iOS zero-day found by Meta, recent Citrix zero-days see mass e [Read More
original
Sep 29 SecurityWeek
Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation
Pepijn van der Stap was convicted in 2023 for hacking multiple organizations, stealing their data, and extorting them.
original
Sep 29 The Hacker News
Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation
Dutch police arrested a 24-year-old Amsterdam man in a ShinyHunters investigation, with a Rotterdam court appearance set for Sept.
original

Part of the PlainSec briefing for 2026-09-22

Every edition of this story: Dutch arrest splits ShinyHunters leadership story

More from today

Threats & Adversaries · RansomwareDutch arrest splits ShinyHunters leadership storyDutch police confirmed they arrested a 24-year-old Amsterdam man in the ShinyHunters investigation, and the reporting now separates him from the group’s current teenage leader. The arrest advances the probe, but it does not read like a clean disruption of the crew’s present operation.The reporting ties the case to ShinyHunters’ recent FBI job-site defacement and to Oracle PeopleSoft exploitation, but the leadership picture is already fractured: one figure is under arrest while another, younger leader is said to be driving the group. That means an arrest can change attribution without ending the campaign.For teams watching ShinyHunters, the durable lesson is that law-enforcement action may narrow the roster without stopping the branding or the exploitation pattern. If your incident timeline depends on one named operator being the whole story, that assumption may not survive the next update.13 sources · Sep 30