Executive Overview
The arrest of a 24-year-old Dutch cybercriminal by European authorities has triggered a massive, high-stakes escalation in the global threat landscape. The suspect—identified by multiple sources as Pepijn van der Stap, a former software engineer and convicted hacker operating under the alias "Umbreon"—was taken into custody by Dutch law enforcement in mid-September. Van der Stap’s arrest immediately ruptured the fragile operational security of the prolific cyber extortion syndicate ShinyHunters.
In the chaotic weeks following the raid on van der Stap’s residence, remaining members of ShinyHunters launched a wave of aggressive retaliatory cyberattacks. These operations included a brazen breach of the Federal Bureau of Investigation’s job application portal (apply.fbijobs.gov), the extortion of the notorious Russian ransomware operation Cl0p, and a mass-exploitation campaign targeting Oracle PeopleSoft vulnerabilities globally.
Compounding the crisis, threat intelligence analysts and investigative journalists have uncovered internal friction within the cybercriminal underworld, revealing a hostile takeover of the ShinyHunters brand by an adolescent Jordanian hacker known as "Rey." This volatile mix of law enforcement intervention, shifting criminal leadership, and zero-day exploits has elevated ShinyHunters to a premier threat vector on track to amass nearly $100 million in illicit extortion payments.
Detailed Chronology: From Dr. Jekyll and Mr. Hyde to the September Raid
The Double Life of Pepijn van der Stap
The narrative surrounding van der Stap reads like a classic modern tragedy of digital duality. Prior to his initial legal downfall, the Almere and Lelystad native maintained a dual existence. By day, van der Stap was employed as a software engineer at the Amsterdam-based cybersecurity startup Hadrian and volunteered his technical acumen to the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit security research group dedicated to identifying digital vulnerabilities.
By night, however, van der Stap transformed into "Umbreon"—a prominent figure on English-language underground cybercrime forums such as RaidForums and Breached. Operating under this alias, he specialized in harvesting, hoarding, and monetizing massive corporate and governmental databases. During his 2023 criminal trial, van der Stap confessed to his crimes, admitting that his actions were largely driven by an obsessive compulsion to collect, organize, and archive stolen data rather than purely financial incentives.
Prosecutors successfully linked him to a string of high-profile data thefts and extortions that yielded between €1.5 million and €2.7 million. Sentenced to four years in prison (with one year suspended), van der Stap served time until his release in December 2025.
Attempted Rehabilitation and Abrupt Silence
Following his release, van der Stap actively attempted to rebrand himself as a rehabilitated security professional. In an interview with KrebsOnSecurity on September 9, 2026, he cast himself as a reformed individual trying to make amends while dealing with ongoing civil lawsuits and restitution orders from his past victims. At the time of the interview, he was employed as an offensive security lead at the Dutch firm Neo Security.
However, this veneer of rehabilitation cracked within days. Van der Stap abruptly ceased all communication with journalists and associates. Sources familiar with the ongoing investigation confirmed that Dutch law enforcement executed a raid on van der Stap’s residence on or around September 16, carting away hardware and personal effects.
The Dutch police formally confirmed the arrest of a 24-year-old man tied to the broader ShinyHunters investigation, scheduling his appearance before the Rotterdam District Court. In a shocking late development, local Dutch media outlet RTL reported that investigators are examining whether van der Stap attempted to orchestrate at least two murders abroad, significantly escalating the severity of charges against him.
ShinyHunters’ Violent Retaliation and the Odido Connection
The arrest of van der Stap sent shockwaves through the ShinyHunters collective. The group had previously been linked to the high-profile February 2026 breach of Odido, the Netherlands’ largest mobile telecommunications provider. In that attack, a native Dutch speaker socially engineered an Odido employee via a spoofed website, exfiltrating personal data belonging to more than 6.2 million Dutch citizens.
When Dutch authorities publicly released audio clips from the Odido social engineering call in an attempt to identify the suspect, ShinyHunters rallied behind their member. In a statement provided to the NL Times, the gang promised complete emotional, mental, and financial support for the detained operative:
"Our team member has our full support — emotionally, mentally, and financially. Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."
The group also issued vitriolic threats against Dutch law enforcement: "The Dutch police will need all the luck in the world — and everyone’s prayers — if they want to catch him before we carry out another large-scale data theft in the Netherlands. Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."
Supporting Context & Metrics: The FBI Breach, Oracle Exploits, and Underground Warfare
The FBI Job Portal Breach
Capitalizing on the chaos surrounding the Dutch raids, ShinyHunters executed one of their most audacious attacks to date: a zero-day exploit targeting the FBI’s job application portal, apply.fbijobs.gov.
According to investigative reports from 404 Media and Reuters, the breach compromised sensitive Personally Identifiable Information (PII) belonging to more than 5,000 individuals, including Social Security numbers, specific job classifications (such as special agents, threat intake examiners, and major cybercrime investigators), and highly sensitive medical and psychiatric files.
To mock federal authorities, the hackers defaced the compromised portal with an ASCII art rendition of the Pokémon character Umbreon—a direct nod to van der Stap’s former handle—alongside the taunting message: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)."
The PeopleSoft Zero-Day and WAF Bypasses
The FBI breach was part of a broader, mass-exploitation campaign targeting PeopleSoft, a software-as-a-service (SaaS) human resources platform owned by Oracle. The hackers weaponized a vulnerability tracked as CVE-2026-35273.
Although Oracle swiftly issued patches and security firms like Mandiant released web application firewall (WAF) mitigation rules, security researchers at Mandiant and the Google Threat Intelligence Group (GTIG) confirmed that ShinyHunters successfully bypassed these defenses using sophisticated URL-encoding tricks. The campaign impacted dozens of systems across critical sectors, including higher education, healthcare, technology, agriculture, transportation, and government entities.
The Rise of "Rey" and Intersyndicate Warfare
Behind the scenes, the character of ShinyHunters’ operations has undergone a fundamental transformation due to internal leadership struggles. Intelligence analysts trace this pivot to a hostile takeover by an adolescent Jordanian hacker operating under the handle "Rey."
Rey is a key figure in ScatteredLapsussHunters (SLSH), a hybrid cybercrime amalgam fusing elements of Scattered Spider, LAPSUS$, and ShinyHunters. Sources indicate that Rey harbored a severe personal and operational grievance against van der Stap regarding control over the ShinyHunters brand and its assets. The inclusion of the oversized Umbreon Pokémon imagery in the FBI portal defacement was widely interpreted by threat analysts as a deliberate maneuver by Rey to pin the high-risk federal intrusion squarely on the imprisoned Dutch hacker.
This friction was further exacerbated by a chaotic partnership with TeamPCP, an upstart supply-chain hacking group. According to reporting by Wired, Mandiant covertly infiltrated TeamPCP and burned their stolen credentials by feeding them directly to cloud giants like Amazon and Microsoft. Amid the ensuing confusion, ShinyHunters allegedly went rogue, utilizing TeamPCP’s stolen credentials to conduct independent extortions while cutting out their partners.
Official Statements & International Response
Law enforcement agencies on both sides of the Atlantic have responded with a unified front against the expanding operations of ShinyHunters and SLSH.
In a video statement released by the FBI Cyber Division, Assistant Director Brett Leatherman addressed the syndicate directly, acknowledging the assistance of Dutch law enforcement and warning the remaining members of the hacking collective:
"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."
Meanwhile, Dutch authorities continue to process evidence seized from van der Stap’s residence. The Rotterdam District Court has maintained strict security protocols as legal proceedings move forward against the 24-year-old defendant, who now faces an expanding docket of charges that includes data theft, extortion, and suspected solicitation of murder.
Future Outlook
The convergence of aggressive federal investigations, inter-gang betrayals, and sophisticated zero-day exploits marks a critical inflection point in the fight against elite cyber extortion syndicates.
- The Erosion of Cybercriminal Safe Havens: As demonstrated by the coordinated international raids between Dutch police and American intelligence agencies, elite hackers can no longer rely on geographical boundaries or internet aliases to shield their real-world identities. The arrest of van der Stap proves that even technically proficient actors with backgrounds in institutional cybersecurity remain vulnerable to persistent investigative pressure.
- Volatility within Syndicate Hierarchies: The ascent of volatile, younger leadership figures like Rey within hybrid groups like SLSH signals a shift toward riskier, high-impact operations. By attacking law enforcement agencies and rival ransomware groups (such as Cl0p), these factions have effectively eliminated their diplomatic insulation in the cyber underworld.
- Heightened Scrutiny on Software Supply Chains: The mass exploitation of the Oracle PeopleSoft vulnerability underscores the urgent need for robust, proactive vulnerability management. As threat actors continue to bypass standard WAF mitigations through advanced encoding techniques, organizations across all critical infrastructure sectors must accelerate zero-trust architectures and rapid patch deployment strategies.
Ultimately, while ShinyHunters remains financially potent—projected by threat analysts to pull in nearly $100 million in extortion proceeds throughout 2026—the tightening noose of global law enforcement suggests that the collective’s current reign of high-profile cyberattacks may face an accelerated and systemic dismantling.
