The cybercrime group ShinyHunters says disruptions to its dark web leak site on are unrelated to its breach of the FBI. In a statement to Straight Arrow on Thursday, a representative for ShinyHunters said the group took the website offline to perform infrastructure upgrades because rival hackers launched a distributed denial-of-service, or DDoS, attack — not because of a criminal investigation by the FBI.
“Our website being down has no relation to what ever is going on with the victim entity and we have no comment about what ever is going on there,” the representative said. “Furthermore, datacentres supporting our infrastructure also suffered disruption due to unrelated incident,” the representative added. While the URL previously used by the group no longer directs to its website, Straight Arrow uncovered on Thursday a new domain on the dark web resembling ShinyHunters’ previous infrastructure.
A hacker with the group confirmed to Straight Arrow over email that the new URL is valid. The domain, which includes a new captcha system designed to protect against DDoS attacks, lists the companies O’Reilly Automotive and DexCom, Inc. as the group’s latest victims. “When you visit the page you will be able to clearly see the upgrades that were done to mitigate DDoS attacks,” the group said.
Hack exposed sensitive information The site went down
Hack exposed sensitive information The site went down days after ShinyHunters defaced the FBI jobs website and stole between two and three terabytes of personal information on what it said were nearly ”all FBI employees and applicants.” The data, reportedly obtained after the hackers exploited a previously unknown vulnerability to access a government cloud server, includes information such as the names, job titles, Social Security numbers, addresses, phone numbers, dates of birth and badge numbers of current and former FBI employees.
Personal information on applicants as well as the spouses of agents and applicants was also exposed. The breach highlighted the online vulnerability of the nation’s top law enforcement agency, with possible national security implications. The leaked data could be used to learn the identity of agents involved in sensitive investigations and possibly to compromise their work. A sample of the data containing information on 5,000 employees, which the hackers provided to numerous media outlets, revealed details on everyone from the FBI’s secretive hacking unit to agency employees investigating China, Russia and drug cartels.
ShinyHunters said it breached the FBI in response to a public service announcement from May in which the bureau accused the hackers of using harassment and “exaggerated claims of access” to sensitive data as part of its extortion efforts. The hackers, pushing back on the characterization, told Straight Arrow that it does not “exaggerate, lie or bluff.” And although the group gave the FBI one week to retract or delete the public service announcement, seen by many as a threat to leak the full data cache, the group later told Straight Arrow it never planned to do so.
Since the very beginning we had made our
“Since the very beginning we had made our decision that we would never publish this data,” the group said. Priority for FBI In the wake of the breach, the FBI appears to have prioritized disrupting the hacking group. In a statement to NPR, an FBI spokesperson said the bureau is working “around the clock to investigate the cyber incident involving FBIJobs.gov and is in regular communication with anyone who may be impacted.” The FBI also announced on Tuesday that a 24-year-old member of ShinyHunters had been arrested by Dutch law enforcement.
The bureau did not say whether the individual was involved in the breach of its data. FBI Cyber Division Assistant Director Brett Leatherman also published a video statement on the bureau’s website calling on other members of the group to turn themselves in. “To the remaining members of ShinyHunters: You’ve heard about the arrest of your colleague,” Leatherman said.
“Other groups believed anonymity or their friends would protect them and they were wrong,” he continued. “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who’s left. I suggest you reach out first while the choice is still yours.”
