The Fall of ‘Umbreon’ and the Rise of ‘Rey’: Inside the Chaos, Collisions, and Escalating Campaigns of ShinyHunters

By Investigative Staff
Global Cybersecurity & Threat Intelligence Desk

Main Facts

In a high-stakes convergence of international law enforcement, internal underworld betrayals, and devastating corporate breaches, authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal suspected of playing a critical role in the data thefts and extortion campaigns masterminded by the prolific hacking collective ShinyHunters.

According to three sources close to the investigation, the detained individual is Pepijn van der Stap, a Dutch national residing in Almere and Lelystad. Van der Stap is no stranger to the justice system; he was previously convicted in late 2023 for a sprawling wave of data thefts and corporate extortions that prosecutors estimated raked in between €1.5 million and €2.7 million.

Yet, Van der Stap’s arrest is merely the catalyst for a much larger, highly volatile geopolitical storm. In the immediate aftermath of his detention, remaining members of ShinyHunters—operating under new, volatile leadership—dramatically escalated their offensive operations. The group launched an unprecedented, brazen cyberattack against the FBI’s job application portal (apply.fbijobs.gov), exfiltrating deeply sensitive personnel files, Social Security numbers, and confidential medical and psychiatric assessments of federal agents. Simultaneously, the group turned its crosshairs outward, extorting the notorious Russian ransomware syndicate Cl0p and launching a mass-exploitation campaign across global supply chains that threat intelligence firms warn could net the gang nearly $100 million in illicit payments by the end of 2026.

Underpinning these digital felonies is a bitter, cutthroat succession battle for control of the ShinyHunters brand, marked by internal sabotage, false-flag framing operations, and an infiltration strategy orchestrated by a teenage Jordanian cybercriminal known as Rey.

Chronology of Events

The intricate web of events leading up to the current crisis spans several years of dual lives, prison sentences, and shifting underground alliances.

• September 2021: Operating under the pseudonym “Umbreon”—complete with a Pokémon avatar—Pepijn van der Stap sells massive stolen databases on English-language cybercrime forums like RaidForums, dumping information belonging to 2.3 million Dutch citizens.
• Late 2023: Van der Stap is arrested, prosecuted, and convicted in the Netherlands. During his trial, he admits to leading a "Dr. Jekyll and Mr. Hyde" existence: by day, he worked as a software engineer for Amsterdam-based cybersecurity startup Hadrian and volunteered for the non-profit Dutch Institute for Vulnerability Disclosure (DIVD); by night, he extorted corporate victims under the Umbreon moniker. He is sentenced to four years in prison (with one year suspended).
• March 2025: Cybersecurity firm KELA publicly unmasks Rey, a teenage cybercriminal operating out of Amman, Jordan, who serves as an administrator for the cybercrime amalgamation ScatteredLapsussHunters (SLSH)—a fusion of Scattered Spider, LAPSUS$, and ShinyHunters.
• December 2025: Van der Stap is released from prison, having served the custodial portion of his sentence. He attempts to rebrand himself, landing a job as an offensive security lead at Dutch firm Neo Security and maintaining in interviews that he is attempting to make amends for his past.
• February 2026: A native Dutch-speaking ShinyHunters operative uses sophisticated social engineering against Odido, the Netherlands’ largest mobile telecommunications provider. By tricking an employee into logging into a spoofed web portal, the hacker steals data belonging to more than 6.2 million Dutch citizens. Dutch police subsequently release audio clips asking the public for help identifying the voice.
• September 9, 2026: Van der Stap gives an extensive interview to security journalist Brian Krebs, casting himself as a reformed hacker trying to steer his life straight while grappling with lingering civil lawsuits and restitution. Shortly after, he abruptly stops responding to communications.
• On or around September 16, 2026: Dutch authorities arrest Van der Stap for his alleged continued ties to ShinyHunters. Witnesses report law enforcement carting boxes of digital evidence out of his residence.
• Late September 2026: ShinyHunters breaches the FBI’s job application portal, leaving behind an ASCII art image of the Pokémon Umbreon in a calculated move by Rey to pin the high-profile federal crime on the newly arrested Dutch hacker.
• September 25, 2026: Mandiant and the Google Threat Intelligence Group (GTIG) publish joint threat advisories confirming a mass-exploitation campaign targeting an Oracle PeopleSoft vulnerability (CVE-2026-35273), revealing that ShinyHunters bypassed web application firewall (WAF) mitigations using advanced URL-encoding tricks.

Supporting Data and Technical Analysis

The technical execution of the recent ShinyHunters campaigns demonstrates a sophisticated evolution in tradecraft, moving from simple credential stuffing and forum leaks to zero-day exploitation and advanced evasion tactics.

The Oracle PeopleSoft Zero-Day and WAF Bypasses

The engine driving ShinyHunters’ 2026 financial windfall is a critical vulnerability tracked as CVE-2026-35273, affecting Oracle PeopleSoft, a widely deployed enterprise platform used globally for human resources, hiring, benefits management, and payroll processing.

Initially exploited as a zero-day as early as June 2026, Oracle rapidly issued patches, while security firm Mandiant released stop-gap web application firewall (WAF) rules to protect organizations unable to immediately patch their systems. However, security reports released in late September by BleepingComputer, Mandiant, and Google Threat Intelligence Group revealed that ShinyHunters successfully neutralized these defenses by implementing a sophisticated URL-encoding trick to bypass Mandiant’s WAF mitigation rules.

This technique allowed the gang to mass-exploit dozens of organizational networks spanning higher education, technology, healthcare, agriculture, transportation, and government sectors.

The FBI Breach

Leveraging access gained through the PeopleSoft flaw (or associated supply chain credentials), ShinyHunters penetrated apply.fbijobs.gov, the public-facing recruitment and application portal for the Federal Bureau of Investigation. According to breach investigations conducted by 404 Media and Reuters, the stolen cache contained:

• Social Security numbers and personally identifiable information (PII) of more than 5,000 FBI personnel and applicants.
• Specific operational team assignments and job titles, including Special Agents, threat intake examiners, and members of major cybercrime units tracking foreign state-sponsored actors.
• Highly sensitive medical and psychiatric evaluation files belonging to bureau staff.

In a display of psychological warfare, the defacement banner left on the FBI portal featured a prominent ASCII art rendition of the Pokémon Umbreon alongside the taunting text: "This site has been seized by ShinyHunters. rooting your systems since ’19 ;)." Intelligence analysts quickly recognized this as an identical calling card used during the group’s 2020 compromise of Hackforums, weaponized here by Rey to incriminate the freshly detained Pepijn van der Stap.

Official Responses

The escalation of hostilities has drawn sharp, public reactions from corporate entities, security researchers, and international law enforcement bodies alike.

• The Federal Bureau of Investigation: In the wake of the portal breach, the FBI issued a concise press statement confirming the compromise of the apply.fbijobs.gov system and acknowledging that employee PII had been accessed. The bureau has not commented on the specific operational fallout regarding its cyber units.

• ShinyHunters’ Public Posturing: Responding aggressively to Dutch media outlets regarding the audio clips released by police investigating the Odido telecom hack, the collective issued a defiant statement backing their incarcerated colleague:

  "Our team member has our full support — emotionally, mentally, and financially. Everything has been arranged, including a criminal defense lawyer. We do not look down on our staff and members; we take excellent care of them."

  

  The group also lashed out at local law enforcement:

  "The Dutch police will need all the luck in the world — and everyone’s prayers — if they want to catch him before we carry out another large-scale data theft in the Netherlands. Frankly, the Dutch police are a big joke; they are incapable of doing anything. Incompetent. Irrelevant. Unimportant. Useless."

• DIVD (Dutch Institute for Vulnerability Disclosure): Following reports of an internal cybersecurity incident involving the potential malicious use of artificial intelligence at the non-profit research group, DIVD representatives clarified that the internal event bore no connection to ShinyHunters nor to the historical volunteer work of Pepijn van der Stap.
• Neo Security & Hadrian: Van der Stap’s current employer, Neo Security, where he served as an offensive security lead, declined all requests for comment regarding his arrest. His former employer, Hadrian, and legal representatives have remained largely silent as the investigation unfolds.

Implications

The simultaneous arrest of Pepijn van der Stap and the reckless escalation by the ShinyHunters collective under the leadership of "Rey" signal a profound turning point in the global cybercrime landscape.

1. The Death of the "Lone Hacker" Myth: The case illustrates how underground syndicates routinely exploit, consume, and discard individual talent. Van der Stap’s transition from a data-hoarding software engineer into a state-targeted cybercriminal highlights the devastating real-world consequences of mixing raw technical prowess with compulsive digital hoarding and poor psychological safety nets. Furthermore, Rey’s deliberate use of Umbreon imagery to frame Van der Stap demonstrates that honor among thieves is entirely non-existent; gang members will readily feed their own comrades to law enforcement as a smoke screen.
2. A Pivot to High-Risk, High-Reward Geopolitical Trolling: Historically, groups like ShinyHunters focused on corporate data theft and extortion for monetary gain. Under Rey and the ScatteredLapsussHunters umbrella, operations have mutated into brazen, ego-driven geopolitical acts of war—targeting the FBI and Russian ransomware syndicates like Cl0p simultaneously. This reckless strategy risks provoking an unprecedented, coordinated international cyber-policing backlash.
3. The $100 Million Extortion Economy: Security analysts from Mandiant and Google estimate that despite (or perhaps because of) law enforcement pressures, ShinyHunters is on track to amass close to $100 million in extortion payouts throughout 2026. The group’s ability to rapidly pivot from zero-day exploits (PeopleSoft) to supply-chain credential harvesting proves that traditional perimeter defenses and static web application firewalls are fundamentally inadequate against agile, fluid cybercriminal confederations.

As Dutch prosecutors prepare their case against Pepijn van der Stap, and as international intelligence agencies hunt for the Amman-based teenager known as Rey, the digital underworld watches with bated breath—anticipating whether the modern hydra of cybercrime can survive its own internal civil war.