INSIDE THE SHINYHUNTERS CHAOS: FBI HACK, RIVAL HACKERS AND ALLEGED MURDER PLOTS
Oct 04, 2026
The investigation surrounding hacking group ShinyHunters has taken an extraordinary turn. What started as another international cybercrime investigation now involves an arrested Dutch hacker, an alleged internal power struggle, a massive breach of FBI data and separate allegations involving attempts to arrange two murders abroad.
At the center of the Dutch investigation is 24-year-old Pepijn van der S., identified by multiple media organizations as Pepijn van der Stap. Dutch police arrested him in Amsterdam on September 15 on suspicion of participating in a criminal organization connected to ShinyHunters. The FBI has gone further, describing him as one of the group's alleged leaders, although Dutch investigators say his precise role remains under investigation.
Van der Stap was already well known to Dutch authorities. In 2023 he was convicted of hacking, extortion and money laundering and received a four-year prison sentence, one year of which was suspended. After his release, however, he presented himself publicly as a reformed hacker and returned to legitimate cybersecurity work.
The latest investigation became much darker after his arrest. Dutch police say investigators discovered information on his laptop concerning two murders that were allegedly supposed to take place abroad. Police say there are indications that Van der Stap attempted to commission the killings. Authorities have not disclosed the intended victims or countries involved, and importantly, police say the murder investigation is separate from the ShinyHunters case. Van der Stap remains a suspect and these new allegations have not been proven in court.
A FIGHT FOR CONTROL OF SHINYHUNTERS?
The story becomes even stranger when looking at what was allegedly happening inside the hacking community.
Cybersecurity journalist Brian Krebs reported that Van der Stap had been involved in a dispute with a young hacker known as “Rey” over control of the ShinyHunters name and data. Sources cited by Krebs suggested that after Van der Stap's arrest, the group took a much more aggressive direction under Rey's influence.
That included attacks against the Russian ransomware operation Cl0p and, most dramatically, the FBI itself. ShinyHunters claimed it breached an FBI recruitment system and obtained highly sensitive information relating to bureau employees. Reuters examined samples containing personally identifiable information as well as sensitive job, medical and psychiatric information. The FBI has been treating the incident as a serious compromise.
There is another bizarre detail. Van der Stap previously used the hacker identity “Umbreon.” Following his arrest, Umbreon imagery appeared during attacks attributed to ShinyHunters, including the FBI incident. Sources speaking to Krebs suggested this may have been an attempt by rivals to associate Van der Stap with attacks occurring while he was already in custody.
That theory has not been established by law enforcement, however. ShinyHunters itself has publicly denied that Van der Stap belongs to the current group, telling journalists he had “no association” with them. Dutch police and the FBI clearly take a different view and continue investigating his suspected connections.
NOW “REY” HAS BEEN DETAINED TOO
The biggest new development came this week.
Reuters reports that Saif al-Din Khader, the hacker allegedly known as Rey, has been detained in Jordan. Even more significantly, sources say he is now cooperating with the FBI and helping investigators identify and locate other hackers.
One source told Reuters that Khader was walking investigators through electronic devices and digital communications. Jordan has confirmed the detention of a suspected ShinyHunters member and says its investigation into the group and related actors is continuing.
That could be extremely damaging for an organization such as ShinyHunters. Cybercriminal groups depend heavily on aliases and compartmentalization, but investigators who gain access to a member's communications may be able to connect usernames, conversations and other evidence to real people.
ShinyHunters' behavior has also changed dramatically. Its dark-web leak site disappeared shortly after the FBI publicly warned members that investigators were coming for them. Operators communicating through a ShinyHunters-linked email later told Reuters that they wanted “no further escalation” with the FBI and indicated the group was backing down.
The result is an unusually chaotic picture: one alleged member imprisoned in the Netherlands, another suspected member detained in Jordan and reportedly cooperating, an FBI investigation spanning multiple countries, an apparent internal struggle over the ShinyHunters identity and separate allegations of attempted murder solicitation.
Whether ShinyHunters survives under the same name remains unclear. But the events of the past few weeks demonstrate something frequently seen in cybercrime investigations: the biggest threat to a hacking group may eventually come from inside the group itself.
At the center of the Dutch investigation is 24-year-old Pepijn van der S., identified by multiple media organizations as Pepijn van der Stap. Dutch police arrested him in Amsterdam on September 15 on suspicion of participating in a criminal organization connected to ShinyHunters. The FBI has gone further, describing him as one of the group's alleged leaders, although Dutch investigators say his precise role remains under investigation.
Van der Stap was already well known to Dutch authorities. In 2023 he was convicted of hacking, extortion and money laundering and received a four-year prison sentence, one year of which was suspended. After his release, however, he presented himself publicly as a reformed hacker and returned to legitimate cybersecurity work.
The latest investigation became much darker after his arrest. Dutch police say investigators discovered information on his laptop concerning two murders that were allegedly supposed to take place abroad. Police say there are indications that Van der Stap attempted to commission the killings. Authorities have not disclosed the intended victims or countries involved, and importantly, police say the murder investigation is separate from the ShinyHunters case. Van der Stap remains a suspect and these new allegations have not been proven in court.
A FIGHT FOR CONTROL OF SHINYHUNTERS?
The story becomes even stranger when looking at what was allegedly happening inside the hacking community.
Cybersecurity journalist Brian Krebs reported that Van der Stap had been involved in a dispute with a young hacker known as “Rey” over control of the ShinyHunters name and data. Sources cited by Krebs suggested that after Van der Stap's arrest, the group took a much more aggressive direction under Rey's influence.
That included attacks against the Russian ransomware operation Cl0p and, most dramatically, the FBI itself. ShinyHunters claimed it breached an FBI recruitment system and obtained highly sensitive information relating to bureau employees. Reuters examined samples containing personally identifiable information as well as sensitive job, medical and psychiatric information. The FBI has been treating the incident as a serious compromise.
There is another bizarre detail. Van der Stap previously used the hacker identity “Umbreon.” Following his arrest, Umbreon imagery appeared during attacks attributed to ShinyHunters, including the FBI incident. Sources speaking to Krebs suggested this may have been an attempt by rivals to associate Van der Stap with attacks occurring while he was already in custody.
That theory has not been established by law enforcement, however. ShinyHunters itself has publicly denied that Van der Stap belongs to the current group, telling journalists he had “no association” with them. Dutch police and the FBI clearly take a different view and continue investigating his suspected connections.
NOW “REY” HAS BEEN DETAINED TOO
The biggest new development came this week.
Reuters reports that Saif al-Din Khader, the hacker allegedly known as Rey, has been detained in Jordan. Even more significantly, sources say he is now cooperating with the FBI and helping investigators identify and locate other hackers.
One source told Reuters that Khader was walking investigators through electronic devices and digital communications. Jordan has confirmed the detention of a suspected ShinyHunters member and says its investigation into the group and related actors is continuing.
That could be extremely damaging for an organization such as ShinyHunters. Cybercriminal groups depend heavily on aliases and compartmentalization, but investigators who gain access to a member's communications may be able to connect usernames, conversations and other evidence to real people.
ShinyHunters' behavior has also changed dramatically. Its dark-web leak site disappeared shortly after the FBI publicly warned members that investigators were coming for them. Operators communicating through a ShinyHunters-linked email later told Reuters that they wanted “no further escalation” with the FBI and indicated the group was backing down.
The result is an unusually chaotic picture: one alleged member imprisoned in the Netherlands, another suspected member detained in Jordan and reportedly cooperating, an FBI investigation spanning multiple countries, an apparent internal struggle over the ShinyHunters identity and separate allegations of attempted murder solicitation.
Whether ShinyHunters survives under the same name remains unclear. But the events of the past few weeks demonstrate something frequently seen in cybercrime investigations: the biggest threat to a hacking group may eventually come from inside the group itself.