Aftermath of the September ShinyHunters Arrests: Battle Over the Brand Name

Part 2: The Fight Over the Name After Rey (Read Part 1 here)

By Jon DiMaggio, Cybersecurity Researcher

The September arrests should have been the end of ShinyHunters. Instead, threat actors saw what happens to whoever wears the crown, and rather than rebrand or distance themselves from the title, they began to fight with one another over who should have it.

The timeline shows how fast it happened. Dutch police arrested a 24-year-old on September 15 for what they described as “participation.” Two weeks later, Rey, whom other threat actors in the posts I collected treated as one of its leaders, was detained in Jordan, and Reuters later reported that he was cooperating with the FBI. Within a week, rival Telegram channels were posting leadership claims, and by mid-October, I counted at least three factions, each insisting it was the real ShinyHunters.

I spent months going through their channels in Flare, and the public fight didn’t match what I found underneath it. All summer, the leak site and those rival channels had sent victims to the same server, 176.120.22[.]24, to download stolen data, even as they publicly disowned one another. I couldn’t establish whether the channel operators had access to those servers or were copying public download links.

In Part 1 of this two-part series, I laid out how Scattered Spider, LAPSUS$ and ShinyHunters operate as three separate intrusion clusters, while SP1D3R HUNTERS (Scattered LAPSUS$ Hunters) is a brand they share rather than a group of its own. Treat them as one group and your attribution will be wrong. Part 1 asked whether arresting these threat actors stopped the attacks, and I gave you my answer then: it didn’t. Part 2 picks up from there. When the threat actors behind a brand get arrested, what happens to the name they leave behind, and who gets to use it?

NOTE: “Faction” isn’t a standard term in threat reporting. This is one of the most confusing and difficult investigations I’ve done, and to communicate my findings clearly, I needed a way to separate the threat actors competing for the ShinyHunters name. In ransomware, “group” usually means a centrally managed operation, like a ransomware-as-a-service (RaaS) program, which ShinyHunters certainly is not. So I use “factions” for the three entities behind the ShinyHunters activity in this report. By October, the activity had split into these three:

• The leak-site faction: the threat actors behind the ShinyHunters leak site and forum accounts, who call themselves the real ShinyHunters.
• The Aegis faction: the threat actors running the Telegram channels that promoted Aegis, a persona who claimed to lead ShinyHunters after Rey’s arrest. They posted first in the “SH” and “ShinyHunters (SLSH)” channels, then in “SH Group,” “Other And Other” and the Escanors channels after October 10.
• ShinyEquationCartel: a Telegram brand that opened October 10, claiming former ShinyHunters, LAPSUS$, HellCat, and LockBit members. The “ShinyHunters (SLSH)” channel joined it that day.

Before October, the Telegram side was spread across more channels than these, and I refer to those as the Telegram channels.

Key Findings About the Aftermath of the ShinyHunters Arrests Takeaways

• The arrests didn’t retire the ShinyHunters name. They put it up for grabs. After the September arrests, at least three factions claimed the name, and the two on Telegram publicly denounced each other. That left victims like H&M facing rival claims to the same stolen data, with no way to know which faction to pay.
• The ShinyHunters-associated factions publicly disputed one another while advertising download links to the same servers. The leak site and rival Telegram channels all linked to 176.120.22[.]24, and based on technical evidence, I’m moderately confident one operation maintained its backup servers together through at least September 18.
• After the arrests, Aegis’s contacts showed up on a channel tied to the summer’s busiest leak account. The “International Global Network (SLSH)” channel now signs its posts with Aegis’s contacts, and its posting patterns support coordinated publishing with @shsupportsh.
• Telegram handles can be bought, hijacked or shared, so a handle alone doesn’t identify anyone. The Aegis faction accused a member called Sevy of informing on Rey and tied her to the @barbie handle, but the account holding @barbie now says it bought it. Whether that account belongs to Sevy is not confirmed.
• Names, UNC identifiers and copied signatures are claims, not attribution. What held up in this research was hard to fake: signatures that actually verify, server maintenance patterns, account IDs tracked over time and the tactics the human operators keep coming back to.

Background: One Name, Many Claims

ShinyHunters has stolen and sold data since 2020. In 2025, it became the most visible name inside Scattered LAPSUS$ Hunters (SLH), the shared brand behind last year’s extortion campaign against Salesforce customers. Most of what follows comes from my own research: Telegram and forum posts I collected through Flare, and the leak site and servers behind the brand. In my assessment, most of the Telegram activity belongs to the SLH brand rather than to ShinyHunters proper.

Most Russian-speaking ransomware gangs vet affiliates and control their access to the gang’s panel and leak site, so they can cut anyone off. But controlling a panel is different from controlling a name. ShinyHunters could not revoke another faction’s ability to use its name or advertise copied download links. In 2025, the threat actors behind it ran much of their public activity through Telegram alongside SLH, then shifted mainly to their leak site and forum accounts. Other SLH-associated malicious actors kept opening Telegram channels under the ShinyHunters name to sell and leak data. I believe most of them couldn’t post to the leak site and could only repost from it, but I can’t prove that. For the next ten months, the leak-site faction and the competing channels disowned each other’s accounts and called each other fake, and none of it stopped anyone from using the name.

Based on the data I collected and the human interactions I reviewed during this research, I believe the leak-site faction was the core ShinyHunters operation during the period covered by this research. Google’s June and September 2026 reports tie activity under the publicly known ShinyHunters name to that leak site and to UNC6240, the extortion cluster behind it. I can’t prove they’re the same threat actors who sold stolen data as ShinyHunters in 2020.

Every sale, threat, and leak on Telegram was open to doubt, so the threat actors behind the Telegram channels tried to prove their posts were their own. They signed with Session IDs, the private contact address at the bottom of most of their sales and extortion posts. Anyone could copy an ID into their own post, so a matching ID only showed where replies went, not who wrote the post.

The Fight Over the Name

On October 4, five days after Rey’s reported detention, whoever runs the Telegram channel “ShinyHunters (SLSH)” reposted a statement from someone calling himself Aegis. I can’t tell you whether that’s one person or several, so I’ll call them the Aegis faction, after the persona they promoted. That doesn’t mean Aegis runs the channel. Table 1 lists the accounts and contacts I refer to in this report. Aegis said he was the “Grand Founder” of ShinyHunters and had taken control of the organization after Rey’s arrest. The next day, the Aegis faction dropped most of the addresses that had appeared in every version of the brand’s contact list since spring, including their XMPP chat account and Tuta email address. They kept one Proton Mail address and one Session ID, 0501da…, and said @reyswap was Aegis’s account.

Name in this report	Who or what	Identifiers	Status
The leak-site faction	The threat actors behind the ShinyHunters leak site and forum accounts, who call themselves the real ShinyHunters	ShinyHunters leak site; forum accounts on BreachForums and XSS	My assessment, moderate confidence: was the core ShinyHunters operation during the period covered by this research
The Telegram factions	The threat actors running Telegram channels under the ShinyHunters and SLH names	“ShinyHunters (SLSH)” channel and ShinyEquationCartel (rows below); “International Global Network (SLSH)” channel -1003528892083; support account @shsupportsh, Telegram ID 8581727007	Claims the brand; promoted together with the leak site under SLH for most of 2025
SLH (Scattered LAPSUS$ Hunters)	A shared brand that combines the ShinyHunters, Scattered Spider and LAPSUS$ names (Part 1)	SLH-branded Telegram channels, including “scattered LAPSUS$ hunters part 9” (-1004374612447) and “Fuck M4ndiant, CrowdStrike ,SLH” (-1004482237550)	SLH is a brand and coordination layer, not a single intrusion cluster (Part 1)
“ShinyHunters (SLSH)” channel	Telegram channel run by one of the Telegram factions. This blogcalls the threat actors behind it “the Aegis faction”	Channel -1004302958887; reposts its origin channel, SH (-1004228181647)	The Aegis faction’s channel through October 9; announced on October 10 that it was joining ShinyEquationCartel. Reposted the Aegis statement; began listing a second Session ID on October 6
Aegis	Persona claiming to be the “Grand Founder” of ShinyHunters after Rey’s arrest	Claimed @reyswap as his account on October 3	Actor claim. My assessment, moderate confidence: not credible. A June statement reused a 2025 signature, but its connection to Aegis’s later leadership claim remains unverified, and forum peers called his claim a “larp”
@reyswap	Telegram account the origin channel listed as its founder from September 25, 2026, then claimed on October 3 by Aegis	Telegram ID 8746178180; founder listing first seen in a repost of the origin channel (“Escanors Official” -1003398932380/10702815232)	ShinyEquationCartel said it “does NOT possess” the H&M data
Rey	Detained in Jordan on September 29, 2026; treated as one of the group’s leaders in the posts I collected. Reuters named him as Saif al-Din Khader, citing people familiar with the matter	None	Reported detained September 29 and cooperating with the FBI (Reuters, October 3). No public charges or law enforcement statement as of October 14.
Sevy / @barbie (link unresolved)	Member the Aegis faction accused on October 6 of putting Rey in prison by handing over his personal information, BTC address, and photo. Cybercrime channels tied Sevy to @barbie in May and again in October; the account holding @barbie on October 15 (8448751453) says it bought the handle. Actor posts call Sevy both “her” and “him;” I use “her,” as the accusation does	Telegram channel “I HATE FRANCE BL2C,” whose description lists @barbie. The Aegis faction’s “SH” channel identified it as Sevy’s channel on October 6 at 12:19 UTC. Earlier brand contact: shinysevy[@]tutamail[.]com (April 2026 contact blocks)	Actor claim: accused of informing on Rey. Unverified. Unresolved whether the current @barbie account belongs to the person the channels called Sevy
Session 0501da0be27ccac7d4cec7ca1a84e946e3c7dfa9c4da49552b5f32d69980596d7b	The contact the Aegis faction kept after dropping their other addresses	First seen September 5, 2026	Still in use in mid-October
Session 05cd1b4d112bc03c6512b030de865af03468530566d22c82c48737ac1c9a433421	New contact on the Aegis faction’s October 6 ad, then ShinyEquationCartel’s negotiation contact	First seen 17:44 UTC, October 6, 2026	Same inbox in both places; who wrote the posts is unproven
ShinyEquationCartel	New Telegram channel claiming former ShinyHunters, LAPSUS$, HellCat and LockBit members	Channel -1004410761239, opened October 10	Membership and breach claims unconfirmed

Table 1: Who’s who in this report, with the identifiers I tracked and each one’s status as of mid-October 2026. Unless a row cites another source, the identifiers come from Telegram and forum posts I collected in Flare.

On October 6, the Aegis faction gave H&M a week to pay $100,000. Within the hour, they accused another member, Sevy, whom the Aegis faction tied to @barbie, of having “put Rey in prison, by giving Rey’s personal information, sending Rey’s personal BTC address, and sending Rey’s real photo” (Figure 1), and warned rivals that their “identities will soon be leaked to the feds (FBI, DOJ, and the DGSI for the French clowns).” That’s an extortion gang threatening to inform on rivals in its own community, which tells you how much trust was left. About an hour later, the same channel mocked Sevy for renaming her own channel “I HATE FRANCE BL2C,” a jab at the French police cybercrime unit, and said it hoped BL2C would come to her house and pick her up (Figures 2 and 3).

The same day, the Aegis faction’s contact details changed. A day earlier, it had cut its contact list down to a single Session ID, 0501da. At 16:47 UTC, the channel posted that contact block as usual. 57 minutes later, an ad for access to casino gaming panels on the same channel listed a different Session ID, 05cd1b4d…. The old ID didn’t disappear. At 22:05 UTC, the channel reposted Aegis’s contact block, still ending in 0501da (Figure 4). One day after the faction made 0501da its only Session contact, the same channel was advertising a second one. I noted the new ID and monitored for new activity associated with it.

Figure 1: The “SH” channel’s October 6 post accusing Sevy, whom the channel tied to @barbie, of informing on Rey. I blacked out a sexual insult aimed at Sevy. (Flare link to post, sign up for the free trial to access if you aren’t already a customer)

Figure 2: About an hour after the accusation, the “SH” channel said Sevy had renamed her channel “I HATE FRANCE BL2C.” I blacked out a racist remark at the end of the post. (Flare link to related source with matching wording, not the pictured post, sign up for the free trial to access if you aren’t already a customer)

Figure 3: The “I HATE FRANCE BL2C” channel’s description lists @barbie.(Flare link to related message mentioning @barbie, sign up for the free trial to access if you aren’t already a customer)

Figure 4: Three October 6 posts from the “ShinyHunters (SLSH)” channel, listing Session 0501da, then 05cd1b4d, then 0501da again. Screenshot times are EDT. (Flare link to first post only, second post only, or third post only; sign up for the free trial to access if you aren’t already a customer)

Four days after the new Session ID appeared, a new Telegram channel called ShinyEquationCartel appeared. Its opening posts asked readers to share the link. The next day, posting as ShinyEquationCartel, they claimed a breach of the telecom company Orange and told the victim to negotiate through a single Session ID: 05cd1b4d. They described themselves as a loose collective of former ShinyHunters, LAPSUS$, HellCat, and LockBit members who “cooperate when it serves us” and “operate independently when it doesn’t” (Figure 5).

Figure 5: The banner from ShinyEquationCartel’s introduction post on October 11, 2026, at 14:22 UTC. (Flare link to post, sign up for the free trial to access if you aren’t already a customer)

By October 13, they were auctioning H&M data, the same company the Aegis faction had threatened a week earlier, with a note that @reyswap “does NOT possess this database.” On October 14, they offered “$11.000 USD for Aegis dead head” and called him their pawn. The worst part is that the victim now had two factions claiming the same data. If H&M wanted to pay, it would have to guess which one actually held it, or pay them both. Figure 6 shows the sequence, and the timeline in Appendix A puts these events next to the arrests.

Figure 6: How the same Session contact appeared in posts associated with the Aegis faction and ShinyEquationCartel. The dashed line marks the new brand turning on Aegis. A shared Session ID shows where replies went, not who wrote the posts. Supporting post for the Orange claim and advertised Session ID: Flare: Orange claim, October 11. Channel-opening post only: Flare: channel opening, October 10. Bounty-claim post: Flare: October 14 bounty claim.

None of these claimed attacks has been confirmed as a new compromise, or as the work of any particular faction. On October 12, H&M said it was investigating claims attributed to ShinyHunters and had so far found no sign its data environment was compromised. Every claim here comes from a threat actor who wants to get paid, and I treat each one as unverified. With several factions each calling itself the real ShinyHunters and calling the others scammers, I can’t accept anyone’s claim to lead the group on their word alone. Rey’s case was different, because his role showed in how the rest of the ecosystem dealt with him, not just in what he said about himself. All Aegis offered was a statement, reposted on Telegram days after a major arrest, and that isn’t enough for me to make an assessment. What I wanted to know was whether a real operation moved into ShinyEquationCartel or whether rival factions were reusing the same names and contacts. To find out, I went back to the Telegram accounts and leak servers that had handled ShinyHunters’ sales and extortion for most of 2026.

The Forgery

Earlier this month I wrote about a June 12 Telegram post that recycled a December 2025 ShinyHunters statement signed with the old BreachForums admin key. ShinyHunters had been tied to running BreachForums, so a statement signed with the forum’s admin key was the closest thing the group had to an official seal. Someone had changed the contact from @wokawoka10 to @myselft6040 and copied the December statement’s PGP signature block underneath it, character for character. That block contains the cryptographic signature used to verify that a message was signed with a particular key and hasn’t been altered. Copying it made the June post look signed, but it couldn’t authenticate the changed text. I verified the original December statement successfully; the altered June text taken directly from Flare failed verification. The December signer’s fingerprint was E80C1308A09EC1ADC418C3F02578988F69BCA3FC. For this report, I went back to the channel that posted it, titled “ShinyHunters” (-1003920339685), and looked at the posts around it. The original statement came from the leak-site faction, which had denied any affiliation with SLH and called itself the real ShinyHunters. Whoever posted the June forgery used the leak-site faction’s statement to make @myselft6040 look like an authenticated ShinyHunters contact.

The channel posted the forgery after a series of leak listings and payment demands on June 12. Figure 7 shows the sequence, A through F. All times below are UTC.

Figure 7: The channel’s posts on June 12–13, 2026, by original post time (UTC). Captured via a mirror channel in Flare; image-only messages omitted; victim claims are unverified. Supporting mirror copy: Flare: June 12 mirrored statement, 20:51 UTC.

A. Between 18:55 and 19:16, the channel posted 21 leak listings.

B. At 20:14, it posted what it claimed was University of Nottingham data, with a download link on 176.120.22[.]24, the server Google had publicly named the day before as the clear web mirror of the ShinyHunters leak site. Google also observed an outbound SSH connection from the attackers’ staging host to that mirror, linking it to UNC6240’s June operation.

C. Over the next six minutes, six “FINAL WARNING PAY OR LEAK” posts followed, each listing the same XMPP, Tuta and Session contacts.

D. At 20:42, twenty-two minutes after the last warning, the channel posted the forged statement.

E. At 22:58, a post listed “SH Leader: @shinhcorpzs,” a Telegram invite labeled “SH Office,” and contact details introduced as “Our actual Official Contact.”

F. At 00:51 on June 13, the channel offered Salesforce and Cisco data for $250,000 and listed “UNC6040 @myselft6040” as the contact.

The @myselft6040 handle swapped into the altered statement was one of the channel’s own sales contacts, listed under Google’s cluster name as a label.

Based on the combined evidence above, the Telegram channel was most likely run separately from the ShinyHunters leak site. The channel advertised its own extortion and sales contacts, while the leak-site faction publicly denied operating on Telegram. The shared XMPP, Tuta, and Session contacts connect the channel to the 2026 pay-or-leak activity. Its use of the leak site’s public download links, however, doesn’t establish that it controlled the site.

Later on June 13, umbreon_sh, who spoke for the leak-site faction, told its audience that an “Indonesian individual” was impersonating ShinyHunters through multiple Telegram accounts and channels. His accusation concerned Telegram impersonation broadly. I can’t establish whether he was responding to the forged statement posted the previous evening.

On July 25, @shsupportsh posted the same “SH Leader,” “SH Office” and “Our actual Official Contact” details, word for word and in the same layout as the June 12 post. On June 9, “ShinyMontana Exploit” had announced that @shsupportsh was no longer part of ShinyHunters, claiming the account had been sold. Six weeks after the channel posted the altered December statement with the copied PGP signature, @shsupportsh was still advertising the channel’s contacts as its own. Advertising contacts you can’t access gains you nothing, so @shsupportsh was most likely working with whoever controlled them. Whether that was the same operator or a partner remains unknown.

Following the Stolen Data

The Nottingham link from June 12 pointed to 176.120.22[.]24, so I followed it. By June 3, eight days before Google named it, the threat actors running the Telegram channel “ShinyMontana Exploit” were already posting links to stolen data stored on that server. Over the next three months, the same server showed up in posts from two SLH-branded Telegram channels and the @shsupportsh account, and in the ShinyHunters leak site’s own listings (Figure 8). All summer, the leak-site faction insisted it had no Telegram channel and that every channel using its name was a scam. However, its listings sent victims to the same data leak server those channels did.

Figure 8: Who posted links to the leak servers, and the evidence tying the posters and the servers together. Sources: Flare (posts), VirusTotal (certificates), Shodan (page title). Supporting source for the Baxter mirrors and matching download token only: Flare: Baxter mirror listing. Stored certificate histories: VT: 91.215.85.103; VT: 91.202.233.104.

The @shsupportsh Account

The account that posted the most links to that server was @shsupportsh, which is the account that “ShinyMontana Exploit” had stated was no longer part of ShinyHunters on June 9. The @shsupportsh handle belongs to Telegram account 8581727007, which previously posted as @whalesgleitsman through April and switched to @shsupportsh in late May. Between late July and late August, @shsupportsh posted more than 70 leak notices linking to 176.120.22[.]24. On August 3, @shsupportsh released what it claimed was Brinks Home data, listed itself as the “Office” contact and signed the post “Scattered Hunters.” Ten days later, it reposted a leak-site notice that said “We do not operate a Telegram channel.” It posted that notice on Telegram.

I compared the 849 posts I collected from @shsupportsh with the posts in the “International Global Network (SLSH)” channel. Of those 849, 779 matched a channel post character for character. Next, I checked the timing. For each of the 779 matching messages, I compared when @shsupportsh posted its copy with when the channel posted its copy. In 315 cases, the two copies went up within 60 seconds of each other. In 252 of those 315, the channel posted first. @shsupportsh posted first in 37, and in the other 26, both copies went up in the same second. The extensive matching content and closely timed posts support my assessment of coordinated publishing. They do not establish whether one operator controlled both accounts.

The Sevy Connection

The contact lists in these posts tied the account to Sevy, the member the Aegis faction accused of informing on Rey. From July into September, posts from @shsupportsh and the SLH-branded channels listed “Shinysevy @shsupportsh” next to “UNC6040 @myselft6040.” @myselft6040 is the sales handle someone swapped into the altered December statement on June 12. Months earlier, the “ShinyMontana Exploit” channel had already announced that Sevy was no longer part of the group. On May 7, the channel announced that someone called HasanBroker had doxed “Sevy ( @barbie ).” 14 minutes later, it posted that Sevy was “now not part of us.” By late August, the SLH-branded channels were posting “we are not affiliated with Sevy” directly above a contact line that still read “Shinysevy @shsupportsh.” The posts show the label. They don’t show whether Sevy ever controlled the account.

The Baxter Download Token

The clearest link between the leak site and the Telegram channels comes from a single victim. Flare first collected the ShinyHunters leak site’s listing for Baxter International on August 18. The listing offers the stolen data on four servers, and every link uses the same download path and token. On August 20, the “International Global Network (SLSH)” channel posted a Baxter download link on 176.120.22[.]24 with the same token and filename. I put the two side by side, and the token matched character for character. Flare refreshed its copy of the listing in October, so I can’t tell which side posted the link first. On its own, the shared download token shows that both sides advertised the same file, not that they controlled the same server.

Unlike many Russian-speaking ransomware gangs, ShinyHunters didn’t negotiate with victims on its leak site. In everything I collected, the posts sent victims to outside contacts such as Session IDs, XMPP, Tuta email and Telegram handles, and the download server only hosted the files. KrebsOnSecurity reported on October 19 that the group also ran a separate extortion site, shinywire[.]com, from about May 3 until October 16, where entries for nearly 100 victims pushed them to discuss payment before their data went to the leak site. That site wasn’t in my collection, and it doesn’t change what the leak site and download servers did. So the Telegram posts sending victims to those download links do not prove the threat actors behind the channels had access to the leak site.

The Backup Servers

Next, I looked at the servers themselves. In an August 13 post leaking Council of Europe data, the “International Global Network (SLSH)” channel pointed to 176.120.22[.]24 as the primary download server and listed two backups, 91.202.233[.]104 and 91.215.85[.]103. The post told readers that “All mirrors have the same files and PATH.” Both backups use the same hosting provider, and each one uses a self-signed certificate named for its own IP address. The backups’ certificate validity periods began close together on three dates. Alongside their advertised mirror relationship and shared configuration, that supports my assessment of common maintenance, but does not establish when the certificates were installed. On September 18, 176.120.22[.]24, which uses a different provider, had a certificate validity start 15 minutes after the first of the pair. Appendix B lists the exact times. In the Shodan records I examined, three servers showed a page titled “// SH”: 91.215.85[.]103, 91.215.85[.]22 and 104.219.238[.]66. The earliest observation I found was July 10 on 91.215.85[.]103. The title match was a lead, not proof that the page was unique or the servers shared an operator. I’m moderately confident that one leak-distribution operation maintained the two backup servers together, and 176.120.22[.]24’s timing fits the same pattern. Shared hosting or a common certificate-generation routine could also explain the repeated timing pattern.

The Telegram channel that posted the altered statement was still most likely run separately from the ShinyHunters leak site. Both advertised links to the same download servers, and the certificate patterns suggest that at least two of those servers were maintained together. What I couldn’t establish was whether the Telegram operators had access to those servers or were reposting public download links. The factions fought over the ShinyHunters name in public while sending victims to the same servers.

Where the Evidence Stops

The first three sections show who posted the stolen data, where they posted it, and which servers hosted it. They don’t show who hacked the victims and stole that data in the first place. The threat actors made that gap harder to see by borrowing the labels defenders use to track their activity.

Google assigns UNC identifiers to separate one intrusion cluster from another. The threat actors in this report used those identifiers to brand themselves. The June 13 post offering stolen Salesforce and Cisco data, which I described earlier, listed “UNC6040 @myselft6040,” and the same post also listed “UNC6395 @myselft6395.” Google tied UNC6395 to the 2025 Salesloft Drift token theft and didn’t attribute that theft to ShinyHunters. From late August, the Telegram account that later posted as Belzebuth6040 promoted a chat room called UNC6040prt2. By October, threat actors posting in one Telegram channel claimed that the FBI ran an account called @unc6040.

The threat actors selling the stolen data put Google’s adversary identifiers in their posts because the threat actors buying it know those identifiers from Google’s public threat reports and connect them to major breaches. A UNC identifier in a post selling stolen data tells you nothing about who carried out the intrusion, and two identifiers in the same post don’t merge the clusters behind them. Attribution should never rest on a threat actor claiming to belong to a tracked cluster. The claim may even be true, but without independent evidence and analysis, treat the connection as unknown.

In Part 1 of this blog series, I said I would come back to UNC6671, because its activity is easy to mistakenly attribute to ShinyHunters. Google tracks UNC6671 as the cluster behind BlackFile, a voice-phishing and extortion operation. BlackFile launched its leak site in February 2026, posted a shutdown notice on May 11, and came back eight days later under a new name, Redact. By August, Google had tied BlackFile, Redact, Pink, Helix and Falcon to UNC6671 and assessed that the cluster operates independently of ShinyHunters. Microsoft’s September 9 report makes the two look closer than they are. Microsoft says an access broker it tracks as Storm-3121 supplied access for both ShinyHunters and Falcon extortion, and that a group it tracks as Storm-3032 split from BlackFile to run Helix. That is one access broker selling to more than one criminal group, which is how this economy works. It isn’t a shared operation. The download servers I examined showed no positive infrastructure linkage to UNC6671, and nothing I collected contradicts Google’s assessment. The evidence I’ve seen doesn’t support treating UNC6671 as part of ShinyHunters.

Table 2 lists each finding in this report, the evidence behind it, how confident I am, and what the finding doesn’t show.

Finding	Evidence	Confidence	What it doesn’t show
My assessment: the leak-site faction was the core ShinyHunters operation during the period covered by this research.	My analysis of the collected activity and human interactions, corroborated by Google’s June and September reporting linking the leak site and UNC6240 to ShinyHunters.	Moderate	That they are the same threat actors who sold data as ShinyHunters in 2020
The Telegram channel that posted the June 12 forged statement ran separately from the leak site	The copied PGP signature failed verification; the channel advertised its own contacts while the leak-site faction denied operating on Telegram	Moderate	Who ran the channel
The matching content and closely timed posts support coordinated publishing between @shsupportsh and the “International Global Network (SLSH)” channel	779 of 849 eligible @shsupportsh posts matched a channel post exactly; 315 pairs were within 60 seconds: the channel posted first in 252, @shsupportsh in 37, with 26 ties	Moderate	Whether one operator controlled both accounts
One leak-distribution operation maintained the two backup servers	Certificate validity start times close together on June 17, July 26 and September 18; the same “// SH” page recorded by Shodan	Moderate	Who runs that operation, or whether it still holds the servers
UNC6671 is separate from ShinyHunters	Google’s assessment; no positive infrastructure linkage to UNC6671 in the download servers examined	Moderate	That the two never buy access from the same broker
UNC identifiers in posts selling stolen data	The June 13 sale, the UNC6040prt2 chat room, the @unc6040 claim	Actor claim, no attribution weight	Who carried out any intrusion
The leak site and the Telegram channels sent victims to the same download servers	Leak-site listings and Telegram posts linking to 176.120.22[.]24; the matching Baxter download token	Observed	That the threat actors behind the channels controlled the servers or the leak site

Table 2: The findings in this report, the evidence behind each, my confidence in each, and what each finding doesn’t show.

What the Arrests Changed

On October 9, FBI Director Kash Patel announced the arrest of “another suspected co-conspirator of the ShinyHunters group.” BleepingComputer and KrebsOnSecurity identified the man as Edward Dubrovsky, a Canadian former executive at the ransomware negotiation firm CYPFER, though the FBI hasn’t confirmed it. Court records list conspiracy and extortion charges filed in the Eastern District of Texas, and the complaint is sealed. If the reporting holds, a man whose job was negotiating with extortionists now faces extortion charges in a case reportedly tied to ShinyHunters. He may not be the only one. KrebsOnSecurity reported on October 19, citing two sources close to the investigation, that the FBI believes at least one executive at a US consulting firm helped operate a ShinyHunters extortion site. No one has been named or charged.

Aegis and the Fight for Control

Inside the brand, the arrests set off a fight for control. On October 10, the “ShinyHunters (SLSH)” channel, the channel Table 1 uses to define the Aegis faction, announced that it was joining ShinyEquationCartel. On October 13, it reposted ShinyEquationCartel’s H&M auction 74 seconds after the original, including the line “@reyswap does NOT possess this database.” Aegis kept posting, but from other channels: “SH Group,” “Other And Other,” “Escanors Marketplace” and “Escanors Files.” On October 14, a post in “Other And Other” titled “STATEMENT FROM AEGIS” said Rey had reportedly been arrested in Jordan and that Aegis would “take responsibility for leading this organization.” The next two posts repeated his Proton address, shinyprocorp[@]proton[.]me.

Who Aegis is depends on the day you ask. The Telegram account @reyswap (8746178180), which now signs Aegis’s posts, wrote “I am the real Rey” on October 9. On October 11 it wrote “not Rey, i’m aegis,” and on October 15, “I’m not Rey, I’m Aegis.”

Aegis’s contacts also turned up somewhere I didn’t expect: the “International Global Network (SLSH)” channel, which I tied to @shsupportsh earlier in this report. That channel now signs its posts with @reyswap, the shinyprocorp[@]proton[.]me address and Session 0501da, which Aegis continued to advertise after Session 05cd1b4d also appeared in ShinyEquationCartel posts. @shsupportsh went silent on October 1. Aegis may have taken over the channel, or the person running it may have switched allegiance to him. The channel could also simply be reposting his contacts.

By October 16, the two sides had publicly cut ties with each other. At 03:34 UTC, the “SH” channel denounced ShinyEquationCartel. About three hours later, ShinyEquationCartel denounced @reyswap. The bounty on Aegis spread the same way the leak notices had, with one account reposting another account’s message within seconds. Belzebuth6040, the account that promoted the UNC6040prt2 chat room, posted the “$11.000 USD for Aegis dead head” offer in a group called “Nullsec Chat” on October 13. On October 14 it posted the offer again at 19:48:57 UTC, one second after ShinyEquationCartel. One repost a second apart isn’t enough to say the same person runs Belzebuth6040 and ShinyEquationCartel.

The Sevy Intelligence Gap

The accusation against Sevy exposed an intelligence gap I can’t close. Since May, criminal channels have tied the Sevy name to the @barbie handle, and on October 6 the Aegis faction identified the channel listing @barbie as Sevy’s. But the account that holds @barbie now, 8448751453, tells a different story.

On October 15, it wrote in a group chat that it bought the handle, saying it had been offered 30k for it and paid 10k. Minutes later it said someone had asked whether it wanted @sevy assigned to it, and that it had “never accepted.” Between October 10 and 15, the same account claimed it was under house arrest, that its bank account had been seized, and that “fbi sent papers to turkey, I answered their questions.” I can’t verify any of it. That leaves an open question: is the person behind @barbie today Sevy, or someone who bought a handle that rivals had already tied to Sevy?

The Aegis faction accused Sevy of informing on Rey, so anyone tracking that accusation needs to know whether they’re watching the right account.

The Affiliate Program and the Server that Stayed Up

Aegis also tried to grow the business. On October 13, the “SH Group” channel posted a “SHINYHUNTERS AFFILIATE PROGRAM — RANSOMWARE-AS-A-SERVICE (RaaS),” offering affiliates 80% of each payment. The next day, a user posting as “ShinyHunters” put the same text on PWSForums, and that evening Aegis’s channels, including “International Global Network (SLSH),” reposted it within about two minutes of each other. The ad reads like it was run through an AI rewriting tool. It says ShinyHunters is “described as operating” a developer-and-affiliate model, and it notes that its own revenue split “has not been independently verified.” Most threat actors at least pretend to believe their own sales pitch! On October 16, ShinyEquationCartel announced a BreachForums revival at breached[.]rs.

Through all of this, Aegis’s channels kept advertising the same download server. On October 14, within about three minutes, the “Escanors Marketplace,” “Escanors Files” and “Other And Other” channels all advertised “6.5 TB – SalesForce 99 Files – ShinyHunters” with a download link to 176.120.22[.]24, signed “I am Aegis as a Journalist … – SH.” When the leak-site tracker ransomware.live checked on October 16, 176.120.22[.]24 still answered, but the other three servers in this report did not. The leak site itself had gone dark weeks earlier. Reuters reported that the ShinyHunters website went offline on September 30, a day after a deadline the group had set for the FBI expired. Two days later, the group told the Dutch outlet BNR that it had moved to a new address because rivals kept attacking the old one. When I checked on October 16, the leak site still didn’t load, and the last victim ransomware.live recorded on it was posted on September 24.

Scammers in the Name

Not everyone posting as ShinyHunters is trying to extort a victim. Some are trying to scam the people around the brand. Earlier I showed @reyswap (8746178180), the account that signs Aegis’s posts, claiming to be Rey one day and Aegis the next. Those conflicting claims do not authenticate @reyswap as Rey, the ShinyHunters figure reported detained in Jordan.

When I pulled the stolen-data claims @reyswap made, I found one I had already seen. On September 30, the International Global Network (SLSH) channel posted “CIA 300gb document military Negotiable price @reyswap.” Earlier in the summer, the same channel posted that exact claim, word for word, with @shsupportsh as the contact. Nothing changed except the handle. ShinyEquationCartel publicly accused @reyswap of falsely claiming possession of H&M data: “User @reyswap does NOT possess this database. Any claims made by them are fake.” See the Flare record of the accusation. The conflicting identity claims, recycled sales wording and public accusation support my assessment that @reyswap was using the ShinyHunters name to scam buyers and victims. Who controlled the account and whether it possessed the advertised data remain unverified. This is truly the bottom of the bucket when it comes to criminals.

Consider this scenario. You are actually breached and your data is stolen and this threat actor says you have to pay him or he will leak the data. He proves authenticity to you by giving you a sample of the stolen data. However, that sample was actually taken from the data by the real attacker. Now you pay the extortion and the real attacker who has your data does not get paid and you either pay them as well or you have your data leaked. That is the risk I associate with @reyswap’s claims. This scenario does not document an actual victim payment.

Recommendations for Security Teams

If you’re tracking anyone using the ShinyHunters name:

• Track infrastructure and account IDs, not names. When a post claims to be ShinyHunters, check the servers, the contact details and the Telegram account ID behind it before you accept the label. A handle tells you which account holds it today, not who held it before.
• Treat labels as leads, not attribution. A brand name, a UNC identifier or a “signed” statement in a cybercrime post is a claim. Verify signatures against the real public key, and don’t merge clusters because a threat actor put two identifiers in the same post.
• Check leak-site status yourself. Trackers can count a site as up when all that answers is a page that redirects to it. Before you report a leak site as live or dead, look at what actually loads.
• Expect the name to outlive this round of arrests. Plan for more threat actors claiming the name, more recycled data, and extortion notes signed “ShinyHunters” by threat actors with no tie to the original operation. Judge each claim on its own evidence.

You can arrest the people behind a brand. You can’t arrest the name. Stop following the name, and follow the infrastructure and TTPs instead.

What This Means

In Part 1 of this series, I found that the arrests disrupted people, not the tradecraft. Part 2 adds a second limit: arrests don’t retire a brand. A well-known criminal name is worth more than any one person behind it, because victims recognize it and the threat actors who buy stolen data trust it. That makes the name worth fighting over, and the fight is where defenders get misled.

The public fight was the least reliable evidence in this story. It played out on Telegram, through accusations, bounties, and leadership statements. The evidence that held up came from somewhere else: backup servers with certificate validity periods that began close together on three separate dates, an account and a channel that posted the same messages within a minute of each other hundreds of times, and a download token that matched character for character. The public posts told me what the threat actors wanted readers to believe. The servers and the posting patterns told me how the operation worked.

Appendix A: Timeline

Date	Event	Source
2025	Leak site and Telegram channels promoted together under the SLH name	Actor channels (Flare)
December 16–17, 2025	Leak-site faction publishes statements calling itself the real ShinyHunters and disowning SLH	Actor statements on shinyhunte[.]rs (Wayback capture, December 18, 2025)
September 15, 2026	Dutch police arrest a 24-year-old for a role in ShinyHunters	Dutch police
September 29, 2026	Rey reported detained in Jordan	Reuters (October 3)
September 30, 2026	ShinyHunters leak site goes offline, a day after a deadline the group set for the FBI expires	Reuters
October 2	Group tells BNR it moved the leak site to a new address after attacks by rivals (group’s claim)	NL Times, citing BNR
October 4	Aegis faction reposts Aegis’s “Grand Founder” statement	“ShinyHunters (SLSH)” channel (Flare)
October 5	Aegis faction drops shinyc0rpsss[@]xmpp[.]jp, sh1nyhunt3rs[@]tuta[.]io, shinycorp[@]onionmail[.]com and shinygroup[@]onionmail[.]com; keeps shinyprocorp[@]proton[.]me and Session 0501da0be27ccac7d4cec7ca1a84e946e3c7dfa9c4da49552b5f32d69980596d7b	“ShinyHunters (SLSH)” channel (Flare)
October 6	100,000 USD demand to H&M; Sevy, tied by the Aegis faction to @barbie, accused of informing on Rey; at 17:44 UTC a sales ad lists the new Session 05cd1b4d112bc03c6512b030de865af03468530566d22c82c48737ac1c9a433421; at 22:05 UTC the Aegis faction reposts Aegis’s contact block, still listing the old Session 0501da0be27ccac7d4cec7ca1a84e946e3c7dfa9c4da49552b5f32d69980596d7b	“ShinyHunters (SLSH)” channel (Flare)
October 8	Former ransomware-negotiation executive arrested on federal charges in a case reportedly tied to ShinyHunters	Reuters, KrebsOnSecurity
October 9	FBI Director Kash Patel announces the arrest of “another suspected co-conspirator of the ShinyHunters group”	CBS News
October 10	ShinyEquationCartel channel opens	ShinyEquationCartel channel (Flare)
October 10	“ShinyHunters (SLSH)” channel announces it is joining ShinyEquationCartel; Aegis keeps posting from “SH Group,” “Other And Other,” “Escanors Marketplace” and “Escanors Files”	“ShinyHunters (SLSH)” channel (Flare)
October 11	ShinyEquationCartel claims an Orange breach, negotiation through Session 05cd1b4d112bc03c6512b030de865af03468530566d22c82c48737ac1c9a433421	ShinyEquationCartel channel (Flare)
October 13	ShinyEquationCartel auctions H&M data; Belzebuth6040 posts a bounty on Aegis in “Nullsec Chat”	ShinyEquationCartel channel (Flare)
October 13	“ShinyHunters (SLSH)” reposts ShinyEquationCartel’s H&M auction (“@reyswap does NOT possess this database”); Aegis’s “SH Group” channel posts a “ShinyHunters affiliate program” offering affiliates 80% of each payment	“ShinyHunters (SLSH)” and “SH Group” channels (Flare)
October 14	“STATEMENT FROM AEGIS” claims leadership after Rey’s reported arrest and repeats the shinyprocorp[@]proton[.]me contact; affiliate program posted on PWSForums and reposted across Aegis’s channels; ShinyEquationCartel offers “$11.000 USD for Aegis dead head,” reposted by Belzebuth6040 one second later; Aegis-signed posts advertise 6.5 TB of Salesforce data on 176.120.22[.]24	Aegis channels, ShinyEquationCartel, “Nullsec Chat” and PWSForums (Flare)
October 15	Account holding @barbie (8448751453) claims it bought the handle and never accepted @sevy (unverified)	Telegram group chat (Flare)
October 16	“SH” channel denounces ShinyEquationCartel; ShinyEquationCartel denounces @reyswap and announces a BreachForums revival at breached[.]rs; leak site still down, 176.120.22[.]24 up, the other three servers down; shinywire[.]com extortion site goes offline (KrebsOnSecurity)	Actor channels (Flare); ransomware.live; author’s check; KrebsOnSecurity

Table A1: From the 2025 rift to the October 2026 split. All breach and victim claims are the actors’ own.

Appendix B: Download servers

Server	Provider	Where it appeared	Certificate validity start (UTC)
176.120.22[.]24	Proton66 (AS198953)	Primary mirror. “ShinyMontana Exploit” from June 3; @shsupportsh, the SLSH channels and leak-site listings from July to September	September 18, 12:19:57
91.202.233[.]104	PROSPERO (AS200593)	Backup mirror in SLSH posts and leak-site listings	June 17, 21:15:41; July 26, 22:48:38; September 18, 12:04:48
91.215.85[.]103	PROSPERO (AS200593)	Backup mirror in SLSH posts and leak-site listings	June 17, 21:27:46; July 26, 22:50:37; September 18, 12:07:39
91.215.85[.]22	PROSPERO (AS200593)	Fourth download link in leak-site listings, including Baxter	August 9, 12:38:02

Table B1: Download servers named in the leak posts, their hosting providers and the start of each certificate’s validity period. Sources: Flare (posts), VirusTotal (certificates).