Since then, at least one leader of the rival factions claiming the brand, Saif Al-Din Khader, also known as “Rey,” has been arrested. Together, these developments have caused a degree of chaos and a surge in impersonators claiming to represent the well-known cybercrime group. These criminals claim to have breached companies and demand ransom payments to delete data, even though they have not actually compromised their targets. Rival groups also accuse each other of being impostors. [2]
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
The cyber extortion scene has always attracted scavengers who attempt to extort money without conducting any breaches. In January 2026, a fake ransomware group calling itself “0apt” posted more than 70 alleged breaches on its data leak site. Upon closer inspection, all these claimed breaches appeared to be fake. Other scavenger groups buy or collect data stolen in previous breaches and try to reuse it in further extortion attempts.
Assessment
Some of the more proficient cybercrime groups have moved from ransomware and double extortion to data-leak-only extortion. This creates opportunities for scavenger groups to claim that they have breached organizations without having done so, hoping that victims will pay without demanding proof of a breach.
The English-language cybercrime ecosystem known as “Hacker Com” has always been far more fluid and disorganized than the Russian cybercrime community. Arrests of key figures have historically disrupted groups, but powerful brands are often resurrected. One of the few ways to verify that someone was genuinely linked to a particular brand, such as ShinyHunters, was through the private PGP key used by the group.
All claimed cyber breaches should be verified, especially if the victim has experienced previous breaches and the threat actor may simply be reposting older data stolen during an earlier incident.
References
[1] https://databreaches.net/2025/08/21/cleanup-in-aisle-4-telegram-is-a-mess-of-fake-shinyhunters-channels/
[2] https://arkemcyber.com/research/who-gets-to-be-shinyhunters/
The post Group Claiming to be ShinyHunters Posts Fake Breaches appeared first on Truesec.
Article Link: Group Claiming to be ShinyHunters Posts Fake Breaches - Truesec