FBI's Hackers Are Getting Arrested

Two members of ShinyHunters — the cybercriminal group behind breaches at Ticketmaster, AT&T, and, notably, the FBI itself — have been arrested within a week of each other, according to The Record.

Saif al-Din Khader, identified by security journalist Brian Krebs last November as a key figure in the group, was detained in Jordan on September 28. He is 16 years old. Separately, Dutch national Pepijn van der Stap — himself a convicted hacker who had only recently completed a previous prison sentence — was arrested by the FBI and Dutch National Police on September 29.

Khader is reportedly cooperating with law enforcement and helping identify other ShinyHunters members. His arrest follows the takedown of the group's leak site, though the group promptly reappeared on Telegram claiming to restart a defunct criminal forum.

The FBI breach at the centre of this investigation was significant. Attackers obtained names, home addresses, phone numbers, Social Security numbers, and email addresses for nearly every FBI agent, along with records for thousands of local police officers working on joint task forces.

ShinyHunters has publicly stated it will not release the FBI data, describing the breach as a response to an advisory they disagreed with. Whether that holds is another matter.

What you should do: If you are a law enforcement employee or have worked with federal agencies in any capacity, assume your contact details may be in circulation. Enable call-screening on your phone, freeze your credit with all three major bureaus, and be especially cautious of unsolicited contact from anyone claiming to know your personal details.

A China-aligned threat group called TA419 ran a targeted campaign in July impersonating US government officials to steal credentials from AI policy researchers at think tanks, universities, and law firms, according to Dark Reading.

The approach skips straight to a phishing link only after building apparent legitimacy first. Targets received emails from people who appeared to be real, credible contacts — including someone posing as a former White House science policy official — inviting them to join fictitious advisory committees. Once a reply came, a follow-up link led to a fake Microsoft OneDrive page using an adversary-in-the-middle (AiTM) attack (where attackers sit between the victim and a real login page, intercepting credentials in real time).

Proofpoint, who identified the campaign, notes TA419 has been running similar operations against US and Japan-based targets since at least April 2025, with an earlier February operation impersonating an Anthropic employee against a US think tank.

What you should do: If you work in policy, research, or government-adjacent roles, verify any unexpected professional invitation by contacting the supposed sender through a known, independent channel before clicking anything.

What Rejetto HFS is: A lightweight, open-source file server that lets users share files over a network through a simple web interface.

What it is: A critical flaw in how Rejetto HFS generates and signs session cookies allows an unauthenticated attacker to forge administrator credentials and execute arbitrary code on the server.

Who's at risk: Anyone running Rejetto HFS version 3.2.0 or earlier, whether on a home network or exposed to the internet. VulnCheck observed active exploitation attempts — originating from a China Telecom IP address — hitting targets in Japan and the US as of October 2.

CVSS: 9.3 (Critical — patch today.)

Root cause: The server uses JavaScript's built-in Math.random() function — which relies on an algorithm called xorshift128+ — to generate session cookies and derive the key used to sign them. This algorithm's outputs are mathematically reversible: collect enough values and you can reconstruct the internal state and recover the signing key. Think of it like a combination lock where watching someone open it a few times lets you deduce the code.

Attack vector: An unauthenticated attacker sends a series of login requests to the server, collecting the random values returned in each response. Using those values, they reverse the algorithm to recover the signing key. They then forge a valid administrator session cookie and use it to access the server_code configuration feature, which allows remote code execution (RCE — running arbitrary commands on the target machine).

Detection strategies: Look for repeated unauthenticated login requests to your HFS instance in quick succession; unexpected changes to server configuration settings; and outbound connections from the HFS process to unfamiliar external addresses.

Recommended actions:

1. Upgrade to Rejetto HFS version 3.2.1 immediately — it is available from the official Rejetto repository.
2. If you cannot patch immediately, restrict access to the HFS interface to trusted IP addresses only.
3. Review server logs for signs of unusual login attempts or configuration changes.

Researchers at FortiGuard Labs have identified a Linux backdoor called ClingSTUN that targets home routers and network devices from brands including D-Link, TP-Link, Tenda, Ivanti, and others, turning infected devices into hidden proxies for attackers, according to SecurityWeek.

The malware spreads by exploiting known, unpatched vulnerabilities — meaning most infections are preventable.

What you should do: Log in to your home router's admin panel (usually found at 192.168.1.1 or 192.168.0.1 in your browser) and check for a firmware update. If your router model is no longer receiving updates from the manufacturer, consider replacing it. Routers are not set-and-forget devices. If yours is more than five years old and the manufacturer has stopped supporting it, it is effectively an open door.

The US Senate has unanimously passed the Health Care Cybersecurity and Resilience Act, which now moves to the House of Representatives, according to SecurityWeek. The bill would fund cybersecurity improvements across healthcare providers, boost support for rural clinics, and formalise coordination between the Department of Health and Human Services and CISA. Last year, over 730 breaches affected more than 270 million Americans. For patients, a stronger legal floor on healthcare cybersecurity means your medical records face at least some mandated protection — not just best-effort goodwill.