# ShinyHunters Post-Arrest Brand Fight: Rival Factions, Shared Extortion Infrastructure and Impersonation (SLSH / Aegis / ShinyEquationCartel)

> After arrests in September-October 2026, rival factions (leak-site faction, Aegis, ShinyEquationCartel) are competing for the ShinyHunters brand, reusing the same download servers, forging PGP signatures and recycling unverified victim claims. Aegis announced an Extortion-as-a-Service affiliate program with an unverified 80% revenue split on Oct 13-14, 2026.

- **Published:** 2026-11-04T16:07:07Z
- **Last reviewed:** 2026-11-04T16:07:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5249
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5249.png
- **ID:** TL-2026-5249
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

Following the Dutch police arrest of a 24-year-old on Sep 15, 2026, the detention of 'Rey' in Jordan on Sep 29 (Reuters later reported FBI cooperation) and the arrest of former CYPFER executive Edward Dubrovsky on federal extortion charges (reported Oct 8-9; FBI Director Kash Patel announced the arrest of 'another suspected co-conspirator'), the ShinyHunters leak site went offline on Sep 30 and several actors began claiming the brand. Jon DiMaggio (Arkem Cyber, published via Flare on 2026-11-04) assesses with moderate confidence that three factions now exist: the original leak-site faction, the 'Aegis' faction (which ran the 'ShinyHunters (SLSH)' Telegram channel and claimed 'Grand Founder' status after Rey's detention, though forum peers dismissed the persona as a 'larp'), and 'ShinyEquationCartel' (channel opened Oct 10, claiming ex-members of ShinyHunters, LAPSUS$, HellCat and LockBit).

Infrastructure analysis shows the factions reuse the same download servers: 176.120.22.24 (Proton66, AS198953, certificate validity starting Sep 18 12:19:57 UTC) and 91.202.233.104, 91.215.85.103 and 91.215.85.22 (PROSPERO, AS200593). The three backup servers share certificate start dates (Jun 17, Jul 26, Sep 18) and a '// SH' page title, with the earliest sighting on 91.215.85.103 (Jul 10). The same download token for Baxter International appeared across platforms. The @shsupportsh Telegram account (ID 8581727007) posted 779 of 849 messages matching the 'International Global Network (SLSH)' channel exactly, with 315 message pairs inside 60 seconds, supporting coordinated publishing (moderate confidence). The Aegis faction on Oct 5 pruned its contact list (dropping XMPP, Tuta and OnionMail addresses, retaining shinyprocorp@proton.me) and uses Session IDs.

Impersonation and deception tradecraft includes a Jun 12 extortion post that carried a forged copy of a December 2025 BreachForums admin PGP signature whose verification fails on altered text (original fingerprint E80C1308A09EC1ADC418C3F02578988F69BCA3FC), contact handles swapped from @wokawoka10 to @myselft6040, recycled postings (CIA '300GB documents', Sep 30) and a recycled H&M claim: Aegis demanded $100,000 on Oct 6, ShinyEquationCartel auctioned the same data on Oct 13 saying '@reyswap does NOT possess this database', and an Oct 12 investigation found no evidence of compromise. Other claims (University of Nottingham, Council of Europe, Brinks Home, Baxter International, Orange, Salesforce and Cisco at a $250,000 ask) are unverified per the source. On Oct 13-14 Aegis posted a 'SHINYHUNTERS AFFILIATE PROGRAM - RANSOMWARE-AS-A-SERVICE' offering affiliates 80% of revenue (unverified); the source frames this as an extortion-as-a-service model. KrebsOnSecurity reported the extortion site shinywire.com operated roughly May 3 to Oct 16, 2026, and a BreachForums revival at breached.rs was announced Oct 16.

Attribution caveats: Google tracks the ShinyHunters leak site as UNC6240. UNC6395 (Salesloft Drift token theft) and UNC6040 identifiers are being co-opted by personas (@myselft6395, @myselft6040) and are not valid attribution for these factions. UNC6671 (BlackFile/Redact extortion) is assessed as separate from ShinyHunters. Press reporting (The Hacker News) attributes to the broader brand 140+ breaches and about $70 million in extortion payments; these are not verified for any individual current faction. No CVE or CVSS applies.

## MITRE ATT&CK

- T1583.004 Server
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1684.001 Impersonation
- T1190 Exploit Public-Facing Application
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ShinyHunters Factions Shared Download Servers — Firewall Contact (Proton66/PROSPERO)** (`TL-2026-5249-SPL-001`)

TL-2026-5249: detects firewall sessions to the four download servers reused by the rival ShinyHunters factions (176.120.22.24 on Proton66 AS198953; 91.202.233.104, 91.215.85.103 and 91.215.85.22 on PROSPERO AS200593). These host the victim-data download links used as proof in extortion posts, so inbound-heavy sessions suggest staff retrieving extortion proof or a host fetching or staging stolen data. Summarises volume per source and destination.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.004, T1657
- **Data sources:** firewall:pan:traffic, network_traffic
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=firewall sourcetype="pan:traffic" earliest=-24h
dest_ip IN ("176.120.22.24", "91.202.233.104", "91.215.85.103", "91.215.85.22")
| stats count AS sessions sum(bytes_out) AS bytes_out sum(bytes_in) AS bytes_in values(dest_port) AS dest_ports values(action) AS actions min(_time) AS first_seen max(_time) AS last_seen BY src_ip dest_ip
| eval mb_in=round(bytes_in/1048576,2), mb_out=round(bytes_out/1048576,2)
| convert ctime(first_seen) ctime(last_seen)
| sort - bytes_in
```

### Microsoft KQL

```kql
let IocIps = dynamic(["176.120.22.24", "91.202.233.104", "91.215.85.103", "91.215.85.22"]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in (IocIps)
| summarize Sessions=count(), BytesIn=sum(ReceivedBytes), BytesOut=sum(SentBytes), Ports=make_set(DestinationPort), Actions=make_set(DeviceAction), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DeviceVendor
| order by BytesIn desc
```

### Sigma

```yaml
title: ShinyHunters Factions Shared Download Server Contact - Firewall
id: 5b1e7c3a-2a4d-4f6e-9a10-5249a0000001
status: experimental
description: Detects network sessions to download servers reused by rival ShinyHunters factions (Proton66 AS198953 and PROSPERO AS200593 hosts).
references:
    - https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight
    - https://intel.threadlinqs.com/TL-2026-5249
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.resource_development
    - attack.t1583.004
    - attack.impact
    - attack.t1657
logsource:
    category: firewall
detection:
    selection:
        dst_ip:
            - '176.120.22.24'
            - '91.202.233.104'
            - '91.215.85.103'
            - '91.215.85.22'
    condition: selection
falsepositives:
    - Threat-intel analysts deliberately browsing extortion proof links from a sandbox
    - Security scanners or CTI crawlers probing the hosts
level: high

```

**Known false positives:**

- Authorised CTI/DFIR sandbox hosts visiting the servers to validate an extortion claim
- Internet-wide scanners or threat-intel crawlers logged against the same IPs

**Tuning notes:** Swap index/sourcetype for your firewall (e.g. cisco:asa, fgt_traffic). Exclude CTI sandbox subnets. Raise priority when bytes_in is large or the source is a server. Add new IPs from sibling servers sharing the '// SH' page title or the Jun 17/Jul 26/Sep 18 certificate start dates.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ShinyHunters Download Servers — Web-Server Process Egress After Public-Facing App Compromise (locked: unlock with TL Creds)
- ShinyHunters Aegis Extortion Contact — Outbound Email To Known Contact Addresses (locked: unlock with TL Creds)
- ShinyHunters Community-Observed Sibling Domains — DNS and Network Contact (locked: unlock with TL Creds)
- ShinyHunters Download Servers — Endpoint Network Connection To Shared Infrastructure (locked: unlock with TL Creds)
- ShinyHunters Faction Telegram Contact Accounts — Proxy Access To [indicator] and [indicator] (locked: unlock with TL Creds)
- Fake AEGIS VPN Phishing Domain vpnaegis2.site — Proxy and Email URL Contact (locked: unlock with TL Creds)
- ShinyHunters Aegis Extortion Contact — Inbound Email From Known Contact Addresses (locked: unlock with TL Creds)
- ShinyHunters Extortion Infrastructure — DNS Lookups for [indicator] and [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `176.120.22[.]24`
- Domain: `shinywire[.]com`
- File hash: `E80C1308A09EC1ADC418C3F02578988F69BCA3FC`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Aftermath of the September ShinyHunters Arrests: Battle Over the Brand Name (Jon DiMaggio, Arkem Cyber, via Flare)](https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight)
- [ShinyHunters suspect Rey reportedly cooperating with FBI (The Hacker News)](https://thehackernews.com/2026/10/shinyhunters-suspect-rey-reportedly.html)
- [Cyber exec arrested in case allegedly tied to ShinyHunters hackers (BleepingComputer)](https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/)
- [FBI arrests another suspected ShinyHunters hacker after agency breach (BleepingComputer)](https://bleepingcomputer.com/news/security/fbi-arrests-another-suspected-shinyhunters-hacker-after-agency-breach)
- [FBI says ShinyHunters leader arrested after 140 breaches and $70mn extortion (Beinsure)](https://beinsure.com/news/fbi-says-shinyhunters-leader-arrested-after-140-breaches-and-70mn-extortion/)
- [Dutch police arrest a suspect in the ShinyHunters investigation as the group's attacks escalate](https://startwithidentity.com/blog/2026-09-28-dutch-police-arrest-suspect-in-shinyhunters-investigation.md)
- [FBI Confirms Multiple Arrests in ShinyHunters Investigation (Hackread)](https://hackread.com/fbi-confirms-arrests-shinyhunters-investigation/)
- [ShinyHunters defiant after FBI calls on members to come forward (SecurityWeek)](https://www.securityweek.com/shinyhunters-defiant-after-fbi-calls-on-members-to-come-forward/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5249