After the ShinyHunters arrests, rival factions are denouncing each…

Hello! I'm Jon and I am a cyberaholic... and the author of this research (written for Flare)! I wanted to share my recent research. Thanks!

Summary/overview:

After the September arrests, at least three groups started claiming to be the "real" ShinyHunters: the leak site operators, the Aegis faction on Telegram, and ShinyEquationCartel. They publicly denounce each other, but the leak site and the rival channels were sending victims to the same download server.

You can seize a panel, but you can't revoke a name. H&M ended up with two factions claiming the same stolen data and no way to tell who actually had it.

What this means for anyone tracking these groups:

- A Telegram handle can be bought, hijacked or shared, so a handle alone doesn't identify anyone

- A shared Session ID shows where replies went, not who wrote the posts

- Names, UNC labels and copied signatures are claims, not attribution. Infrastructure and account IDs hold up better

How are others tracking these brands since the arrests?

https://flare.io/learn/resources/blog/shinyhunters-arrests-brand-name-fight

Impact

Victims of ShinyHunters data theft face confusion due to multiple factions claiming ownership of the same stolen data, potentially complicating incident response and remediation. The persistence of the brand despite arrests indicates ongoing risk of data leaks and extortion under the ShinyHunters name. The use of shared download infrastructure by rival factions may facilitate continued data exposure. Attribution challenges hinder law enforcement and security teams' ability to accurately track and respond to threat actor activity.

Defensive guidance

There is no direct patch or fix as this is a threat actor brand fragmentation issue rather than a software vulnerability. Security teams should be cautious in attributing activity solely based on Telegram handles or posted signatures. Instead, rely on infrastructure indicators, account IDs, and verified signatures for attribution. Organizations should monitor for data leaks associated with ShinyHunters and related factions and respond to incidents accordingly. No urgent remediation is indicated beyond standard incident response to data breaches.

Summary

The September 2026 arrests of ShinyHunters affiliates did not end the group's operations but instead led to fragmentation into at least three factions: the original leak-site faction, the Aegis faction on Telegram, and the ShinyEquationCartel. These factions publicly dispute each other's legitimacy while directing victims to the same download server (IP 176.120.22.24) to retrieve stolen data. The research shows that Telegram handles can be hijacked or shared, making attribution based on names or signatures unreliable. Instead, verified signatures, server maintenance patterns, and account IDs offer stronger attribution evidence. The ShinyHunters brand remains active and contested, complicating victim remediation and threat tracking.

After the ShinyHunters arrests, rival factions are denouncing each other on Telegram while sending victims to the same download server

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 13 Nov 2026, 01:38 UTC

Technical details

References

Community reviews

Related threats