1. Executive summary
ShinyHunters (MITRE G1057) defaced the FBI's jobs portal, FBIjobs.gov, on Tuesday 22 September, replacing agency images with a Pokemon photograph, and posted a statement on its leak site threatening to publish data on every FBI agent and job applicant unless the FBI withdrew a May 2026 public service announcement about the group. The FBI confirmed it is investigating unauthorised activity affecting the site, and the special agent application portal was still showing an unavailable banner the following morning. ShinyHunters supplied samples of 5,000 records it says are FBI agent data to 404media and other outlets, which the source says confirmed the samples are legitimate; the FBI has not confirmed the data theft. No CVE, exploited component, malware or initial access vector is identified in the source material, so there is no CVSS score or CISA KEV entry to apply to this item. Direct technical exposure for EMEA financial services clients is limited and conditional, but the incident is a current indicator of G1057's operational tempo against large employers and its use of data-theft extortion.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The incident occurred on a US federal agency's recruitment platform, no EMEA client ICT third-party provider is named, and no client-side incident is described, so no article in the regulatory reference meets the test of a trigger distinctive to this item that changes what a client must do. The position would change only if a client's own ICT third-party provider or recruitment platform is later named in the actor's victim list or in the published dataset, at which point the third-party provisions in the reference (DORA Art. 28, Art. 29, Art. 30) would apply.
3. Technical analysis & attack chain
Confirmed sequence of events:
- ShinyHunters obtained enough access to FBIjobs.gov to modify content served by the site. The source does not state how that access was obtained, and no exploited component or vulnerability is named.
- On Tuesday 22 September the group replaced agency images on FBIjobs.gov with a photograph of a Pokemon it uses as a mascot. This is a defacement: the site remained reachable, and the source describes no destructive or availability impact beyond the portal being taken offline by the FBI.
- The group published a statement on its leak site criticising a May 2026 FBI public service announcement about ShinyHunters, and threatened to release information on every FBI agent and anyone who has applied for a job at the FBI unless the notice was withdrawn.
- ShinyHunters provided samples of 5,000 records it says are FBI agent data to 404media and several other news outlets. According to the source, those outlets confirmed the samples are legitimate.
- The FBI confirmed it is investigating unauthorised activity affecting FBIjobs.gov. As of Wednesday morning the special agent application portal carried a banner stating it was unavailable.
What the source does not establish matters as much as what it does. There is no stated initial access vector, no exploited CVE, no affected product or version, no malware, no persistence mechanism, no command-and-control, no lateral movement and no exfiltration path. The source does not say whether the defacement and the claimed data theft used the same access, whether the 5,000 records came from FBIjobs.gov at all, or which data fields the records contain. Any attack chain beyond the five steps above would be inference, not reporting.
The actor's recent history is the useful context. The May 2026 FBI notice followed a ShinyHunters attack on educational software vendor Instructure, which the source says disrupted operations at thousands of universities and K-12 schools across the US and led the company to pay a ransom to restore its services. The source lists Ticketmaster, AT&T, McGraw Hill, Carnival Cruise Line and 7-Eleven among earlier victims. Brett Leatherman, assistant director of the FBI's Cyber Division, said at a roundtable two weeks ago that the Bureau is focused on ShinyHunters because of its role in data exfiltration and extortion attacks.
Confidence caveats. This item rests on a single outlet, The Record, with the FBI confirming only that it is investigating. The data theft is ShinyHunters' claim, partially corroborated by journalists who verified sample records; the FBI has not confirmed it. The 5,000-record figure is the group's own. The group's denials that it conducts swatting, sextortion or is part of The Com are self-serving statements published on its own leak site and are not independently verified. The claim that Instructure paid a ransom is reported by the source and not confirmed by the company in the material provided. Treat the whole item as single-sourced; verify before acting on any specific claim.
4. Mitigation & containment
P1 (within 24 hours)
- If any staff, contractors or their family members submitted applications or personal data through FBIjobs.gov, treat that data as potentially exposed and warn them about phishing and social engineering that references their application. The source does not state which data fields were taken, so do not assume credentials were or were not included; if credential material is later confirmed, force resets for the affected accounts.
- Check public-facing careers and recruitment sites for unauthorised content changes. Compare the web root against a known-good baseline, review CMS admin account activity and recent publish events, and confirm file integrity monitoring covers image and static asset directories. Content replacement on a public site is the TTP observed here.
- Confirm no client domain or brand appears in ShinyHunters leak-site postings. If one does, escalate to incident response immediately rather than waiting for the actor to publish.
P2 (within 72 hours)
- Review third-party exposure. If any recruitment platform, HR SaaS provider or web hosting provider in your estate is named in the actor's victim list, invoke the security and incident notification clauses in the contract (DORA Art. 30 covers key contractual provisions with ICT third-party providers) and request written confirmation of scope.
- Prepare for data-theft extortion rather than ransomware. The actor's pattern is to publish or sell stolen data. Confirm that out-of-band contact routes for extortion attempts exist, and that legal, communications and regulatory notification runbooks do not depend on the actor's cooperation or on a decryption key.
P3 (within 7 days)
- Add G1057 to the threat model and confirm that public web assets have integrity monitoring with alerting on content change, not just availability monitoring.
- Tabletop the leak-site scenario: who decides on payment, on notification, and on any public statement, and on what evidence.
- No vendor patch applies to this item. No CVE or affected product is identified, so there is nothing to patch on the basis of this report.
5. Indicators of compromise
No indicators of compromise available in the source material. The source contains no hashes, domains, IP addresses, file paths, registry keys or filenames.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Unauthorised replacement of images or static content on a public web property | web server file integrity logs, CMS audit trail, CDN origin change logs | medium (observed in this incident) |
| Publication of victim data or threats on a ShinyHunters leak site | leak-site and dark web monitoring | medium |
| Direct threat to publish data unless a public statement is withdrawn | leak-site posts, inbound email to press or security contacts | low (single-sourced, actor's own claim) |
6. Detection
Insufficient indicators to author detection rules.
Threat actor context
ShinyHunters · G1057 · aka UNC6240, Bling Libra
ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …
7. Sources
- Jonathan Greig, Recorded Future News (The Record), "FBI investigating alleged ShinyHunters breach of its jobs site", https://therecord.media/fbi-investigating-alleged-shinyhunters-job-site-breach, 2026-09-23.
8. Adverse Trace position
Adverse Trace assesses direct technical risk to EMEA financial services clients from this item as limited and conditional. There is no CVE, no CVSS score and no CISA KEV entry to apply, because no vulnerability is identified; the exposure that exists is reputational and third-party, and it materialises only if a client's staff applied through FBIjobs.gov or if a client appears in the actor's published data. The item is single-sourced, and the data theft remains the actor's claim rather than a confirmed fact, so we are not raising a sector alert on the strength of it. We will track G1057 activity, monitor for publication of the claimed dataset and for any EMEA financial sector victim appearing in ShinyHunters leak-site postings, and re-issue this advisory if the FBI confirms the scope of the breach or if the published data names financial institutions or their ICT providers.
Published via PulseTrace — Adverse Trace threat intelligence.