Corporate Extortion and the Fall of BreachForums: Tracking ShinyHunters In this episode of "Upwardly Mobile," we dive into the world of high-stakes corporate extortion, focusing on the sophisticated cybercriminal group ShinyHunters (also tracked as UNC6040) and the subsequent takedown of their infamous platform, BreachForums. The sources detail how the FBI, in collaboration with French law enforcement authorities, seized the Breachforums.hn domain, which the Scattered Lapsus$ Hunters (a gang linked to ShinyHunters, Scattered Spider, and Lapsus$) were using as a data leak and extortion site. This action involved switching the domain’s nameservers to ns1.fbi.seized.gov and ns2.fbi.seized.gov. ShinyHunters confirmed the seizure, noting that law enforcement gained access to BreachForums database backups dating back to 2023 and escrow databases since the latest reboot, effectively declaring that "the era of forums is over". Despite the clearnet site takedown, the threat actors maintained that their Tor dark web site was still accessible and that the seizure would not affect their campaign. The Massive Salesforce Extortion Campaign The core focus of the Scattered Lapsus$ Hunters’ recent activity was an extensive Salesforce extortion campaign. This campaign originated in May 2025 when ShinyHunters launched a social engineering campaign using voice phishing to trick targets into connecting a malicious app to their organization’s Salesforce portal. The hackers claimed to have stolen more than one billion records containing customer information. The long list of affected companies included major corporations such as FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, Gap, McDonald's, Walgreens, and Chanel. Salesforce has publicly stated that they will not engage, negotiate with, or pay any extortion demand. Beyond Salesforce: Discord and Red Hat The criminal group also claimed responsibility for other significant intrusions: - https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/: The Scattered Lapsus$ Hunters took credit for compromising a Red Hat GitLab server, stealing more than 28,000 Git code repositories and sensitive internal documents, including customer secrets and infrastructure details. - https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service: ShinyHunters claimed responsibility for an incident affecting Discord users. Discord confirmed that an unauthorized party compromised a third-party customer service provider (5CA), impacting a limited number of users who had contacted Customer Support or Trust & Safety teams. Critically, the unauthorized party gained access to a small number of government-ID images submitted for age verification appeals, as well as usernames, emails, limited billing info, and IP addresses. Tactics and Targets The group employs sophisticated tactics, including exploiting zero-day vulnerabilities, such as a critical flaw in Oracle’s E-Business Suite software (CVE-2025-61882). Furthermore, members of the group have been known to distribute malware—specifically the commercially available ASYNCRAT backdoor—disguised as a Windows screensaver file (.scr) via menacing, targeted emails. This highlights the constant pressure faced by security professionals, often from threat actors derisively called "Advanced Persistent Teenagers" (APTs). Links & Resources - Law Enforcement Takedown: Nameservers used in the FBI seizure: ns1.fbi.seized.gov and ns2.fbi.seized.gov. - Publications Cited: https://www.bleepingcomputer.com/news/security/fbi-takes-down-breachforums-portal-used-for-salesforce-extortion/. - Discord Security Incident: Discord confirmed they would contact impacted users via [email protected]. - Security Validation: Join the Picus BAS Summit to experience the future of security validation. - ASYNCRAT Analysis: Virustotal analysis on the ASYNCRAT malware provided via link. 🛡️ Sponsor: https://approov.io/ To ensure your mobile and web applications are secure against sophisticated attacks, trust the experts. Learn more about enhanced security measures and API protection at approov.io. Keywords ShinyHunters, BreachForums, Salesforce Extortion, FBI Takedown, Scattered Lapsus$ Hunters, Data Breach, Red Hat, Discord Hack, Voice Phishing, Cybercrime, Hacking Forum, ASYNCRAT, UNC6040, CVE-2025-61882, Security Validation. Relevant 

Mannen som antas å ha styrt et av verdens største russiskspråklige cyberkriminalitetsforum skal ha tjent millioner på å tilrettelegge for hackere.

Gut geplant: FBI und Europol haben die mutmaßlichen Betreiber von BreachForums verhaftet. Die USA hat einen Auslieferungsantrag gestellt. Der Artikel <a href="https://tarnkappe.info/artikel/szene/dark-commerce/breachforums-bust-vier-festnahmen-ein-auslieferungsantrag-317153.html">BreachForums-Bust: Vier Festnahmen, ein Auslieferungsantrag</a> erschien zuerst auf <a href="https://tarnkappe.info">TARNKAPPE.INFO</a>

Brack.ch prüft derzeit, ob der Online-Händler Opfer eines Datenabzugs geworden ist. Die Kunden wurden per E-Mail aufgefordert, ihre Passwörter zu ändern.

CrowdStrike hat Behauptungen über einen Datenleck zurückgewiesen. Ein Hacker namens "Rey" hatte am 27. Februar dies behauptet.

Telefónica ist Ziel eines Cyberangriffs geworden. Die Angreifer wollen 2,3 GByte an Daten erbeutet haben - darunter angeblich auch Kundendaten.

In einem Hackerforum werden Daten von Temenos Quantum Fabric angeboten. Das Unternehmen sagt, es untersuche einen Cybersicherheitsvorfall.

Almost 2.7 billion records of personal information for people in the United States were leaked on a hacking forum, exposing names, social security numbers, all known physical addresses, and possible a...

Angeblich geklaute Daten des Chipherstellers werden auf einem Hackerforum zum Verkauf angeboten. AMD untersucht, ob an den Behauptungen was dran ist.

Tactics include “tricking” the AI into believing it is in “development mode” or roleplaying.

[English]Bezüglich des AnyDesk-Hacks werde ich aktuell von der Realität ständig rechts überholt - habe ich in AnyDesk-Hack Undercover – Verdachtsfälle und mehr  – Teil 3 noch vorsichtig "noc...