联邦调查局和执法合作伙伴已经逮捕了“多名”嫌疑人，这是对9月份据称涉及数据盗窃和勒索集团ShinyHunters的黑客行为进行调查的一部分。“联邦调查局继续积极调查最近涉嫌涉及ShinyHunters的网络事件，已经与合作伙伴合作逮捕了多个主题，我们将不遗余力地将每个责任人绳之以法，”FBI发言人周一在一封电子邮件中告诉我们。
The FBI and law enforcement partners have arrested “multiple” suspects as part of an investigation into a September hack allegedly involving data-theft-and-extortion group ShinyHunters, the bureau told The. “The bureau continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects and we will spare no resource in bringing each of the responsible individuals to justice,” an FBI spokesperson told us in an email on Monday.
据路透社报道，美国联邦调查局拒绝就具体逮捕行动发表评论，其中包括涉嫌ShinyHunters成员赛义夫·丁·卡德尔（Saif al-Din Khader），据报道，他已被拘留在约旦。据报道，化名Rey的Khader于9月29日被拘留，据说他正在与联邦调查局合作，以确定该组织的其他成员。ShinyHunters没有回应The有关逮捕以及卡德尔涉嫌参与该犯罪集团的询问。
The FBI declined to comment on the specific arrests, including that of Saif al-Din Khader, a suspected ShinyHunters member who has reportedly been detained in Jordan, according to Reuters. Khader, who goes by the alias Rey, was reportedly brought into custody on September 29, and is said to be cooperating with the FBI to identify other members of the group. ShinyHunters did not respond to The’s inquiries about the arrest and Khader’s alleged involvement with the criminal group.
雷伊去年向安全记者布莱恩·克雷布斯证实了他的真实身份--卡德尔。克雷布斯将卡德尔描述为分散的LAPSUS$ Hunters的“技术运营商和公众代言人”。“雷伊终于被抓了，”安全侦探凯文·博蒙特在被捕消息传出后说道。据博蒙特称，雷伊是“进入捷豹路虎的孩子之一”。2025年8月下旬发生的捷豹路虎（JLR）违规事件影响了该公司的IT系统并停止了制造业务。
Rey confirmed his real identity - Khader - to security journalist Brian Krebs last year. Krebs described Khader as the “technical operator and public face” of Scattered LAPSUS$ Hunters. “Rey got picked up finally,” said security sleuth Kevin Beaumont following news of the arrest. According to Beaumont, Rey was “one of the kids who got into JLR.”The Jaguar Land Rover (JLR) breach, which occurred in late August 2025, affected the company's IT systems and halted manufacturing operations.
经销商系统也出现故障，供应商面临订单被取消或延迟。数字窃贼除了使这家汽车制造商的业务运营瘫痪数月之外，还窃取了数千名捷豹路虎员工的个人工资数据。这次网络攻击是英国历史上损失最大的网络攻击之一，归咎于分散的LAPSUS$ Hunters。
Dealer systems also went down, and suppliers faced canceled or delayed orders. In addition to crippling the carmaker’s business operations for months, the digital thieves stole personal payroll data belonging to thousands of JLR employees. The cyberattack, one of the most costly in UK history, was attributed to Scattered LAPSUS$ Hunters.
卡德尔被拘留两周前，荷兰国家警察逮捕了一名24岁的男子，联邦调查局称他为“ShinyHunters涉嫌领导人之一”。虽然荷兰警方尚未透露嫌疑人的姓名，但克雷布斯和其他报道称，他是佩皮恩·范德斯塔普（Pepijn van der Stap），他于2023年因黑客攻击和勒索众多组织而被定罪，并在入狱三年后被监督释放。Van der Stap还曾在阿姆斯特丹的网络安全初创公司Hadrian担任软件工程师，并自愿担任荷兰漏洞披露研究所（DIVD）的安全研究员。
Khader’s detention came two weeks after the Dutch National Police arrested a 24-year-old whom the FBI described as “one of the alleged leaders of ShinyHunters.”While Dutch cops have not named the suspect, Krebs and other reports say he is Pepijn van der Stap, who was convicted in 2023 for hacking and extorting numerous organizations and was on supervised release after three years in prison. Van der Stap also worked as a software engineer at the Amsterdam-based cybersecurity startup Hadrian and volunteered as a security researcher at the Dutch Institute for Vulnerability Disclosure (DIVD).
在被捕后的视频信息中，联邦调查局网络部门助理局长布雷特·莱瑟曼（Brett Leatherman）向数据盗窃和敲诈勒索团伙的“剩余成员”提出了一些建议。莱瑟曼上周表示：“逮捕可以改变谁愿意说话，而扣押的基础设施可以向我们展示谁还剩下。”“你在这里待的时间越长，我们对你的了解就越多。您知道如何找到我们，我们也知道如何找到您。我建议你在选择权还在你的时候先联系。”
In a video message following the arrest, Brett Leatherman, assistant director of the FBI's Cyber Division, had some advice for the “remaining members” of the data theft and extortion gang. “Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left,” Leatherman said last week. “The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out first while the choice is still yours.”
当时，联邦调查局拒绝回答The有关视频消息的问题，包括是否占领了该网络犯罪组织的任何基础设施，以及ShinyHunters的任何成员是否接受了莱瑟曼的提议“首先联系”。9月下旬，ShinyHunters入侵了FBIJobs.gov门户网站，并声称该网站窃取了有关现任、前任和未来联邦调查局雇员的敏感个人详细信息。一位发言人告诉The，与大多数数字入侵不同的是，这次入侵“不是出于经济动机……我们希望联邦调查局更正或撤回他们的声明，其中包括大量虚假指控。”
At the time, the FBI declined to answer The’s questions about the video message, including whether it had seized any of the cybercrime group’s infrastructure, and whether any of ShinyHunters’ members had taken Leatherman up on his offer to “reach out first.”In late September, ShinyHunters hacked the FBIJobs.gov portal and claimed it stole sensitive personal details about current, former, and prospective FBI employees. A spokesperson told The that unlike most of its digital break-ins, this one was “NOT financially motivated … We want the FBI to correct or retract their statements they made, which included substantial false allegations.”
后来，在一次独家采访中，该发言人告诉我们，这次引人注目的黑客攻击“从根本上来说是我们业务的公关和营销举措”。®
Later, in an exclusive interview, the spokesperson told us the attention-grabbing hack was “fundamentally a public relations and marketing initiative for our business.” ®