UmbreonMalware
- espeon
A Linux rootkit that provides backdoor access and hides from defenders.From MITRE ATT&CK
Last reported 13 days ago, by AhnLab ASEC12 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1684Social Engineering
“The group's methods moved from credential theft against platforms like Snowflake toward a focus on social engineering like with Salesforce.”
- T1014Rootkit
“SIXZUT and JITTERLY: Newly launched security firm VirLabs looks at SIXZUT and JITTERLY, a Linux implant and a rootkit that are being planted by the Red Heron group on Gitea servers.”
- T1110.004Credential Stuffing
“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”
- T1176.001Browser Extensions
“Malicious browser extensions: Security researchers have discovered a cluster of more than 30 malicious Chrome extensions posing as financial advice tools.”
- T1195Supply Chain Compromise
“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
12 reports, newest first · the exact sentence from each-
September 2026 Dark Web Threat Actor Trend Report“…i-Arabia seizure Sentencing ShinyHunters source-code-leak supply-chain-attack T1ER0NE Taiwan TakeDown Telecommunications transportation Umbreon United-States Virut VPN-vulnerability ZeroBytes”
-
ShinyHunters Extorted Boeing Spin-off Prior to Arrests“…d to his longtime account on Twitter/X, while simultaneously including images of the avatar used by Van Der Stap’s former hacker alias “Umbreon” in an apparent attempt to frame the Dutchman for both hacks.”
-
Alleged ShinyHunters Leader Arrested in Jordan“Khader apparently pinned the recent FBI hack on van der Stap by placing a defacement image featuring the Pokémon character Umbreon.”
-
ShinyHunters Suspect Detained in Jordan Helps FBI Track Down the Group“Multiple sources, including KrebsOnSecurity, have identified him as Pepijn van der Stap, a Dutch hacker previously known online as “Umbreon.””
-
Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia“Dutch police detained Pepijn Van der Stap, a 24-year-old hacker who went on hacking forums as Umbreon.”
-
Shocker: suspected ShinyHunters member charged with attempted incitement to commit two murders“Anyone following the recent arrest of Pepijn van der Stap, the previously convicted hacker known as “Umbreon,” was likely shocked today when the prosecution announced that he was being charged with two counts of attempted incitement to murder.”
-
Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation“Investigative journalist Brian Krebs reports that prior to his conviction, van der Stap used the online hacker handle Umbreon in his extortion activities while working as a software engineer at cybersecurity startup Hadrian.”
-
Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation“…ional details, independent security journalist Brian Krebs and DataBreaches.Net identified the arrested man as Pepijn van der Stap (aka Umbreon), who was previously apprehended in 2023 for his role in a series of data thefts and extortions.”
-
24-Year-Old Arrested in Dutch Investigation Into ShinyHunters“Multiple sources, including KrebsOnSecurity, have identified him as Pepijn van der Stap, a Dutch hacker previously known online as “Umbreon.””
-
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation“Hyde existence, secretly using the hacker handle “Umbreon” to extort victims and post their data on English language hacking communities like the now-defunct RaidForums and Breached.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“…rs" are dedicated gamers whose purpose is to find rare color variant ("shiny") Pokémon, like their early forum avatar which was a shiny Umbreon.”
-
ShinyHunters Claims Access to FBI Systems“The following day, apply.fbijobs.gov was defaced with ShinyHunters’ familiar “seized” banner and Umbreon artwork before the page was taken down and later restored.”
Indicators in its reports
named in the reports above- fbijobs[.]govin 4 reports
- apply.fbijobs[.]govin 3 reports
- security[.]orgin 1 report
- azurenetfiles[.]netin 1 report
- 142.11.200[.]186in 1 report
- politie[.]nlin 1 report
- kevinhardiman.bsky[.]socialin 1 report
- kevincollier.bsky[.]socialin 1 report
- secure[.]comin 1 report
- promo[.]comin 1 report
- raidforums[.]comin 1 report
- rf[.]wsin 1 report
- raid[.]lolin 1 report
- breachforums[.]stin 1 report
- breachforums[.]hnin 1 report
- task[.]namein 1 report
- fa210f015399de16…94972a3bdc43in 1 report
- d5efdf6f35e9c6ed…3d591b94e384in 1 report
- a4e525d8825c1bac…799e07e207e4in 1 report
- classaction[.]orgin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.