There have been several important updates to this story:

RTL in the Netherlands reports that investigators believe Van Der Stap tried to orchestrate at least two murders.

https://www.rtl.nl/nieuws/binnenland/artikel/5656154/pepijn-van-der-s-verdacht-van-opdracht-geven-moorden?referrer=https%3A%2F%2Finfosec.exchange%2F

The FBI's cyber division has posted a video and transcript of the FBI discussing the ShinyHunters investigation. The FBI said ShinyHunters has stolen at least $70 million. The video includes a direct message to the remaining members of ShinyHunters.

"Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left. The longer you stay in this, the more we learn about you. You know how to find us, and we know how to find you. I suggest you reach out to us while the choice is still yours."

https://x.com/FBICyberDiv/status/2104923994801553646?s=46

Yesterday's scoop on the arrest of an alleged ShinyHunters member in the Netherlands got picked up as part of a piece on the FBI hack that was the top story last night on the NYT homepage. Got a nice mention and link. There is so much more to this story. More to come soon, hopefully.

https://www.nytimes.com/2026/09/28/us/politics/fbi-shinyhunters-damage.html

RE: https://techhub.social/@Techmeme/117353706002267129

They know this language is C level exec porn. $$$$$$$$$

IR vendors have started sharing their #PitScaler write ups but they’re sharing webshell names (.sig files) and attacker IPs - which are unique per victim, so it’s helping me map out the victim orgs via network traffic.

If they failed to remediate you can also then access with the webshell name. One also uploaded their IR investigation to VirusTotal.

The Dutch government has shut down all Citrix Netscalers and is asking every gov org to perform incident response

HT @bert_hubert

https://berthub.eu/tkconv/document.html?nummer=2026D47262

#PitScaler

Social media giant Meta pulled down Brazilian President Lula's Facebook page and blocked his campaign from running political ads but allows paid ads calling for a military coup

It also didn't take down any of the right-wing disinformation campaigns reported in August

https://novaramedia.com/2026/09/28/facebook-blocks-lulas-campaign-ads-just-days-before-brazil-election/

Hackers was release exactly 11337 days ago.