Loading story…
Huntress said internal investigations and consultations with law enforcement found no evidence supporting allegations by a former employee that the company had an insider threat involving illegal conduct, unauthorized access, customer or partner data disclosure, source code exposure, or an insider allegedly "caught by the FBI." The company said it re-opened and continued reviewing the matter after the former employee resurfaced concerns and sent additional communications.
The company acknowledged that a current teammate told a threat actor that law enforcement had contacted them about that actor, calling the disclosure poor judgment but not illegal. Huntress said it immediately investigated the incident by reviewing systems and communications, interviewing staff, and consulting law enforcement, then imposed administrative actions and coaching and strengthened internal researcher policies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-29, Huntress published a statement responding to allegations from a former employee. The company said multiple internal investigations and consultations with law enforcement found no evidence of illegal conduct, customer or partner data disclosure, source code exposure, or an insider being 'caught by the FBI.'
Huntress said a former employee later resurfaced concerns about an alleged insider threat and sent additional communications. In response, the company said it re-opened the matter and continued its review.
After learning of the disclosure, Huntress said it immediately investigated the matter by reviewing systems and communications, interviewing staff, and consulting law enforcement. The company said it later strengthened researcher policies and applied coaching and administrative actions.
Huntress said a current teammate told a threat actor that law enforcement had contacted them about that actor. The company described the disclosure as poor judgment but said its investigations found it was not illegal and did not involve unauthorized access or data exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The hacking group **ShinyHunters** claimed to have breached the internal systems of *Resecurity*, a US-based cybersecurity firm, releasing screenshots purportedly showing access to sensitive dashboards, user management panels, API keys, employee data, and internal communications. ShinyHunters alleged they exfiltrated internal chats, client lists, threat intelligence data, and employee information, framing the attack as retaliation for Resecurity's alleged attempts to infiltrate threat actor groups by posing as buyers on dark web markets. The group also credited Devman Ransomware for assistance in the attack and published evidence to support their claims. However, *Resecurity* responded by stating that the data accessed by ShinyHunters was part of a sophisticated honeypot operation designed to monitor and log threat actor activity. According to Resecurity, the honeypot included simulated data and a planted honeytrap account, and there was no impact on actual customers or internal operations. Resecurity confirmed that all data referenced by ShinyHunters originated from the honeypot, and they had already logged the attackers' IP addresses. The incident highlights the ongoing cat-and-mouse dynamics between cybersecurity firms and threat actors, as well as the use of deception technologies in cyber defense.
Jun 29, 2026
CrowdStrike terminated an employee after discovering that the individual had shared internal screenshots of company systems with a hacking group. The screenshots, which included dashboards and links to company resources such as an Okta dashboard, were later published by Scattered Lapsus$ Hunters on Telegram. CrowdStrike emphasized that their systems were not breached, no customer data was exposed, and the incident was promptly reported to law enforcement. The hacking group ShinyHunters claimed to have offered the insider $25,000 for network access and alleged they received SSO authentication cookies, but CrowdStrike stated that the insider's access was cut off before any compromise occurred. The hackers also attempted to obtain internal reports about ShinyHunters and Scattered Spider but were unsuccessful. CrowdStrike denied any connection between this incident and recent claims of broader Salesforce-ecosystem breaches involving other companies.
Jun 29, 2026
SentinelOne said it temporarily removed its research article **"Elephant Hunting | Inside an Indian Hack-For-Hire Group"** after receiving notice of a pending court order. The company identified the report as research by Tom Hegel and said the takedown was made out of an abundance of caution while related legal proceedings continue. The company said it **stands by its findings** and maintained that the report was based on many hours of research, verified sources, and transparent presentation of supporting evidence. SentinelOne added that it is monitoring the legal action tied to the article, signaling that the dispute now extends beyond the underlying cyber-espionage allegations to a legal challenge over publication of the research.
Jun 29, 2026