Rival Factions and Suspected Impersonators Contest the ShinyHunters Identity After Arrests

Arrests in September 2026 did not end activity under the ShinyHunters name; at least three factions—the leak-site operators, Aegis, and ShinyEquationCartel—competed to claim the identity while advertising overlapping stolen data. Flare researcher Jon DiMaggio assessed with moderate confidence that the leak-site faction represented the core operation during the period examined. Shared download links, matching file tokens, synchronized Telegram messages, and certificate timing connected parts of the distribution ecosystem, but did not establish who conducted the intrusions or controlled the servers. Competing claims involving H&M, Orange, and Baxter International remain unverified; the reporting also distinguished the leak-site-associated UNC6240 cluster from UNC6671, assessed as independent of ShinyHunters.

Separately, StealthMole assessed that the Telegram persona @reyswap, which claimed to represent Rey and ShinyHunters around Rey’s reported September 29 detention in Jordan, was an impersonation operation. Newly created accounts and PGP keys, contradictory identity claims, and failure to demonstrate control of Rey’s historical verification keys undermined its legitimacy. The persona alternated between Rey and Aegis while advertising data sales, extortion, recruitment, and escrow services, but its identity, data access, and affiliation remain unverified. The disputes increase the risk of victims negotiating with impersonators rather than actual data holders. Defenders and incident responders should verify persistent account IDs, historical cryptographic signatures, infrastructure, and operator behavior rather than trusting branding, and validate supplied indicators before operational use.