A 24-year-old Amsterdam man linked to the extortion group ShinyHunters was set to appear before a Rotterdam judge Monday, Dutch police said, as fallout continued from the group's brazen hijacking of a rival ransomware gang's leak site earlier this month.
Dutch police confirmed that Pepijn van der Stap, arrested September 15 and previously known online by the handle "Umbreon," is being investigated over a possible connection to ShinyHunters. Police said investigators are examining links between van der Stap's alias and the group's recent use of similar Pokémon-themed imagery in its attacks. Van der Stap was previously convicted in 2023 of hacking and blackmailing more than a dozen companies and was serving probation from that case at the time of his arrest.
ShinyHunters denied any connection to him. "That individual has no association with us. Frankly, we are laughing," the group said in a statement reported by KrebsOnSecurity.
The Clop hijacking
The arrest follows one of the more unusual episodes in recent ransomware history: ShinyHunters' breach of Clop's own dark-web leak site. According to BleepingComputer, the group exploited an unauthenticated file-upload flaw in the Grav content management system running Clop's Tor site, then defaced it with ASCII art of its Umbreon mascot and claimed to have stolen the site's source code, server logs and the private keys to its onion address.
ShinyHunters demanded an eight-figure payment from Clop, threatening to raise the price every 24 hours and to publish details of which companies had paid Clop ransoms during its 2025 campaign exploiting Oracle E-Business Suite software, along with the Bitcoin addresses used. The group said the attack was retaliation for threats it says Clop representatives made during an earlier dispute between the two gangs. Clop responded on its hijacked site but rejected ShinyHunters' contact attempt, and the standoff between the two extortion operations remains unresolved.
The episode illustrates a dynamic researchers have tracked with growing interest this year: as ransomware and data-extortion crews multiply, they increasingly turn on each other, competing for victims, notoriety and leverage in ways that occasionally expose one gang's operations through a rival's attack. Whether Monday's court appearance produces charges tied specifically to the ShinyHunters group remains unclear; Dutch prosecutors have not detailed what, if anything, van der Stap will be charged with beyond matters related to his existing probation.