ShinyHunters is putting pressure on the FBI, which we’ve seen from them before at this stage of an attack. However, with the FBI’s policy against paying ransoms, the group’s leverage comes from the data it claims to have accessed.

If the FBI’s data is extorted, the concern is long-term – who has access to it and what the data could be used for. Cybercriminals have posed as such agencies in order to infiltrate other companies, and depending on the information revealed, the safety of FBI employees.

This is why the focus has to be on preventing sensitive data being exfiltrated. Encryption can be a distracting smokescreen if the focus is on keeping systems running, but the priority should be preventing sensitive data from leaving the network.

Like most ransomware groups, ShinyHunters is highly protective of how it is portrayed. The group has a history of going after individuals who make claims about its activities. It’s no surprise they’ve demanded changes to the FBI’s report because it’s an attempt to control the narrative, however, it’s unlikely to work.