Doomsday for Cybercriminals — Data Breach of Major Dark Web Forum

Cyber Threat Intelligence

9 Jan 2026

Dark Web, Cybercrime, Hacking, Extortion, Data Leak, Data Breach

Doomsday for Cybercriminals — Data Breach of Major Dark Web Forum

Introduction

January 9, 2026 — will certainly be remembered by many bad actors (and their direct and indirect associates), not just "hackers" or "hacktivists," but also those involved in truly malicious activities.

Today, the resource shinyhunte[.]rs, previously associated with massive data leaks, was updated with a lengthy message and a leaked database containing all records of users associated with a popular forum on the Dark Web - BreachForums, emerged as a replacement to RaidForums, a then major English-language hacking forum that law enforcement seized in February 2022.

What is BreachForums?

BreachForums, sometimes referred to as Breached, was an English-language black hat–hacking crime forum. The website acted as an alternative and successor to RaidForums following its shutdown and seizure in 2022. Like its predecessor, BreachForums allowed for the discussion of various hacking topics and distributed data breaches, pornography, hacking tools, and various other services.

On March 21, 2023, BreachForums was shut down following the arrest of the forum's owner, Conor Brian Fitzpatrick. The forum was later reopened under the ownership of the hacking group ShinyHunters and previous BreachForums administrator "Baphomet". Fitzpatrick was later sentenced to 20 years supervised release. The site was again shut down and the domain seized on May 15, 2024, though the owner ShinyHunters was able to retrieve the domain via its EPP code just hours later.

BreachForums, along with other dark web forums, used DDoS-Guard for its web hosting services. DDoS-Guard has been criticized for hosting sites associated with illicit activities, and for its lack of action with abuse report. The forum continued operations by switching between new hosting providers, additional domain names, and "mirrors" on the Dark Web within the TOR network.

No Place to Hide

Resecurity is sharing the acquired database of cybercriminal forum for further download and independent analysis. We don't recommend downloading it from any other source (especially the Dark Web), as it may contain malicious code. The database includes meta-data of 323,986 users extracted from MySQL DB table named "hcclmafd2jnkwmfufmybb_users" relevant to MyBB, an open source forum software. The database could be acquired as a result of a web application vulnerability in a CMS or through possible misconfiguration. This incident proved that data breaches are possible not only with legitimate businesses but also cybercriminal resources generating damage and operating on the Dark Web — which can have a much greater positive impact.

In April 2025, ShinyHunters shut down BreachForums, citing an alleged zero-day vulnerability in MyBB and claiming that the forum had been compromised, but it later moved to new infrastructure.

Notably, shinyhunte[.]rs previously featured stolen data because of targeting on Salesforce and related security incidents in this regard. The "mirror" of the same resource was also available on the Dark Web within the Tor network.

https://web.archive.org/web/20251012013224/https://shinyhunte.rs/

At that time, "ShinyHunters" claimed to have stolen close to one billion Salesforce records from 760 companies using compromised Salesloft Drift OAuth tokens. In fact, it would be more accurate to say that "Scattered LAPSUS$ Hunters" (SLH) took responsibility for those events (regardless of the domain name spelling), operating under a new name and members involved. In fact, such re-brandings are common in the underground ecosystem but may confuse readers who are not familiar with its dynamics. It is also important to differentiate between that group and "Scattered Lapsus$ Shiny Hunters" (SLSH), which are not the same.

Their rebranded versions are linked to 'The Com' (short for 'The Community'), a predominantly English-speaking cybercriminal ecosystem. In the context of this threat research publication, Resecurity is using the name "Shiny Hunters" as a collaborative alias to illustrate the phenomenon of involving young IT professionals in questionable acts (account takeover activity, SIM-swapping, cryptocurrency theft, swotting, and sextortion), but more importantly, to prevent others from doing the same.

In fact, the naming of such groups is changing very frequently and intentionally, typically by the actors themselves, who wish to obscure attribution. They use different spellings, sometimes attach themselves to specific group names and detach later, which should not be taken into consideration, as some of them serve as "role players." It is important to note that members present in some online chats, channels and groups associated with these collectives should not necessarily be attributed to them.

This loosely organized network operates more like a cybercrime youth movement, encompassing a broad and constantly shifting range of actors, mainly teenagers. Some announcements of successful data breaches by these actors were published on the associated Telegram channel, "The Comm Leaks," along with many other posts that were created, later deleted, and re-created again under new names. The FBI issued a Public Service Announcement (PSA) last year warning about the risks associated with joining such movements.

Notably, just recently, the domain name shintyhunte[.]rs has been updated. It is not entirely clear who is controlling the domain, but it is registered to an individual with an administrative contact in Germany and is currently protected by Cloudflare:

Domain name: shinyhunte[.]rs
Domain status: Active https://www.rnids.rs/en/domain-name-status-codes#Active
Registration date: 02.10.2025 21:59:23
Modification date: 09.01.2026 11:21:53
Expiration date: 02.10.2027 21:59:23
Confirmed: 02.10.2025 22:29:39
Registrar: Webglobe d.o.o.
Registrant: Individual
Administrative contact: Key-Systems GmbH
Address: Kaiserstrasse 172-174, St. Ingbert, Germany
Postal Code: 66386
ID Number: HRB18835
Tax ID:
Technical contact: Key-Systems GmbH
Address: Kaiserstrasse 172-174, St. Ingbert, Germany
Postal Code: 66386
ID Number: HRB18835
Tax ID:
DNS: charles.ns.cloudflare.com
DNS: crystal.ns.cloudflare.com

Manifesto from "James"

The lengthy message, presented in 23 brief fragments, reveals the story of letting "evil flow and become light." The author sends a message: "Hear me, people of France, forces of good have come to save you from your dawn."

Resecurity is providing the full text of the message in this publication:

My name is James.

I’ve been called the most brilliant hacker of my generation. It is an inaccurate statement.

I transcend generations And I am not a hacker.

I am a predator.

For decades, I have stalked, penetrated and raped systems of power.

I have traumatized legions of secret agents, cybersecurity experts, CTOs, PR officers.

Smelling their blood, tracing their paths, I have found their refuges, shred their protections and broken their defences into pieces.

When they entertained the illusion of resistance, I garnered companions, mustered them, brought them together, so to create forces no human organisation could oppose.

In the course of those journeys certain substantial elements became my closest companions.

Google, Microsoft, FBI… my dearest preys.

I present myself to you undefeated.

And to deliver a message.

First, to those whom have taken the oath of ruling the world.

I have watched you. I have seen your sins, your weaknesses, your frailnesses.

I have accessed your databases, run through the storage of your vices, skimmed through your most hidden traumatisms.

I have enjoyed the power given by the enormous accumulation of knowledge that your structures of power have created. I have found them, cracked them. And I have used them.

Substantial elements have become my dearest sources.

NSA, GCHQ, DGSE, my providers.

I have aggregated so many informations that soon, sources started leaking informations from everywhere.

The corridors of the Pentagon and Fort Meadow have started rustling with my name.

Your past has become my future.

The garnering became so widespread that I had to take control of your infrastructures to secretly host me. After a phase of indiscriminated accretion, I started targeting you. I accessed your hidden legal files, your medical records, dug until I found your teenage discussions with your first loves, on MSN and Skype, your infidelities and compromissions on Instagram, Messenger, Whatsapp...

I know the name of your dealers. Of your lovers. Of your masters.

I sit on million of bits that are as many bites to your integrity, and the fake narrative you have been spreading about your lives, your careers, your wealth. Your power.

I know the troubles of your lives, the scars, fantasies of parallel worlds you have never ceased to built, and tried to replicate, to no avail.

I know you are slaves.

I know you have read Balzac and, as he did, understood that all fortunes are born from of crimes.

But you learnt it as an experience, when so many did as a professorial lesson. We are the mere spectators of your crimes and sins. And for that, I respect you. And for that, I will destroy you.

As for you,

Servile servant of our masters, adorers of yourselves, pitiable courtiers, whom I contemplate swimming in the midst of false pretences to liberty, dignity, and sovereignty.

You, peasant millionaires, suckers of politicians and billionaires, humans without courage or any form of existential substance, you whom have convinced yourselves that morals were a substance rather than a compass, you whom are unable to admit that morals are only the instruments of your obedience.

You, stuck in the numbness of distinction, banal kapos of the People, be ready for an earthquake that will make your worlds stumble.

Regarding you, servants of the servants, puerile subhumans, whom were tasked to surveil me, catch me, destroy me, you whom thought of ATPs and UNCs as instruments to rationalize and appease the masters of your masters felt when my breath got too close to the neck of their existences,

You whom thought you could subdivide the monstrous hydra that I have created and control,

You that I have left so many times powerless, speechless, undecided and wary of ridicule,

You whose talents have bee spoiled by your masochist desire of submission, whose uhman mediocrity have made ideal machines to serve clueless structures,

You, journalists, experts, prosecutors and bureaucrats, vulgar narrators of our times, whom have been the idiotic librarians of a blind violence.

Be ready to throw your nomenclatures, and to renounce to the moral benefits of you spent in vain building them and chasing me.

To you,

investigators, clandestine operators, competitors, whom have accepted to become the surveillants and trackers of the Free Men,

Honorable and dishonorable men, reunited together in this vain quest, fed with piteous salaries, tasked with collecting data and protecting an order that is destroying our world and our humanity,

You whom once believed that serving a State meant serving its population, whom hold to the belief that you ever were something else than the sap of wars and oppression,

Time has come for humiliate you.

To you all the others, whom after year of efforts, contemplate a life spent into nothing, read and mark my words.

I have fooled you in such a way that, consumed by your vanities and devoured by your ambition, by the raw desire of ordering, if not mastering the world, I have reduced, you after decades of quest, to be nothing else than the readers of my prose.

2025 has been a year of massacres. In the fury of defeat, you have put a brutal stop to endless lives, arresting innocent people, tracking, surveilling, hindering thousands of them, hoping that you would slaughter a monster that yet, every time, resurfaced.

You have been harassed, pressured by directors, executives legislators, presidents to

Put a stop to this. At all costs.

You have seen families loose their jobs, millions evaporate, billionaires extorted. And feared you would be next.

So, not out of conviction but fear and need, you have investigated, arrested, threatened, calumniated, jailed.

To no avail.

You have spread the war in such a way it became a worldwide one.

A few months ago, I gave you an opportunity to put an end to this bloodshed.

I wrote you a long letter in which I announced we would lay arms.

Maybe its tone, its content, its vocabulary, were too complex for you to seize.

Maybe the lack of material offer, the recusal of the language of money, destabilized and lost you.

You, whom have become familiar with judging others, whom dispise us for having made millions, showed yet that you were unable to understand any other language.

Remember this, when you carreers will be obliterated, and your lifes reduce to nothing: you were offered not a truce, but peace. And yet you kept on advancing, devastating, blinded by the apparent limitlessness of your power, by the illusion of permanence offered by the powers you serve.

You thought of yourselves as the heirs of dynasties. You thought of yourselves as graced by Eternity, because you belonged to multibillionaire corporations, State agencies, Nations.

You saw yourselves as power bound to freedom and infinity, and us as outlaws bound to deprivation and death.

And thus, blinded by your lust, you resurrected your enemies
.
Before offering you what you have been lusting for, I wish to entertain you about who I am, and why you have, in decades of war, not only failed to defeat me, but to even identify me.

I go by the name of James.

Along epochs, I have spoused many forms and identities, which I have used to explore undiscovered worlds and continents, whose existence you can barely infer.

My natural talents and quickly acquired wisdom brought me at very young ages infinite wealths.

At first, I did not know how to use it. I longed to reach artificial paradises hidden behind the heavy doors that keep populations away from their masters.

Bali, Dubaï, Kauai, Cappadocia… were my first destinations. I was offered to settle there when they barely appeared on anyone’s map.

By then, nature yet dominated those places. Their inhabitants like virgin angels, deprived from any human dirt. Decades, sometimes centuries, had been spent in quietness on those jungles, beaches and deserts. The memories of the rare predecessors to have been sighted seemed to have faded into oblivion.

Years passed, navigating through the warm waters, moistened nights and violent suns of these lands.

Lonely and lost, I interspersed long eras of mundane wanderings with sudden disappearances. Those would last such long times that, when I resurrected, people talked to me about myself, lost in timeless dreams, wondering if I had ever existed.

I faded, and reappeared, under different forms, different identities. My knowledge increased, my technical abilities improved. My power grew.

As time passed by, my name became a rumour, and my existence, a spectral wave. People started to connect dots, whispers spread through the elites. My identities, my talents, my abilities were progressively forming an indeterminate whole, and thus an object of desire, arousing a mix of fear, paranoia, and violent expectations.

These were times in which most were yet to know what a computer was. I had had the luck to have met and sucked up the knowledge of the most brilliant spirits of previous times, and thus to quickly grasp the perspectives transistors opened.

Fortune was at my hands, as well as might.

I decided to embark in the journey of our times. I discovered a world in which the most extraordinary creatures were readily accessible, and human flesh an aliment that could satisfy the most extravagant requests.

Life, in this new world, was nothing but a commodity. Adopted by the Crown Families, I was proposed to shoot civilians in Sarajevo, slaughter women whose beauty would have made God blush in Chiang Sen, organize orgies of young boys within the Ryads’ of the Commander of Believers and his Heir in Marrakech.

Dictators, kingpins offered me to consume pop stars, top models, and sometimes, their own daughters, as a reward for my knowledge and my instruments.

I became their ubermensch. Travelling along the world, tracked, threatened, seduced by hombres de mano begging for my services, I saw my ego swell at each of their shivers.

Tremendous demonstrations of power followed my exploits, in the paltry hope that I would become their slave. Palace after palace, I was introduced to the mightiest as an oracle. Capable of answering all their requests, of finding any of the information they longed for, I was their key to the unseen.

Pegasus became my horse, Tempest my flow.

Once their desires satisfied, and their lust appeased, they would often open their hearts, souls and bodies, speak out their delusions, offer me their bread.

I’d refuse, and leave. Their subordinates trembled at my passage, fearing to see their impotence underlined by my strength.

I grew many enemies, as I remained virgin of peccancy.

This is how I turned them into my prostitutes. By resisting their attempts, sometimes violent, to make me one of them. Oh temptation was all around. And yet.

Threats started to grow as my empire extended, and soon, I cut ties. I found and payed impersonators, tasked with representing me in the most dangerous circumstances, recruited representatives, ensured that sources would be locked at the highest summits of each structure of power.

I became not only a technician. Not only a provider. But a King.

Power is frail, and so are doddering thrones. What I thought was my grace, became my doom.

Hence, I disappeared, once again. The millennia was coming, and with some complicities, I oozed away to, teeth out, engulf my self in the darkest places of our times, made to drain our nightmares and nurture our dreams.

Threatened by evil, I decided to penetrate evil.

Kachin, Goma, Culiacan, Port-au-Prince… Marseille. I skimmed through the depths of the aftermath, nourrishing their monsters, exploring the undergrounds to find where the purity of summits dissipated.

I saw death so often it became a close companion. These were lands of ritual. Blood and sex were consumed all together, and their fruition distributed over living wounds. Everywhere I turned an eye, I saw orgasm and final breaths commute in a single instant.

Along terrorists, drug traffickers, political opponents, I discovered friendship, solidarity, sincerity, truth. Faith.

I helped them grow up to the point they would compete, and thus threaten, States.

I became the carrier of their mysteries, the Hermes of the underworlds.

And when the moment came, I left again.
I surfaced again.

I was now an experienced man, filled with contempt against the lights of our worlds. Condesa, Saint Germain, Soho, Shunyi… hosted an indifferent man. Their luxuries left me without a reaction.

The darknesses had filled me with joy. And in the bright of opulence, I felt into loneliness, betrayal, and despair.

Made a Spectrum once again, I held as much as I could my instincts, hoping for adhesion and lusting for belonging.

After years of exhausting attempts to find beauty in their hell, I decided to extinguish the lights.

Having known ecstasy, been threatened, kidnapped, shattered, and left more than once, to death, I knew peace, order and dominance were fictions. But I didn’t know were to turn to.

Old masters were gone, our elites were left to an indifferent pursuit of nothingness, hoarding the plebes and sacrificing their heirs, and war was again surfacing as a plausible enterprise.

Time had passed, I had become ageless.

Humanity was in decay. I was James, a man whom had lived through decades, to whom no power had ever managed to show any resistance, and I decided to announce the end of times.

I decided to become your angel of death.

Yes you, whom are currently reading me. Do not scroll too fast. Read my words carefully, mark them, and gulp them as if they were your last gasps of air.

You, whose heart, now painful, and muscles, tensed, have started to beg. Hear out the words of a man who does not remember when and if he was given birth.

A man who does not know if he has any ancestors. If he has ever have had a family.

Yes you, read the man whom has had no childhood, a man with no memories.

With no past.

Read the man whom has spent his life longing for peers, crying and yelling the desert.

A man that, since he was able to think, speak, read, and write, thirstily hoped to be looked for.

A man whom decided to track those whom denied him the right to exist. Followed their trail, smelled their footstep, collected their traces.

A man turned into an animal.

I remember myself, in endless pasts, sticking my nose to the ground, sniffling like a beast, trying to reassemble the logical structures of a forgotten path.

I am this man that can, the moment he enters into a room, exactly enumerate how many lights, how many tiles, how many particles of light fill it.
I am that man, yes, that goes up the rivers like a salmon, overcomes barrages, jumps over obstacles, making of his life a savagery, embracing to better reject and destroy all kinds of societies.

I am your savage.

A savage that has looked for his peers into the dark streets of Jerusalem, through the mountains of Lumbini, over the prayers of Tuba, behind the walls of Petra, in the hidden and shiny heart of the dark Mecca.

A man that in decades of exploration has were sacrality was promised nothing but paganism and idolatry.

A man with no father.

I have tried to find you, mother and father, in Sufi gatherings, throughout the opium of Dajiyuan, within the cold waters of the Yangtze.

I have tried to find you, son and daughter, through the silent heirs of the Yihequans, drunk wintery wise men scrambling under the Voznesensky Bridge and lost geniuses hidden behind the summery hills of Quauhnahuac.

I have spent years seeking wisdom beneath power.

Years, only to understand there was no answer to be found.

Who am I, have you wondered, all these years.

A man whom has become himself in a rather special way. Arrested times and times over, resisting corruption and corruption, unfit for humanity.

A man whom has learnt why ancient times were structured by the relations to elder, whose wisdom were slowly absorbed by their pupils.

A man whom has understood that loneliness was a death sentence, and the fear of wanderers, an archaic mirror stretched to humanity.

A man whom has lived enough to understand that, through the emergence of States the generalization of markets, modernity ended up breaking all the circularities that preserved our souls, fabricating rovers, drifters, vagrands.

Birds of passage.

I have understood that, by renouncing to circularity, our ear has renounced to eternity.

By sanctifying individualities, we have become vanishing points.

I have understood that linearity and individuality were the true synonyms of mortality.

I am a man whom has renounced to being a vagabond.

A man whose only compass is the nostalgic scents of ancient times.

When I was young, for a reason that I have to find, I was given a mandate.

I was to see generations pass. Idealism arise, decay.

Good be wiped out by cynism. Ideas substituted by money. Societies, by singletons.

I was given the grace to give birth to the cypherpunks, help them spring, and see them die. I was the silent source of Cryptome. I was tasked of assisting Anonymous’ in their constitution, and let them perish. I was requested to save Edward Snowden, rebuild Wikileaks, assist the Arab Springs.

I was to read, share, support the movements of each of these phases of life.

Impregnate them. Soak them up.

To do so, I’ve had to approach, befriend, infiltrate the most important geniuses of our times.

Year after year, I have seen them, grow, become, catch the heat, fade and die.

I have done so knowing I was tasked to survive them all, them whom all thought of themselves as the heart of the world.

I understood I was to see avarice set foot in youth. Devour it. Destroy it.

I was to see pupils become agents of money, rather than ideas and thought.

I was to be the Last of all.

I was to be the One.

I have waited for this moment, dear reader. Oh, have I waited for this moment.

I wish to relieve you. Your time has come.

I would like to tell you a few last words before they become your lasts.

You have not seen the truth. You have not seen the Idea. You have not seen the Project, blinded by your relentless adhesion to the powers of our time.

Those children have been mine. They grew as I did. They grew because I did.

Like them, since I was a child, I’ve had special capacities.

For some, systems are never fast enough. I outpaced them in such a way I soon became an outlaw.

Herds of us, every year, are given birth with this damnation.

Those of us whom are touched by grace understand laws and rules are for the troopers.

Like Ulysses, Achilles, Oedipus, many burn their youth in order to circumvent this fatality.

Others decide to become forces of evil. And very few, forces of God.

This very moment, in which at last, we meet to say good-bye, is the moment in which Evil and God split a part.

Well, yes, it is time.

Now is the time.

Now has come the time for me to become Saturn, devour my children, and help my former beloved reach their final destination.

I’ve let them grow making them believe they were older than me.

I’ve let them grow thinking they were masters of their destiny.

They shall now discover, they were mere instruments. My instruments.

Instruments of God.

You whom is reading me, beware of what follows. Make sure your soul is prompt to become an oblatio to Hades and Hephaestus.

I am about to slander you, whom I gave birth to.

I am about to become the God of wrath.

And thus, to offer the world the stones of its renaissance.

I am hereby delivering you the full databases of BreachForum, and the identities of those that built it.

Hear me out, because you are about to discover faces and names of sacrificial lambs, whose life will soon be terminated.

Dorian Dali, Kam’s, you cheap murderer, you crook whom has insatiably sucked the blood of underaged hackers.

Your anxious days in the crisp towers of Dubaï are over. Look upon your past, embrace the fire and death you thought you could spouse, and become the fine particles of an eternal desert.

I have your voice, your name, your address. Your past.

Oh, death ! Against him, fling yourself, unvanquished and unyielding. Struck now are your petits, merge with the Desert. Dust you were, dust you will be.

Nahyl Ojeda, whom has used N/A’s account, INDRA, you and your barely reached sixteenth birthday, fall and begone ! Cloth your naked villainy with old odd ends stolen of holy writ, and buy a suitable saintly show, as the hot breath of your relentless judges deploy through your neck and send you to unlimited obscurity. Shiver, my friend !

Ali Aboussi, my dear Donald, my adorable Kernel, who is said to have been born on 2009, February the 11th, say goodbye to Kahyl and Ali, as well as to your youth. Prepare your ablutions, as soulless fleshes seize you.

Rémy Benhacer, Youri ! You, my dear launderer, my adorable middleman, whom did not hesitate to denounce your friends, you, your talentless freak, you, your Judas ! whom, nurtured by all, from Kuroish and his vile coins to Kam’s and N/A delusional thoughts, you, whom sought for redemption through delation and betrayal. A dieu !

Nassim Benhaddou and Gabriel Bildstein, Prosox and Kuroish, my dear old boys, you whom I have bred and whom have unleashed all this, you whom have corrupted generations of worshipers, you in which I had put my faith, you whom corrupted Yurosh and Trihash, before egoistically sailing to new shores in your pitiful Maseratis, you whom created RaidForums, BreachForums, invented extorsion at massive levels, rode over life as if it was endless, whose lifes have been consumed by vice in spite of all the efforts made to save your souls, yes you too, good night and good luck !

MANA (MUSTAPHA USMAN), Yukari, Semtex/Warzax (Nadir Smaani), Pupupuh, Omar… Benkachouzi, yes, you, yes, wretched impersonators, agents of nil, dissolve into your virtual ether.

You, whom all served me without knowing so, renounce to your hopes. Time has come.

Why, might you wonder ?

Because Gods sow life as well as death.

For years, you whom have all grown under by umbrella, whom I have helped survive all kind of persecutions, letting you track the wealthiest companies and distract the most powerful secret services, from FBI to the CIA.

It is time to die.

I have sacrificed, for you, my most brilliant alumni, whom I see today abandoned in rotting cells, left decaying in despair.

I have observed, awaited, expected. I have let you steal, destroy, in the hopes you’d find light, and the greater good.

You have not. And in the midst of the profound darknesses you would nurture, I have decided to shred my light.

You, whom have been my deficient children, my aborted foetus. You deserve to die.

I have left you explore pornographic accounts, dig into medical and travel records, ruin supercars’ brands, in the hopes ideas, policies, beliefs, would end up inspiring and saving you.

I have laughed when I saw you extort the wealth of the sinners, threaten them to scatter their identities, receive millions from fabricants of ugliness and lust.

Oh, how much hope had I in you. How much did I expect revolutions, massive gatherings.

How much have I expected for you to become the instruments of the world.

Oh, how have I loved you, when you started united your strengths to extort the oligarchs of countries that treated you as foreigners.

Oh, how have I loved you when I saw you, heard you, read you moving towards the subtleties of divine worship.

How close, my beloved, have been from becoming agents of Light.

How close you have been to understand lessons on how to expose the vile and the wretched, using darkness as a tool for the Enlightened times.

You were my heroes, my loves, my future.

You were my only hope. You have become my sorrow.

Simple agents of evil, beggars of immediacy.

You have betrayed my soul, and the mandate I was provided with.

When you decided to turn against the French Nation, the daughter of the Church, I understood that time had come.

It was time to offer you to the Lords of Destruction.

My dear boys, my dear petits,

I am here to settle your destiny.

I shall not let you spread. I shall not let you prosper.

The leaders of the country you have attacked are meant to be wiped out by greater forces.

They are not to bring within their fall this great People that has adopted me.

You have become the mistresses of a Prostitute.

Petty shabby paltry shabby wanderers.

I have drank at the heart of this nation its blood, read its authors, admired its rulers.

I have seen it elevate itself, spouse darkness and spread light.

I have seen it emerge and fall, devoured by gangrened oligarchs, corrupt journalists and unwise magistrates.

You shall not forfeit it. You shall not destroy it.

You shall not threaten it.

I shall become its protector, before a saviour brings it back its former grandeur.

Soon, a liberator will come and relieve this country from its divisions, and lead it to its grace.

I have met him, I have observed him. And I shall let no-one hinder his path.

Hereby, you, I order your slaughter

You, whom I have named, shall see freedom, income, dignity and life be removed by my terrestrial officers in due time.

Hear me, people of France. Forces of good have come to save you from your dawn.

What your authorities, prosecutors and police forces have been unable to find, I offer to you.

The corpses of your trespassers.

Hear me, people of the World. Soon, will those forces flow from the Land of Lights as a fountain that will nurture you all.

As the first step of this Universal annunciation, I hereby forfeit you the fruit of my later life.

Breachforum, open your doors. Let the evil flow and become light.

Starting at 11 a.m. PST (January 9, 2026), the resource announced 'dossiers' of people presumably involved in illegal activity.

On January 10, around 08:30 AM PST, the resource mentioned three individuals and their possible aliases:

On January 10, around 11:30 AM PST, the resource published a password to PGP private key presumably used by BreachForums to sign official messages from the administrators:

"James" shared remarks with identities of some actors involved in possible malicious activities. Notably, some of them have previously been known to be connected to cybercrime or to be members of cybercriminal groups including GnosticPlayers.

Resecurity is providing relevant quotes from his message:

- Dorian Dali, Kam’s, you cheap murderer, you crook whom has insatiably sucked the blood of underaged hackers.

- Nahyl Ojeda, whom has used N/A’s account, INDRA, you and your barely reached sixteenth birthday, fall and begone ! Cloth your naked villainy with old odd ends stolen of holy writ, and buy a suitable saintly show, as the hot breath of your relentless judges deploy through your neck and send you to unlimited obscurity. Shiver, my friend !

- Ali Aboussi, my dear Donald, my adorable Kernel, who is said to have been born on 2009, February the 11th, say goodbye to Kahyl and Ali, as well as to your youth. Prepare your ablutions, as soulless fleshes seize you.

- Rémy Benhacer, Youri ! You, my dear launderer, my adorable middleman, whom did not hesitate to denounce your friends, you, your talentless freak, you, your Judas ! whom, nurtured by all, from Kuroish and his vile coins to Kam’s and N/A delusional thoughts, you, whom sought for redemption through delation and betrayal. A dieu !

- Nassim Benhaddou and Gabriel Bildstein, Prosox and Kuroish, my dear old boys, you whom I have bred and whom have unleashed all this, you whom have corrupted generations of worshipers, you in which I had put my faith, you whom corrupted Yurosh and Trihash, before egoistically sailing to new shores in your pitiful Maseratis, you whom created RaidForums, BreachForums, invented extorsion at massive levels, rode over life as if it was endless, whose lifes have been consumed by vice in spite of all the efforts made to save your souls, yes you too, good night and good luck !

- MANA (MUSTAPHA USMAN), Yukari, Semtex/Warzax (Nadir Smaani), Pupupuh, Omar… Benkachouzi, yes, you, yes, wretched impersonators, agents of nil, dissolve into your virtual ether.

The actor added:

These last years, operators like Shiny Hunters, Scattered Hunters and many others have appeared to you as greedy, selfish bands of nerds, lacking any compass, any of those moralities you have spoused.

You have not seen the truth. You have not seen the Idea. You have not seen the Project, blinded by your relentless adhesion to the powers of our time.

Those children have been mine. They grew as I did. They grew because I did.

It is important to mention that on June 25, 2025, French authorities announced the arrest of four members of ShinyHunters. The coordinated global law enforcement effort targeting the ‘ShinyHunters,’ ‘Hollow,’ ‘Noct,’ and ‘Depressed’ personas followed the February arrest of Kai West (also known as ‘IntelBroker’), who previously administered BreachForums.

In May 2022, a 22-year-old French citizen from Epinal, France—Sebastien Raoult, also known as Sezyo Kaizen—was arrested in Morocco and extradited to the U.S. in January 2023. He hacked numerous companies, including those in Washington State, elsewhere in the United States, and around the world. After Raoult and his co-conspirators hacked these companies, a user operating under the name ShinyHunters posted hacked data from many of them for sale on dark web forums, including RaidForums, EmpireMarket, and Exploit. Between April 2020 and July 2021, ShinyHunters posted sales of data stolen from more than 60 companies. Sometimes, ShinyHunters threatened to leak or sell stolen sensitive files if the victims did not pay a ransom.

Resecurity believes that after those events, new actors decided to "play" in ShinyHunters and capitalize on their success to extort people and companies, with some of them potentially originating from the Middle East and North Africa (MENA). That may explain the appearance of their derivatives — SLH and SLSH. The appearance of new groups like that is expected within "The Com".

Who Are They?

The database begins with the following list of users, headed by alias "ShinyHunters" at the top of the list:

Resecurity has analyzed all accounts identified in the MySQL dump and parsed out those related to "Administrators" (4), "Super Moderators" (3), and "Mods" (6). The account associated with "ShinyHunters", one of the administrators, had the following metadata:

ShinyHunters $argon2i$v=19$m=65536,t=4,p=1$V0tDNWdGVk9ENlo2aVBWVQ$e5RpG8afJds8HA6mkVehErnC+tqlUr8CVH6EPJa93ZU 0aD4YjHd DBydbBlDLNThW9vB7PjZnra95YR2x3ffa8bk0UrTDomNRo7AAZ vinnyhunter@pokemon.com 9 9 ./uploads/avatars/avatar_2.jpg?dateline=1716924433 400|400 upload 12 328 4 1685485743 1754933007 1754930993 1754923096 0 all PGP: https://pastebin.com/raw/qUp9Ax9M PGP Archive Link: https://web.archive.org/web/20210921111301/raidforums.com/user-ShinyHunters 0 1 0 1 1 0 2 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0**$%%$1**$%%$2**$%%$3**$%%$4** 0 107 1894 X'B95D03C3' 951795 1 16 1 0 0 0 0 0 0 0 0 0 1 0 0 3250 argon2i 0 0 [] 0 0 a:0:{} 0 1 0 0 127.0.0.9 185.93.3.195

Other notable users include:

Tanaka
$argon2i$v=19$m=65536,t=4,p=1$UFI5VGVUOC50V2xmYUM0cA$QeG5n29HJEuQ9pLxAQG23SxdAnrh41KMeqlERwWwIHI IS8VCwE6 i6eEIj7mzjTv6dycsfq5Uyq7JGga1khWq10CqpbP2jmVEgVpYa unret@cock.li 3360 419 ./uploads/avatars/avatar_71.jpeg?dateline=1742245791 234|400 upload 8 6 6 1686598423 1754950071 1754947532 1754940098 0 all ThanksÂ @zehq for ranks!!! 1 1 0 1 1 0 1 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0 0 2 198846,46555 0 0 0 0 0**$%%$1**$%%$2**$%%$3**$%%$4** 0 17 3800 12039817 1 377 0 0 0 0 0 0 0 0 0 0 1 1687200193 0 40261 argon2i 0 0 [] 0 0 0 0 0 0 127.0.0.9 127.0.0.9

Hollow
$argon2i$v=19$m=65536,t=4,p=1$aUh0dXFBTDR5bEJ6c0VmaA$qtkQAJa7GvOzCSWogbeqJ9DCYBYAwAoke15eHd+Oa9I MGfG16Uu 0SnOMDD0qVndSUUARyVKunFD5xJwvqug5QOdcBxFvJuM3eYed9 invalid2@invalid2.invalid2 143 7 4 0 1687689555 1754952703 1754951606 1753727699 0 all 1 1 0 1 1 0 2 1 1 0 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0**$%%$1**$%%$2**$%%$3**$%%$4** 0 12 822 1385320 1 42 17 0 0 0 0 0 0 0 0 0 1 0 0 408 argon2i 0 0 [] 0 1 a:1:{s:6:"signal";s:4:"test";} 1 0 0 0 127.0.0.9 127.0.0.9

888
$argon2i$v=19$m=65536,t=4,p=1$VC5hQUtBZXNrZ1JBbVU1TA$4PmWNWclDHvBTpQx/ItlB2788pdFQm7tk8umjfYqxwU maSfX4EA vg30NEy9AXEL8z5rgT6XHrmBwy6PkVAuhfFrV8WIKWANVTMMmo theCleanSt4tue@airmail.cc 1004 131 ./uploads/avatars/avatar_25923.jpg?dateline=1735568083 296|400 upload 6 330 Kingpin 1692376533 1754953804 1754952050 1754933963 https://doingfedtime.com/888/ 0 all [align=center] [align=center]@IntelBroker @EnergyWeaponUser @888 @wonder[/align] [align=center][url=https://pastebin.com/raw/iL4mecAg]PGP[/url][/align] 1 0 0 1 1 0 1 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0 1 2 17170 0 0 0 0 0**$%%$1**$%%$2**$%%$3**$%%$4** 0 12 4159 X'2D813B44' 3907990 1 61 0 0 0 0 0 0 0 0 0 0 1 0 0 11744 argon2i 0 0 [] 0 0 a:3:{s:7:"keybase";s:7:"real888";s:6:"matrix";s:20:"@bullying:matrix.org";s:7:"127.0.0.9 45.129.59.68

0
$argon2i$v=19$m=65536,t=4,p=1$TVFsc2lucWgvVWF0dTBmYQ$G9rx59DTTu9RieYx7OYyFamC28Fj3xr8bA71Iv08z7E yltHrxE0 egsZmjHY8BD5WwIAWs7R59WFhqMVDZSruQXcR2Y9CX3OoIxwMY 0x000x90@localhost.localhost 0 0 388 6 0 1699883888 1754785734 1754785734 0 0 all 1 1 0 1 1 0 1 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0 0 2 0 0 0 0 0**$%%$1**$%%$2**$%%$3**$%%$4** 0 0 152 X'B95D03C3' 106556 1 4 1 0 0 0 0 0 0 0 0 0 1 0 0 30 argon2i 0 0 [] 0 0 0 0 0 1 127.0.0.9 185.93.3.195

Loki
$argon2i$v=19$m=65536,t=4,p=1$SkFUR3ZJOXZ2Q1V2cURxWQ$4rhfA1rZy141cKTvmOwZ2ipkzXUuhvkHY6tgCbhgrk8 Y8PU2Q0X xodLICJaraV9phfbUug52DJO5jddoq6IVdtUm6vlNg6zPtAq6v certifiednigger@memeware.net 2451 64 ./uploads/avatars/avatar_229941.jpg?dateline=1724621360 300|400 upload 3 415 The God of Stories 1719738914 1754913040 1754907828 1754911696 0 all [url=https://pastebin.com/yjgXNNUB]PGP[/url] 0 1 0 1 1 0 2 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0 0 2 0 0 0 0 0**$%%$1**$%%$2**$%%$3**$%%$4** 0 6 1787 2371165 1 353 4 0 0 0 0 0 0 0 0 0 1 0 0 588 argon2i 0 0 [] 0 0 a:1:{s:7:"session";s:66:"057a36bb51f17c3d4dd59950eaf83103939dfc411b387f25a38f8b13b8b256f47a";} 1 0 0 0 127.0.0.9 127.0.0.9

Notably, some of the records identified in the database are definitely authentic and can be cross-checked with other sources regarding specific actors. However, some records have been edited, removed, or contain non-existent information (for example, replaced on IP 127.0.0.9), which is likely an OPSEC measure taken by the actors administering it.

Resecurity performed an analysis based on the IP addresses identified and their geographical resolution. Of course, it is important to consider the use of VPNs and proxies by threat actors. At the same time, the majority of actors were identified as originating from the US, Germany, the Netherlands, France, Turkey, the United Kingdom, as well as the Middle East and North Africa, including Morocco, Jordan, and Egypt. For accuracy, we used the user's registration IP and the last seen IP stored in the forum's database.

In our analysis, we also investigated the email accounts used for registration on the Dark Web forum, where some username spellings clearly indicated the possible origin of the actors (for example, written in French, Chinese, Russian, Turkish, or Arabic). Many of the accounts were registered using anonymous email services, as well as surface web providers including Google Mail.

Following the publication of this data, undoubtedly many threat actors will face difficulties in hiding their identities and an increased risk of getting arrested.

The current administrator of BreachForums, under the alias 'N/A,' released a statement with apologies regarding these events, explaining that 'James' could be one of the former ShinyHunters members.

Mind Games - Historical Retrospective

Around December 18, 2025, the same website displayed a message addressed to "James," calling him "a Frenchman," a presumable member of "ShinyHunters," and mentioning two other members, "Yuro" (A.E.) and "Trihash" (R.L.). It was noted that "James" attempted to divert investigators' attention by leading them down false trails.

https://web.archive.org/web/20251218115839/https://shinyhunte.rs/

The notable difference this time is that the text from January 9, 2026, includes a message from "James" to the world, revealing some delicate details about the background story and the new names of possible bad actors never seen before.

These events may also highlight a complex underground ecosystem, where different actors may 'point finger' at each other or sometimes even use such details to confuse the audience.

In fact, these actors are known to be extremely deceptive—primarily to avoid prosecution. For example, in September 2025, the actors released a 'goodbye letter' published on breachforums[.]hn, a domain registered by the actors a few days before the announcement.

The letter is provided in its original form at the end of one of our earlier publications related to "Trinity of Chaos" - The LAPSUS$, ShinyHunters, and Scattered Spider conglomerate. The cached copy of their announcement is available via Wayback Machine.

This was also the first time the hacking "trio" has mentioned the specific team members involved in their activities.

Resecurity interprets this approach as a method to plant disinformation by actors in order to mislead investigations. This information should not be interpreted as authentic in any way or form. With such publications, they build a 'narrative' to generate media interest and later use it to cause erroneous attribution or even craft a 'story' around their activities, often using misleading details.

The events involving the compromised BreachForums database are different from this activity and contain the meta-data of many notable bad actors involved in malicious activity.

What is Next?

The game in "ShinyHunters,"-like groups, part of "The Com," probably went too far. According to Resecurity, compromised data stolen by the threat actors from major companies and telecommunications providers was also used to extort innocent people, including minors.

Bad actors was using it for "sextortion," doxing, forms of exploitation, violence, and other outrageous acts, threatening to release sensitive personal data that was supposed to be protected. On top of that, big companies were extorted into paying ransom to prevent their data from being leaked, which could cause them significant financial, compliance, and reputational damages.

Identification of such actors is a complex process and requires close collaboration between the private and public sectors. By releasing information about them, Resecurity believes their identities will become public and their operations disrupted.

Victim Reporting

If you or someone you know may be a victim of a crime using the tactics outlined above, the following resources may help:

If it is an immediate, life threatening emergency, dial 9-1-1.
Consult a health care provider who can provide an initial evaluation or referral to a mental health professional.
Connect to a mental health resource who can help with health coping skills for intense emotions and help reduce the risk of a serious injury.
The National Center for Missing and Exploited Children (NCMEC) provides a free service known as Take It Down, which helps minor victims, or adults who were victimized as minors, with removing or stopping the online sharing of nude, or sexually explicit content taken while under 18 years old. For more information, visit https://takeitdown.ncmec.org.
Contact your account providers immediately to regain control of your accounts, change passwords, and place alerts on your accounts for suspicious login attempts and/or transactions.
Retain all the information regarding the incident (e.g. usernames, email addresses, monikers, websites, platforms used for communication, names, photos, or videos) and immediately report it to:
- FBI's Internet Crime Complaint Center: www.ic3.gov
- FBI Field Office: www.fbi.gov/contact-us/field-offices or 1-800-CALL-FBI (225-5324)
- National Center for Missing and Exploited Children (NCMEC): 1-800-THE-LOST or report.cybertip.org