ZeroFox Intelligence Flash Report - Prominent Threat Actors Reportedly Arrested

ZeroFox Intelligence Flash Report - Prominent Threat Actors Reportedly Arrested

Product Serial: F-2025-06-26b

TLP:CLEAR

In this Flash report, ZeroFox researchers report on the recently announced arrests of individuals reportedly associated with the prominent deep and dark web handles IntelBroker and ShinyHunters.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• Reporting on June 25, 2025, indicated that an individual thought to be behind the prominent deep and dark web (DDW) handle “IntelBroker” had been arrested by a law enforcement operation that occurred in France in February 2025.
• Earlier on the same day, separate reporting suggested that four key members of the popular hacking forum BreachForums, who are known by the aliases “ShinyHunters”, “Hollow”, “Noct”, and “Depressed”, had also been arrested on June 23, 2025.
• Both IntelBroker and ShinyHunters are prominent threat actors that are heavily associated with the popular deep web hacking forum BreachForums, which remains inactive as of the writing of this report.
• BreachForums is unlikely to make a successful comeback or relaunch, regardless of the presence of IntelBroker and ShinyHunters. Despite once being one of the most popular and prominent deep web hacking forums, there is a very likely chance that many members perceive a higher risk from using the forum, which is likely exacerbated significantly following the recent arrests.