An FBI/IC3 PSA warns that the ShinyHunters group may extort victims by escalating harassment after compromising an online learning management system. It recommends verifying urgent requests through alternate channels and not paying or responding to demands.

The FBI/IC3 PSA warns that the ShinyHunters cybercriminal group—linked to attacks against an online learning management system—may attempt extortion and intimidation after gaining access. The PSA describes that victims could face pressure to pay, paired with harassment tactics meant to increase fear and urgency. A key concern highlighted in the alert is the use of real-world context during communication, including spearphishing-related approaches that can make messages seem credible. Once victims are contacted, attackers may issue threatening texts or calls, intensifying the pressure to comply with payment or other instructions. The PSA also cites tactics such as swatting, indicating that the intimidation can be aimed at disrupting the victim’s safety and normal life, not only extracting money. The guidance emphasizes that urgent demands—especially those referencing specific circumstances about the victim or organization—should be independently verified using alternate channels. The PSA discourages victims from responding to or paying attackers because doing so can encourage further demands and escalating behavior. It also advises not to treat attacker instructions as legitimate, even when they appear detailed or time-sensitive.