ShinyHunters Hack: How FBI Cyber Chief Brett Leatherman Executed the Frame-Job That Led to Tor Operator Conrad Rockenhaus’s Homicide

On September 22, 2026, international cyber-extortion group ShinyHunters executed a massive cyberattack on the FBI, taking down the Special Agent Applicant Portal (apply.fbijobs.gov) and defacing the site after exploiting an unpatched Oracle PeopleSoft zero-day vulnerability.

The breach resulted in the exfiltration of approximately 3 Terabytes of sensitive personnel, HR, Criminal Justice (CJ), and Medlink records covering active agents and job applicants. Notably, ShinyHunters posted a public statement on their pay-or-leak portal addressed explicitly by name and title to Assistant Director Brett Leatherman of the FBI Cyber Division, demanding that the Bureau retract its Q2 2026 FLASH report.

FBI Special Agent Brett Leatherman, THE EXACT SAME agent who sat by while prosecutors framed Conrad Rockenhaus over a virtual machine display driver, is now getting lectured on “constitutional rights,” “reputation defense,” and “disinformation” by Shinyhunters😆😆😆 https://t.co/EEJE1qmrCI

— Mia🇦🇹 (@picklepickleg) September 22, 2026

While Brett Leatherman currently serves as the Assistant Director of the FBI Cyber Division in Washington, D.C., his career elevation traces directly back to 2020, when his old title was Supervisory Special Agent for the FBI in Frisco/Plano, Texas. Leatherman served as the lead case agent in the prosecution of Conrad Rockenhaus, a decorated veteran, 100% disabled Navy combat veteran, former NRO network architect, and Tor Operator.

Following years of extrajudicial retaliation stemming directly from Leatherman’s fraudulent prosecution, Conrad Rockenhaus was murdered in April 2026, a homicide forensically unmasked in the official forensic report.

The Plano Perjury and SPICE Driver Frame-Job: How FBI Agent Brett Leatherman’s Prosecutorial Pipeline Led to the Homicide of Tor Operator Conrad Rockenhaus

In the U.S. District Court in Plano, Texas, pretrial officer Tiffany Routh testified under oath that Rockenhaus had downloaded a “Linux hacker operating system called SPICE” to bypass device monitoring.

In reality, SPICE (Simple Protocol for Independent Computing Environments) is merely an open-source virtual machine remote-desktop graphics driver needed for computer science coursework. Under cross-examination, then-Supervisory Special Agent Brett Leatherman admitted under oath that the FBI possessed zero evidence of dark web activity, client software downloads, or monitoring disruption. Despite this admission under oath, Magistrate Judge Kimberly Johnson revoked bond, subjecting Rockenhaus to three years of extrajudicial pre trial detention on a display driver.

This Texas prosecution set off a catastrophic pipeline of state-created lethal harm. On September 4th, 2025, a unit of the USMS (U.S. Marshals Service) executed a violent, warrantless raid on Conrad wife’s (Adrienne Rockenhaus’s) safe house, beating Conrad Rockenhaus in the driveway and inflicting a severe Traumatic Brain Injury (TBI).

Rather than receiving emergency neurological treatment, Conrad Rockenhaus was transferred to FCI Milan, where he was subjected to solitary confinement, medical neglect, physical beatings, and chemical torture. This unbroken sequence of events culminated in a fatal April 2026 fire and the subsequent homicide of Conrad Rockenhaus.

The public callout of FBI Cyber Agent, Brett Leatherman, by ShinyHunters brings the 2020 Plano paper trail full circle, connecting the genesis of a fatal prosecution to the largest cybersecurity failure in recent Bureau history.