# ShinyHunters Claims FBI Breach via Unpatched Oracle PeopleSoft Zero-Day, Threatens 2-3TB of PII/PHI Leak

> Extortion collective ShinyHunters (Scattered Lapsus$ Hunters) claims it used a new, unpatched Oracle PeopleSoft zero-day to gain remote code execution on the FBI's apply.fbijobs.gov portal, pivot into FBI-managed AWS GovCloud infrastructure, and steal 2-3TB of PII/PHI on FBI employees, agents, and job applicants. The group defaced the portal, released a ~5,000-record sample independently spot-checked as partly accurate by 404 Media, and is demanding the FBI retract a May 2026 FLASH bulletin rather than paying a ransom; the FBI confirms it is investigating but has not confirmed a breach.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-27T02:35:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2620
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-shinyhunters-peoplesoft-zero-day-tl-2026-2620.webp?v=35d81586 (Threadlinqs threat intel: ShinyHunters PeopleSoft Zero-Day Breach: Detection & IOCs (TL-2026-2620) — Critical severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2620
- **Severity:** CRITICAL
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)
- **CVEs:** CVE-2025-61882

## Description

On the night of Monday, September 21, 2026, the extortion collective ShinyHunters (operating as part of the loosely affiliated "Scattered Lapsus$ Hunters" / "The Com" cluster) told BleepingComputer and 404 Media it had exploited a previously unknown, unpatched remote-code-execution zero-day in Oracle PeopleSoft to compromise the FBI's public-facing Special Agent Applicant Portal (apply.fbijobs.gov). The group claims it used the initial foothold to move laterally into FBI-managed Amazon Web Services GovCloud infrastructure and exfiltrate 2-3TB of data spanning FBI Criminal Justice Information Services records, HR files, the FBI's Medlink medical/employee-health service, and job-applicant records covering current and former employees and prospective Special Agents.

ShinyHunters briefly defaced apply.fbijobs.gov with its trademark Umbreon (Pokemon) logo and a "seized by ShinyHunters" banner before the FBI took the portal offline. As proof, the group gave 404 Media a sample of roughly 5,000 purported employee records containing names, home addresses, phone numbers, and family-member details; 404 Media cross-referenced a subset of the phone numbers against OSINT tooling and found some corresponded to real individuals, including numbers associated with U.S. Department of Justice personnel. Neither the FBI, Oracle, nor AWS has confirmed a breach, a zero-day, or data theft; the FBI's only statement is that it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating." No CVE has been assigned and no proof-of-concept or technical indicators for the underlying PeopleSoft flaw have been published.

Unusually for the group, ShinyHunters states the attack is "not financially motivated" and that it is not seeking a ransom but rather "coercion": it is demanding the FBI, addressed to Director Kash Patel and Cyber Division Assistant Director Brett Leatherman, retract or correct a May 15, 2026 FBI FLASH/PSA bulletin that named ShinyHunters and Scattered Spider (tracked by Google as UNC6040/UNC6395) for a Salesforce data-theft extortion campaign and accused the group of harassment tactics including swatting and threats against victims' families. ShinyHunters also claims it is now exploiting the same new PeopleSoft zero-day against other, unnamed Fortune 500 organizations.

The incident sits inside an active feud between ShinyHunters and the Cl0p ransomware gang over ownership of a separate, already-patched Oracle flaw: CVE-2025-61882, an unauthenticated RCE in the BI Publisher Integration of Oracle E-Business Suite's Concurrent Processing component that Cl0p exploited as a zero-day from August 2025 before an October 2025 patch. Scattered Lapsus$ Hunters (including ShinyHunters) subsequently leaked the exploit and partial Oracle source code, asserting Cl0p had obtained "their" exploit without authorization. Days before the FBI claims, on September 19, 2026, ShinyHunters hijacked Cl0p's own dark-web leak site via an unauthenticated file-upload vulnerability in its Grav CMS, demanding an eight-figure cut of Cl0p's EBS extortion proceeds. ShinyHunters says it exfiltrated the leak site's source code, Grav CMS plugins, and server logs, and -- most significantly -- the private keys for Cl0p's Tor (.onion) hidden service, which it claims would let it operate Cl0p's dark-web leak address independently. ShinyHunters is also the actor Google Threat Intelligence Group/Mandiant track as UNC6240, which exploited a different, since-patched Oracle PeopleSoft PeopleTools RCE (CVE-2026-35273, patched out-of-band by Oracle on June 10, 2026) as a zero-day against more than 100 organizations, predominantly in education, in mid-2026 -- establishing a clear pattern of the group weaponizing unauthenticated Oracle enterprise-application RCEs as zero-days ahead of vendor disclosure. The zero-day claimed in this FBI incident is presented by ShinyHunters as a newly found, still-unpatched flaw distinct from CVE-2026-35273.

The CVE-2026-35273 campaign gives the clearest public technical picture of how UNC6240/ShinyHunters operates once inside a PeopleSoft environment, and is the closest available proxy for the mechanics of the still-undisclosed FBI zero-day. Per Rapid7 and Arctic Wolf incident-response telemetry, the actor exploited an unauthenticated SSRF-to-RCE chain via the /PSEMHUB/hub and /PSIGW/HttpListeningConnector Integration Gateway endpoints, using the SSRF to force outbound SMB connections capable of capturing Windows NetNTLM hashes; deployed MeshCentral remote-access agents disguised as Microsoft Azure binaries (e.g. meshagent64-azure-ops.exe) that beaconed to a C2 domain, azurenetfiles.net, masquerading as Azure over WSS/443; dropped .jsp web shells and XMLDecoder-based persistence under compromised PeopleSoft webserv/PSEMHUB.war paths; extracted credentials directly from PeopleSoft's psappsrv.cfg application-server configuration files; ran credential-spraying scripts and remote-system discovery to map web/app/batch server tiers for lateral movement; staged stolen data with zstd compression prior to exfiltration; and left a README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT marker on compromised hosts before publishing victim data to its leak site. This same actor's demonstrated, PeopleSoft-specific tradecraft is the basis for the additional ATT&CK techniques mapped below, since no independent technical telemetry has yet been published for the FBI-specific zero-day itself.

The claimed FBI compromise is also the latest in a string of 2026 FBI-adjacent incidents: in March 2026 the FBI disclosed a separate, unrelated "major incident" breach of its Digital Collection System Network (DCSNet) wiretap/surveillance infrastructure -- suspected to be Chinese state-sponsored and reportedly reached via a compromised ISP vendor -- and the Iran-linked "Handala" group separately compromised FBI Director Kash Patel's personal Gmail account and published stolen emails and photos. Those incidents are unrelated to ShinyHunters and are noted here only as target-profile context.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1491.002 External Defacement
- T1187 Forced Authentication
- T1552.001 Credentials In Files
- T1110.003 Password Spraying
- T1552.004 Private Keys
- T1018 Remote System Discovery
- T1505.003 Web Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1560 Archive Collected Data

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PeopleSoft Post-Exploitation: PSEMHUB.war Web Shell Drop, psappsrv.cfg Credential Access, and Azure-Masquerading MeshCentral Agent** (`TL-2026-2620-SPL-002`)

Detects ShinyHunters/UNC6240 post-exploitation tradecraft against compromised PeopleSoft hosts: unexpected .jsp file creation under the PSEMHUB.war deployment path, unusual process access to the psappsrv.cfg application-server configuration file (credential extraction), execution of meshagent64-azure-ops.exe (a MeshCentral remote-access agent masquerading as a Microsoft Azure binary), and drop of the actor's README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT marker file.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1505.003, T1552.001, T1036.005, T1110.003
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint, edr_file_events, edr_process_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","sysmon","WinEventLog:Security") (EventCode=11 OR EventCode=1)
( (EventCode=11 AND TargetFilename="*webserv*applications*peoplesoft*PSEMHUB.war*" AND TargetFilename="*.jsp")
  OR (EventCode=11 AND TargetFilename="*README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT*")
  OR (EventCode=1 AND (Image="*meshagent64*azure*" OR OriginalFileName="meshagent64.exe" AND Image!="*\\Program Files\\MeshAgent\\*"))
  OR (EventCode=11 AND TargetFilename="*psappsrv.cfg" AND Image!="*\\psadmin.exe" AND Image!="*\\pscfg.exe")
)
| eval detection_reason=case(
    match(TargetFilename,"(?i)PSEMHUB\.war.*\.jsp"), "webshell_drop_psemhub",
    match(TargetFilename,"(?i)README-IF-YOU-SEE-THIS"), "shinyhunters_marker_file",
    match(Image,"(?i)meshagent64.*azure"), "meshcentral_azure_masquerade",
    match(TargetFilename,"(?i)psappsrv\.cfg"), "psappsrv_cfg_unusual_access",
    true(), "other")
| stats count min(_time) as first_seen max(_time) as last_seen values(detection_reason) as reasons values(TargetFilename) as files values(Image) as images values(Hashes) as hashes by ComputerName, User
| sort -count
```

### Microsoft KQL

```kql
let SuspiciousImages = dynamic(["meshagent64-azure-ops.exe"]);
let KnownHash = "f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc";
union
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "PSEMHUB.war" and FileName endswith ".jsp"
| extend Reason = "webshell_drop_psemhub"),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT"
| extend Reason = "shinyhunters_marker_file"),
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (SuspiciousImages) or SHA256 == KnownHash or (ProcessCommandLine has "meshagent" and ProcessCommandLine has "azure")
| extend Reason = "meshcentral_azure_masquerade"),
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "psappsrv.cfg" and ActionType in ("FileAccessed", "FileOpened")
| where InitiatingProcessFileName !in ("psadmin.exe", "pscfg.exe")
| extend Reason = "psappsrv_cfg_unusual_access")
| summarize EventCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Reasons = make_set(Reason), Files = make_set(FileName) by DeviceName
| sort by EventCount desc
```

### Sigma

```yaml
title: PeopleSoft Post-Exploitation Web Shell, Config Credential Theft, and MeshCentral Azure Masquerade
id: 3d9e5c71-4a8f-4c2b-b5e0-1f7a9d3c6e42
status: experimental
description: Detects UNC6240/ShinyHunters post-exploitation activity on compromised Oracle PeopleSoft hosts - .jsp web shell drop under PSEMHUB.war, credential-file access on psappsrv.cfg, execution of a MeshCentral agent masquerading as an Azure binary (meshagent64-azure-ops.exe), and the actor's README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT marker.
references:
    - https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/
    - https://arcticwolf.com/resources/blog/critical-oracle-peoplesoft-vulnerability-actively-exploited-in-shinyhunters-campaign/
author: Threadlinqs Team
date: 2026-09-22
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.credential-access
    - attack.t1552.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.meshcentral
    - cve.2026.35273
    - attack.group.shinyhunters
    - attack.group.unc6240
logsource:
    category: file_event
    product: windows
detection:
    selection_webshell:
        TargetFilename|contains: 'PSEMHUB.war'
        TargetFilename|endswith: '.jsp'
    selection_marker:
        TargetFilename|endswith: 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT'
    selection_meshagent:
        Image|contains: 'meshagent64'
        Image|contains: 'azure'
    selection_cfg_access:
        TargetFilename|endswith: 'psappsrv.cfg'
    filter_admin_tools:
        Image|endswith:
            - '\psadmin.exe'
            - '\pscfg.exe'
    condition: (selection_webshell or selection_marker or selection_meshagent or selection_cfg_access) and not filter_admin_tools
falsepositives:
    - Legitimate PeopleSoft administrators reading psappsrv.cfg via psadmin.exe or pscfg.exe
    - Legitimate deployment of application .jsp files during a scheduled PeopleSoft patch window
level: critical
```

**Known false positives:**

- Scheduled PeopleSoft patch/deployment windows that legitimately write .jsp files under webserv paths
- PeopleSoft administrators reading psappsrv.cfg through approved admin tooling (psadmin.exe, pscfg.exe)

**Tuning notes:** Maintain an allowlist of the PeopleSoft deployment/build service accounts and change-window IDs that are permitted to write into PSEMHUB.war; alert immediately (no threshold) on any hash match against f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc since that binary has no legitimate purpose in this environment. Pair with a Windows Security 4625/4648 password-spray correlation (T1110.003) against PeopleSoft service accounts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Oracle PeopleSoft Integration Gateway SSRF-to-RCE Exploitation Attempt (KQL Primary) (locked: unlock with TL Creds)
- PeopleSoft Post-Exploitation: Web Shell, Config Credential Access, and Azure-Masquerading MeshCentral Agent (Sentinel Primary) (locked: unlock with TL Creds)
- PeopleSoft-to-Cloud C2 Beaconing and AWS GovCloud Lateral Movement / Bulk Exfiltration (Sentinel Primary) (locked: unlock with TL Creds)
- Sigma: PeopleSoft Integration Gateway SSRF-to-RCE Exploitation and Forced SMB Authentication (locked: unlock with TL Creds)
- Sigma: PeopleSoft Web Shell, Credential-File Access, and Azure-Masquerading MeshCentral Agent (locked: unlock with TL Creds)
- Sigma: C2 Beaconing to [indicator] / UNC6240 Staging Infrastructure and Remote System Discovery (locked: unlock with TL Creds)
- Oracle PeopleSoft Integration Gateway SSRF-to-RCE Exploitation Attempt (PSEMHUB/PSIGW) (locked: unlock with TL Creds)
- PeopleSoft-to-Cloud C2 Beaconing ([indicator]) and AWS GovCloud Lateral Movement / Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `142.11.200[.]186`
- Domain: `fbijobs[.]gov`
- File hash: `f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach](https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/)
- ['We Hacked the FBI:' Hackers Say They Have Data on All FBI Employees](https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/)
- [Hacking group ShinyHunters claims it breached the FBI, stole agents' and applicants' data](https://techcrunch.com/2026/09/22/hacking-group-shinyhunters-claims-it-breached-the-fbi-stole-agents-and-applicants-data/)
- [ShinyHunters claims FBI hack: 'This is NOT financially motivated'](https://www.theregister.com/security/2026/09/22/shinyhunters-claims-fbi-hack-this-is-not-financially-motivated/5298385)
- [ShinyHunters claims FBI data theft, demands bureau retract cyber warning](https://www.nextgov.com/cybersecurity/2026/09/shinyhunters-claims-fbi-data-theft-demands-bureau-retract-cyber-warning/416144/)
- [ShinyHunters escalates dispute with FBI; claims to have seized job applicants' site and acquired data](https://databreaches.net/2026/09/22/shinyhunters-escalates-dispute-with-fbi-claims-to-have-seized-job-applicants-site-and-acquired-data/)
- [ShinyHunters](https://en.wikipedia.org/wiki/ShinyHunters)
- [Oracle E-Business Suite Zero-Day Vulnerability (CVE-2025-61882)](https://www.esentire.com/security-advisories/oracle-e-business-suite-zero-day-vulnerability-cve-2025-61882)
- [Active Exploitation of Oracle PeopleSoft Zero-Day (CVE-2026-35273)](https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/)
- [Oracle Security Alert Advisory - CVE-2026-35273](https://www.oracle.com/security-alerts/alert-cve-2026-35273.html)
- [Critical Oracle PeopleSoft Vulnerability Actively Exploited in ShinyHunters Campaign](https://arcticwolf.com/resources/blog/critical-oracle-peoplesoft-vulnerability-actively-exploited-in-shinyhunters-campaign/)
- [FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms](https://therecord.media/fbi-warns-scattered-spider-salesforce)
- [ShinyHunters hacks Clop leak site, threatens to extort ransomware gang](https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/)
- [Iran-linked hackers breach FBI Director Kash Patel's personal email, publish excerpts online](https://www.cnbc.com/2026/03/27/iran-hackers-fbi-director-kash-patel.html)
- [FBI investigating hack on its wiretap and surveillance systems, report says](https://techcrunch.com/2026/03/05/fbi-investigating-hack-on-its-wiretap-and-surveillance-systems-report)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2620