Skip to navigation

Threat reportData BreachTL-2026-2760

ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing Agent and Applicant Personal Data

highACTIVE

ShinyHunters claims it defaced fbijobs.gov and stole 2-3 TB of HR data covering nearly every FBI agent and FBI job applicant, and demanded the FBI retract its May 2026 PSA on the group. The FBI confirms it is investigating claims of unauthorized activity affecting FBIjobs.gov but has not confirmed the breach or its scope.

Key facts

IdentifiersTL-2026-2760
Also known asFBIjobs.gov breach, FBI Jobs portal defacement
SeverityHIGH
Affected productsFBI FBIjobs.gov recruitment portal and associated HR systems (claimed: CJ, HR, Medlink, PEGA, PHIRE); Oracle PeopleSoft Enterprise PeopleTools (claimed unnamed zero-day; related CVE-2026-35273)
AttributionShinyHunters (high confidence)
ToolsMeshCentral
MITRE ATT&CK techniquesT1018 Remote System Discovery, T1021.004 SSH, T1027 Obfuscated Files or Information, T1036 Masquerading, T1036.005 Match Legitimate Resource Name or Location, T1048 Exfiltration Over Alternative Protocol, T1059.003 Command and Scripting Interpreter: Windows Command Shell, T1059.004 Unix Shell, T1071.001 Web Protocols, T1078 Valid Accounts, T1078.004 Cloud Accounts, T1090 Proxy and 14 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment administration, police - law enforcement, human-resources, education
Target regionsNorth America
Detection rules9 (1 shown free)
Sources14 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2760 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MeshCentral Agent Execution or Drop (azure-ops Masquerade) — Post-Exploitation

Detects creation or execution of the MeshCentral agent binaries used by ShinyHunters for persistence and remote access in the PeopleSoft campaign: meshagent32-azure-ops.exe, meshagent64-azure-ops.exe and meshagent64-v2.exe, whose 'azure-ops' suffix masquerades as a Microsoft Azure utility. Also matches the five campaign SHA-256 hashes. The FBI incident itself is unconfirmed; this behavior is documented for the related CVE-2026-35273 intrusions.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1219, T1036.005
  • Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, DeviceFileEvents, process_creation
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11) earliest=-24h
  (Image="*meshagent*.exe" OR TargetFilename="*meshagent*.exe" OR Image="*-azure-ops.exe" OR TargetFilename="*-azure-ops.exe"
   OR Hashes="*2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35*"
   OR Hashes="*f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc*"
   OR Hashes="*d83fdb8533c0ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f*"
   OR Hashes="*c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f*"
   OR Hashes="*68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309*")
| eval artifact=coalesce(Image, TargetFilename)
| eval activity=if(EventCode=1, "process_created", "file_created")
| eval masquerade=if(match(artifact, "(?i)azure-ops[.]exe$"), "azure-named-mesh-agent", "meshcentral-agent")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentImage) as parent values(User) as user by host, artifact, activity, masquerade
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")

Microsoft KQL

let meshHashes = dynamic(['2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35', 'f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc', 'd83fdb8533c0ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f', 'c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f', '68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309']);
let meshName = @'(?i)^meshagent.*[.]exe$|azure-ops[.]exe$';
union isfuzzy=true
  (DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName matches regex meshName or SHA256 in (meshHashes)
    | project Timestamp, DeviceName, Activity = 'ProcessCreated', FileName, FolderPath, CommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName, Account = AccountName, SHA256),
  (DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName matches regex meshName or SHA256 in (meshHashes)
    | project Timestamp, DeviceName, Activity = ActionType, FileName, FolderPath, CommandLine = InitiatingProcessCommandLine, ParentProcess = InitiatingProcessFileName, Account = InitiatingProcessAccountName, SHA256)
| order by Timestamp desc

Sigma

title: MeshCentral Agent With Azure-Ops Masquerade Name or Known ShinyHunters Hash
id: a94b7d10-5c3e-4e82-b6f1-0d2c8e5a7b64
status: experimental
description: Detects execution of MeshCentral agent binaries named meshagent32-azure-ops.exe, meshagent64-azure-ops.exe or meshagent64-v2.exe, any executable ending in -azure-ops.exe, or a Sysmon SHA-256 matching the ShinyHunters/UNC6240 PeopleSoft campaign samples. MeshCentral is used for persistence and remote access.
references:
  - https://www.hivepro.com/threat-advisory/oracle-peoplesoft-under-siege-zero-day-cve-2026-35273-fuels-shinyhunters-intrusions
  - https://labs.cloudsecurityalliance.org/research/csa-research-note-oracle-peoplesoft-zero-day-20260630-csa-st/
author: Threadlinqs Team
date: 2026/09/28
tags:
  - attack.command-and-control
  - attack.t1219
  - attack.defense-evasion
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_masq:
    Image|endswith:
      - 'meshagent32-azure-ops.exe'
      - 'meshagent64-azure-ops.exe'
      - 'meshagent64-v2.exe'
      - '-azure-ops.exe'
  selection_mesh_name:
    Image|contains: 'meshagent'
  selection_exe:
    Image|endswith: '.exe'
  selection_hash:
    Hashes|contains:
      - '2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35'
      - 'f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc'
      - 'd83fdb8533c0ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f'
      - 'c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f'
      - '68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309'
  condition: selection_masq or selection_hash or (selection_mesh_name and selection_exe)
falsepositives:
  - Legitimate MeshCentral deployments managed by the IT or MSP team
level: high

Known false positives:

  • Sanctioned MeshCentral deployments run by an internal IT team or MSP use the same meshagent*.exe naming
  • Software inventory tooling that copies agent installers to a staging share

Tuning notes: Allowlist the MeshCentral server URL/agent hashes your IT team deploys, and match on the 'azure-ops' suffix and the five campaign hashes as high-confidence signals. Legitimate Microsoft Azure tooling is never named '*-azure-ops.exe'. Extend the file path to Linux agents (meshagent) if PeopleSoft runs on Linux.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • PeopleSoft Java/WebLogic Process Spawning Shell or Download Tool — Exploitation · unlock with TL Creds
  • ShinyHunters Fanout SSH Script and Extortion Marker File — Post-Exploitation · unlock with TL Creds
  • SSH Password Spray Across Multiple Hosts From a Single Source — Lateral Movement · unlock with TL Creds
  • AWS CloudTrail Activity From ShinyHunters-Associated IPs (GovCloud Access) — Cloud Account Access · unlock with TL Creds
  • Archive or Database Export of PeopleSoft Data on Linux — Collection and Staging · unlock with TL Creds
  • Web Content Defacement — Index Page Written to Web Root by Unexpected Process (ShinyHunters 'Seized' Banner) · unlock with TL Creds
  • PeopleSoft PSEMHUB / PSIGW Endpoint Access From External Source — Exploitation · unlock with TL Creds
  • Connections or DNS Lookups to ShinyHunters Infrastructure ([indicator], AS54290 Range) — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 45 indicators of compromise for TL-2026-2760.

Sample indicators (3 of 45)

  • IP address: 142.11.200[.]186
  • Domain: fbijobs[.]gov
  • File hash: 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35

Defanged, TLP:CLEAR. Full set of 45 indicators: unlock with TL Creds.

45 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

On or about 21-22 September 2026 the ShinyHunters extortion brand defaced the FBI's recruitment portal fbijobs.gov, replacing agency imagery with a Pokemon mascot and a 'This site has been seized by ShinyHunters' banner; the portal later showed a scheduled-maintenance message and was still unavailable on 25 September. Around 22-23 September the group posted on its dark-web site claiming to hold data on 'almost ALL FBI Agents and individuals who filed an application', naming affected systems as Criminal Justice (CJ), HR, Medlink, PEGA, PHIRE and FBIJOBS, with a claimed volume of 2-3 TB. The group provided roughly 5,000 records to journalists (including 404 Media and Reuters). The sample reportedly contained names, home addresses, phone numbers, Social Security numbers, duty assignments, job classifications (special agents, intelligence analysts, attorneys, student trainees) and in some cases names of spouses, siblings and other family members. Reuters partially verified the sample against credit-bureau records (at least 10 matches, including the FBI Director) but could not confirm the data came from FBI systems.

The group says the operation was 'not financially motivated'. Its stated goal is retaliation for FBI Private Industry/Public Service Announcement PSA260515 (15 May 2026), which described ShinyHunters' harassment, swatting threats and exaggerated-access extortion tactics, linked the group's activity to attacks on the Canvas LMS (Instructure), and advised victims not to pay. ShinyHunters called the PSA 'substantial false allegations' and 'disinformation', denied ties to 'The Com' and Scattered Spider, and threatened to publish the full dataset unless the FBI retracted or amended the notice by a deadline reported as one week from the incident (Monday 28 September per CyberScoop).

Initial access is claimed, not confirmed: the group asserts a previously unknown Oracle PeopleSoft zero-day used for remote code execution, followed by access to servers in AWS GovCloud. No CVE has been assigned to the alleged flaw and Oracle has not confirmed it. Context: ShinyHunters (tracked by Google as UNC6240) exploited a different PeopleSoft PeopleTools flaw, CVE-2026-35273 (unauthenticated SSRF-to-RCE via PSEMHUB/PSIGW, CVSS 9.8, PeopleTools 8.61/8.62), as a zero-day from 27 May to 9 June 2026 against 100+ organizations, mostly universities; Oracle patched it out-of-band on 10 June 2026. Public reporting calls the FBI vector 'similar' but does not tie it to that CVE, so it is NOT listed in this record's cve_list. The FBI said the point of breach (third party vs. FBI enterprise) is still undetermined. The Hacker News additionally reports claims of sensitive medical data (diagnoses, prescriptions) via the Medlink system; this is unverified. Post-exploitation ATT&CK mappings beyond initial access, defacement and data collection (MeshCentral persistence, SSH credential spraying via a fanout script, Azure-name masquerading, archive-and-exfiltrate) are taken from the documented CVE-2026-35273 ShinyHunters campaign (HivePro, CSA) and are NOT confirmed for the FBI incident. Risks to those exposed include counterintelligence targeting, doxxing, harassment/swatting and physical-safety threats to agents and their families.

MITRE ATT&CK techniques by tactic:

Discovery

T1018 Remote System Discovery

Lateral Movement

T1021.004 SSH

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566.004 Phishing: Spearphishing Voice

Credential Access

T1110.003 Password Spraying; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage; T1560.001 Archive via Utility

Impact

T1491.002 External Defacement

Persistence

T1505.003 Server Software Component: Web Shell

Remediation

Patches

  • Apply Oracle out-of-band update CPU187 (10 June 2026) for CVE-2026-35273 on PeopleTools 8.61/8.62; no patch exists for the unconfirmed FBI-claimed zero-day

Immediate actions

  • Treat FBI-affiliated personnel and applicants as exposed: monitor for credential-stuffing, phishing and vishing built on leaked PII
  • Restrict external access to PeopleSoft Environment Management Hub (/PSEMHUB/*) and PSIGW (/PSIGW/HttpListeningConnector) endpoints
  • Hunt PeopleSoft/WebLogic hosts for MeshCentral agents (meshagent*-azure-ops.exe) and README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT marker files
  • Do not pay or negotiate extortion demands; follow FBI PSA260515 guidance and report to IC3

Workarounds

  • Block internet exposure of PeopleSoft integration gateway and Environment Management endpoints
  • Rotate credentials and SSH keys reachable from PeopleSoft hosts

Longer-term hardening

  • Segment HR/recruitment platforms from enterprise networks and cloud tenants
  • Minimize retention of applicant and family PII; enforce field-level encryption and access logging
  • Monitor for swatting/doxxing risk to exposed personnel and brief them on impersonation and social-engineering attempts

Affected and fixed versions

  • FBI — FBIjobs.gov recruitment portal and associated HR systems (claimed: CJ, HR, Medlink, PEGA, PHIRE)
    Vulnerable versions: Unconfirmed
  • Oracle — PeopleSoft Enterprise PeopleTools (claimed unnamed zero-day; related CVE-2026-35273)
    Vulnerable versions: 8.61; 8.62 (CVE-2026-35273 only)
    Fixed in: CPU187 (10 June 2026) for CVE-2026-35273

Timeline

Last updated · 2 updates · revalidated 2× · latest source

  • FBI publishes PSA260515 describing ShinyHunters' Canvas/Instructure-related extortion, harassment and swatting tactics and urging victims not to pay
  • ShinyHunters (UNC6240) begins exploiting PeopleSoft zero-day CVE-2026-35273 against 100+ organizations, mostly universities (related campaign; not confirmed as the FBI vector)
  • Exploitation window of CVE-2026-35273 closes (27 May-9 June) as ShinyHunters/UNC6240 activity against PeopleSoft hosts is disclosed
  • Oracle releases out-of-band emergency update CPU187 for CVE-2026-35273 after a 14-day exploitation window
  • Dutch police arrest a 24-year-old Amsterdam man, reported as Pepijn van der Stap ('Umbreon'), suspected ShinyHunters leader; Rotterdam court orders pre-trial detention.
  • Alleged intrusion into FBI systems on Monday night, per ShinyHunters claims reported by Nextgov
  • locked-ioc-22 defaced with Pokemon mascot and 'This site has been seized by ShinyHunters' banner; portal later shows maintenance message
  • Reuters partially verifies sample against credit-bureau records (10+ matches incl. FBI Director) but cannot confirm data originated from FBI systems
  • ShinyHunters posts claim on its dark-web site (2-3 TB, nearly all FBI agents and applicants) and shares ~5,000 records with journalists; FBI confirms it is investigating
  • locked-ioc-22 remains unavailable; group says 'we got what we wanted'
  • Google Mandiant/GTIG warns of renewed ShinyHunters mass exploitation of PeopleSoft CVE-2026-35273 using the /%50SEMHUB/ percent-encoded WAF bypass, with JSP web shells deployed.
  • ABC News reports the FBI told employees to assume their personal data was compromised; ShinyHunters tells 404 Media it will not publish the data (analysts warn it could still sell it).
  • Saif al-Din Khader ('Rey') is detained in Jordan and is reportedly cooperating with the FBI (sources give dates between 28 Sept and 3 Oct).
  • Monday deadline for FBI to retract or amend PSA260515 or face publication of the full dataset; FBI says it is 'actively and aggressively investigating'
  • FBI Cyber Division posts a video warning it will aggressively pursue ShinyHunters, citing a recent Dutch arrest of an alleged affiliate, which the group denies.
  • FBI acknowledges a cyber incident involving locked-ioc-22 and says it is contacting potentially affected people (per NPR via Hive Security).
  • FBI states the locked-ioc-22 breach resulted from a contractor (reported as Accenture) failing to apply an issued security patch to the PeopleSoft platform; the contractor is removed.
  • Edward Dubrovsky, a Canadian cybersecurity executive and ransom negotiator, is arrested in Pennsylvania on extortion-conspiracy and interference-with-commerce charges tied to ShinyHunters.
  • FBI Director Kash Patel announces the arrest; FBI urges remaining ShinyHunters members to come forward. FBI says the group breached 140+ organizations and extorted at least $70M.

Update history

Sources cited

More from ShinyHunters

Previous and next in data breach

Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats