# ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing Agent and Applicant Personal Data

> ShinyHunters claims it defaced fbijobs.gov and stole 2-3 TB of HR data covering nearly every FBI agent and FBI job applicant, and demanded the FBI retract its May 2026 PSA on the group. The FBI confirms it is investigating claims of unauthorized activity affecting FBIjobs.gov but has not confirmed the breach or its scope.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-11-12T02:19:56.774Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2760
- **ID:** TL-2026-2760
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 (1 shown free below) · **IOCs:** 45 (3 shown free below)

## Description

On or about 21-22 September 2026 the ShinyHunters extortion brand defaced the FBI's recruitment portal fbijobs.gov, replacing agency imagery with a Pokemon mascot and a 'This site has been seized by ShinyHunters' banner; the portal later showed a scheduled-maintenance message and was still unavailable on 25 September. Around 22-23 September the group posted on its dark-web site claiming to hold data on 'almost ALL FBI Agents and individuals who filed an application', naming affected systems as Criminal Justice (CJ), HR, Medlink, PEGA, PHIRE and FBIJOBS, with a claimed volume of 2-3 TB. The group provided roughly 5,000 records to journalists (including 404 Media and Reuters). The sample reportedly contained names, home addresses, phone numbers, Social Security numbers, duty assignments, job classifications (special agents, intelligence analysts, attorneys, student trainees) and in some cases names of spouses, siblings and other family members. Reuters partially verified the sample against credit-bureau records (at least 10 matches, including the FBI Director) but could not confirm the data came from FBI systems.

The group says the operation was 'not financially motivated'. Its stated goal is retaliation for FBI Private Industry/Public Service Announcement PSA260515 (15 May 2026), which described ShinyHunters' harassment, swatting threats and exaggerated-access extortion tactics, linked the group's activity to attacks on the Canvas LMS (Instructure), and advised victims not to pay. ShinyHunters called the PSA 'substantial false allegations' and 'disinformation', denied ties to 'The Com' and Scattered Spider, and threatened to publish the full dataset unless the FBI retracted or amended the notice by a deadline reported as one week from the incident (Monday 28 September per CyberScoop).

Initial access is claimed, not confirmed: the group asserts a previously unknown Oracle PeopleSoft zero-day used for remote code execution, followed by access to servers in AWS GovCloud. No CVE has been assigned to the alleged flaw and Oracle has not confirmed it. Context: ShinyHunters (tracked by Google as UNC6240) exploited a different PeopleSoft PeopleTools flaw, CVE-2026-35273 (unauthenticated SSRF-to-RCE via PSEMHUB/PSIGW, CVSS 9.8, PeopleTools 8.61/8.62), as a zero-day from 27 May to 9 June 2026 against 100+ organizations, mostly universities; Oracle patched it out-of-band on 10 June 2026. Public reporting calls the FBI vector 'similar' but does not tie it to that CVE, so it is NOT listed in this record's cve_list. The FBI said the point of breach (third party vs. FBI enterprise) is still undetermined. The Hacker News additionally reports claims of sensitive medical data (diagnoses, prescriptions) via the Medlink system; this is unverified. Post-exploitation ATT&CK mappings beyond initial access, defacement and data collection (MeshCentral persistence, SSH credential spraying via a fanout script, Azure-name masquerading, archive-and-exfiltrate) are taken from the documented CVE-2026-35273 ShinyHunters campaign (HivePro, CSA) and are NOT confirmed for the FBI incident. Risks to those exposed include counterintelligence targeting, doxxing, harassment/swatting and physical-safety threats to agents and their families.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.004 Cloud Accounts
- T1059.004 Unix Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1110.003 Password Spraying
- T1018 Remote System Discovery
- T1021.004 SSH
- T1213 Data from Information Repositories
- T1560.001 Archive via Utility
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1048 Exfiltration Over Alternative Protocol
- T1491.002 External Defacement
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1566.004 Phishing: Spearphishing Voice
- T1505.003 Server Software Component: Web Shell
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1528 Steal Application Access Token
- T1572 Protocol Tunneling
- T1530 Data from Cloud Storage
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1090 Proxy
- T1552.001 Unsecured Credentials: Credentials In Files
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MeshCentral Agent Execution or Drop (azure-ops Masquerade) — Post-Exploitation** (`TL-2026-2760-SPL-002`)

Detects creation or execution of the MeshCentral agent binaries used by ShinyHunters for persistence and remote access in the PeopleSoft campaign: meshagent32-azure-ops.exe, meshagent64-azure-ops.exe and meshagent64-v2.exe, whose 'azure-ops' suffix masquerades as a Microsoft Azure utility. Also matches the five campaign SHA-256 hashes. The FBI incident itself is unconfirmed; this behavior is documented for the related CVE-2026-35273 intrusions.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1219, T1036.005
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents, DeviceFileEvents, process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11) earliest=-24h
  (Image="*meshagent*.exe" OR TargetFilename="*meshagent*.exe" OR Image="*-azure-ops.exe" OR TargetFilename="*-azure-ops.exe"
   OR Hashes="*2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35*"
   OR Hashes="*f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc*"
   OR Hashes="*d83fdb8533c0ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f*"
   OR Hashes="*c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f*"
   OR Hashes="*68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309*")
| eval artifact=coalesce(Image, TargetFilename)
| eval activity=if(EventCode=1, "process_created", "file_created")
| eval masquerade=if(match(artifact, "(?i)azure-ops[.]exe$"), "azure-named-mesh-agent", "meshcentral-agent")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentImage) as parent values(User) as user by host, artifact, activity, masquerade
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
```

### Microsoft KQL

```kql
let meshHashes = dynamic(['2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35', 'f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc', 'd83fdb8533c0ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f', 'c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f', '68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309']);
let meshName = @'(?i)^meshagent.*[.]exe$|azure-ops[.]exe$';
union isfuzzy=true
  (DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName matches regex meshName or SHA256 in (meshHashes)
    | project Timestamp, DeviceName, Activity = 'ProcessCreated', FileName, FolderPath, CommandLine = ProcessCommandLine, ParentProcess = InitiatingProcessFileName, Account = AccountName, SHA256),
  (DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName matches regex meshName or SHA256 in (meshHashes)
    | project Timestamp, DeviceName, Activity = ActionType, FileName, FolderPath, CommandLine = InitiatingProcessCommandLine, ParentProcess = InitiatingProcessFileName, Account = InitiatingProcessAccountName, SHA256)
| order by Timestamp desc
```

### Sigma

```yaml
title: MeshCentral Agent With Azure-Ops Masquerade Name or Known ShinyHunters Hash
id: a94b7d10-5c3e-4e82-b6f1-0d2c8e5a7b64
status: experimental
description: Detects execution of MeshCentral agent binaries named meshagent32-azure-ops.exe, meshagent64-azure-ops.exe or meshagent64-v2.exe, any executable ending in -azure-ops.exe, or a Sysmon SHA-256 matching the ShinyHunters/UNC6240 PeopleSoft campaign samples. MeshCentral is used for persistence and remote access.
references:
  - https://www.hivepro.com/threat-advisory/oracle-peoplesoft-under-siege-zero-day-cve-2026-35273-fuels-shinyhunters-intrusions
  - https://labs.cloudsecurityalliance.org/research/csa-research-note-oracle-peoplesoft-zero-day-20260630-csa-st/
author: Threadlinqs Team
date: 2026/09/28
tags:
  - attack.command-and-control
  - attack.t1219
  - attack.defense-evasion
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_masq:
    Image|endswith:
      - 'meshagent32-azure-ops.exe'
      - 'meshagent64-azure-ops.exe'
      - 'meshagent64-v2.exe'
      - '-azure-ops.exe'
  selection_mesh_name:
    Image|contains: 'meshagent'
  selection_exe:
    Image|endswith: '.exe'
  selection_hash:
    Hashes|contains:
      - '2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35'
      - 'f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc'
      - 'd83fdb8533c0ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f'
      - 'c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f'
      - '68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309'
  condition: selection_masq or selection_hash or (selection_mesh_name and selection_exe)
falsepositives:
  - Legitimate MeshCentral deployments managed by the IT or MSP team
level: high
```

**Known false positives:**

- Sanctioned MeshCentral deployments run by an internal IT team or MSP use the same meshagent*.exe naming
- Software inventory tooling that copies agent installers to a staging share

**Tuning notes:** Allowlist the MeshCentral server URL/agent hashes your IT team deploys, and match on the 'azure-ops' suffix and the five campaign hashes as high-confidence signals. Legitimate Microsoft Azure tooling is never named '*-azure-ops.exe'. Extend the file path to Linux agents (meshagent) if PeopleSoft runs on Linux.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PeopleSoft Java/WebLogic Process Spawning Shell or Download Tool — Exploitation (locked: unlock with TL Creds)
- ShinyHunters Fanout SSH Script and Extortion Marker File — Post-Exploitation (locked: unlock with TL Creds)
- SSH Password Spray Across Multiple Hosts From a Single Source — Lateral Movement (locked: unlock with TL Creds)
- AWS CloudTrail Activity From ShinyHunters-Associated IPs (GovCloud Access) — Cloud Account Access (locked: unlock with TL Creds)
- Archive or Database Export of PeopleSoft Data on Linux — Collection and Staging (locked: unlock with TL Creds)
- Web Content Defacement — Index Page Written to Web Root by Unexpected Process (ShinyHunters 'Seized' Banner) (locked: unlock with TL Creds)
- PeopleSoft PSEMHUB / PSIGW Endpoint Access From External Source — Exploitation (locked: unlock with TL Creds)
- Connections or DNS Lookups to ShinyHunters Infrastructure ([indicator], AS54290 Range) — C2 / Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 45)

Defanged, TLP:CLEAR.

- IP address: `142.11.200[.]186`
- Domain: `fbijobs[.]gov`
- File hash: `2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35`

Full set of 45 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ShinyHunters trades financial extortion for a reckless war of ego with the FBI](https://cyberscoop.com/fbi-data-breach-shinyhunters-agent-safety-risk/)
- [FBI investigating alleged ShinyHunters job site breach](https://therecord.media/fbi-investigating-alleged-shinyhunters-job-site-breach)
- [ShinyHunters claims FBI breach after alleged PeopleSoft zero-day attack](https://securityaffairs.com/?p=199612)
- [ShinyHunters claims FBI breach, says it exploited PeopleSoft zero-day](https://thehackernews.com/2026/09/shinyhunters-claims-fbi-breach-says-it.html)
- [ShinyHunters claims FBI data theft, demands bureau retract cyber warning](https://www.nextgov.com/cybersecurity/2026/09/shinyhunters-claims-fbi-data-theft-demands-bureau-retract-cyber-warning/416144/)
- [FBI hack: ShinyHunters countdown ticks down, claims 'we got what we wanted'](https://cybernews.com/news/shinyhunters-fbi-hack-five-day-deadline/)
- [ShinyHunters claims FBI systems hack, sensitive data on almost ALL FBI agents](https://cybernews.com/news/shinyhunters-claims-fbi-systems-hack-sensitive-data-on-almost-all-fbi-agents/)
- [Hackers Claim Breach Exposed 'Very Sensitive Data' on Nearly All FBI Agents, Job Applicants](https://www.officer.com/command-hq/technology/news/55407335/fbi-investigating-alleged-fbijobsgov-breach-claimed-by-shinyhunters-hackers)
- [FBI investigates after ShinyHunters hackers claim theft of agents' personal data](https://www.foxnews.com/politics/fbi-investigates-shinyhunters-hackers-claim-theft-agents-personal-data)
- [TechRadar: ShinyHunters say they stole 2TB of employee data, seeking an apology not money](https://www.techradar.com/pro/security/hackers-hit-the-fbi-shinyhunters-say-they-have-stolen-2tb-of-employee-data-but-the-attack-isnt-looking-for-money-just-an-apology)
- [FBI PSA260515: ShinyHunters extortion and harassment tactics (IC3)](https://www.ic3.gov/PSA/2026/PSA260515.pdf)
- [CVE-2026-35273 analysis (Horizon3.ai)](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-35273/)
- [CSA Research Note: Oracle PeopleSoft Zero-Day, ShinyHunters Breaches 100 Universities](https://labs.cloudsecurityalliance.org/research/csa-research-note-oracle-peoplesoft-zero-day-20260630-csa-st/)
- [Oracle PeopleSoft Under Siege: Zero-Day CVE-2026-35273 Fuels ShinyHunters Intrusions (HivePro)](https://www.hivepro.com/threat-advisory/oracle-peoplesoft-under-siege-zero-day-cve-2026-35273-fuels-shinyhunters-intrusions)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2760