Skip to content
Today
Sections

Security Widely confirmed14 publishers 3 min read Published Updated

ShinyHunters pins its claimed FBI breach on an unpatched PeopleSoft RCE

The extortion crew defaced apply.fbijobs.gov on September 22 and told reporters it got remote code execution from a new Oracle PeopleSoft flaw, the same one it says it is now using against Fortune 500 targets. No technical details are public.

The Watch · Security desk

Send a correction

What happened

  • Hackread saw apply.fbijobs.gov defaced on September 22, 2026 with a page reading "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS", the group's branding and a link to its dark web leak site.
  • ShinyHunters told BleepingComputer the initial access was remote code execution against Oracle PeopleSoft, followed by lateral movement into FBI-managed AWS GovCloud infrastructure.
  • The group claims it took between 2TB and 3TB covering current and former FBI employees, job applicants and other internal records.
  • 404 Media broke the story after receiving a sample of about 5,000 purported FBI employee records, and said some contents checked out, including numbers associated with Justice Department personnel.
  • The FBI told Reuters it is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is investigating.

Why it matters

  • Who's exposed exposure The group worked the education sector first and has named its next target set as corporations including the Fortune 500. Every internet-reachable PeopleSoft instance sits inside that stated scope.
  • What it limits constraint BleepingComputer could not verify the zero-day, the lateral movement or the data volume. Any operator pulling PeopleSoft off the internet this week is acting on an extortion crew's description of the bug.
  • Who has to decide decision The defaced site is the FBI's own Oracle applicant portal. Organisations running PeopleSoft self-service for external job applicants have to decide whether that endpoint stays public with no patch available.
  • What it sets up precedent One earlier PeopleSoft flaw carried this crew into more than 100 organisations, mostly universities. That is the reach to expect from a single working PeopleSoft bug in their hands.

The crew has been in PeopleSoft before. ShinyHunters weaponized CVE-2026-35273 in June 2026 to break into enterprise networks and extort the victims [4]. The flaw it describes now is a different one. It says the bug remains a zero-day and has released no technical details [21], and no public description of a PeopleSoft pre-authenticated RCE zero-day exists [20]. About three months separate the June exploitation from this one [14].

"The Oracle product we exploited the 0day in is PeopleSoft. We found another one yesterday and immediately exploited it on the FBI," the group told BleepingComputer [17]. BleepingComputer asked Oracle and Google Cloud's Mandiant whether either was aware of a new PeopleSoft vulnerability or related exploitation activity [19]. ShinyHunters also says it tried to erase evidence of its activity from the servers it touched, to make the zero-day harder to identify [25].

Take that last claim at face value and a clean PeopleSoft log review means less than it looks. For now the work is exposure and behaviour: whether the application server is reachable from the internet, and which cloud credentials it can use from where it sits.

The group's stated motive is retaliation. The FBI's IC3 public service announcement titled "ShinyHunters: Cyber Criminal Group Attacks Learning Management System" was published on May 15, 2026, and the group cites it as the reason for the attack [7]. ShinyHunters says it found the bug on a Monday night and used it immediately, which dates the intrusion to September 21 [26]. That is 130 days after the advisory [15]. The statement was addressed to FBI Cyber Division Assistant Director Brett Leatherman and Director Kash Patel [11].

Etay Maor, VP of threat intelligence at Cato Networks, said in remarks published by The Hacker News that "Its recent playbook has emphasized abusing trusted identity paths through help-desk social engineering, malicious OAuth applications, and stolen SaaS integration tokens, rather than simply breaking through a technical perimeter" [12]. The intrusion described here is perimeter exploitation. Maor also described the group as a resilient criminal brand that has outlasted takedowns, arrests and forum seizures by evolving its methods and attracting new operators, and as more than a fixed set of people or infrastructure [13]. He flagged the September 23 timestamp on the group's post against September 22 coverage in the US as a pointer toward activity in Asia, and said it is not a definitive attribution [27].

ShinyHunters names Criminal Justice, HR and Medlink among the FBI services it says were compromised [23]. The jobs portal now returns "Scheduled Maintenance Underway. We're Sniffing Out Site Updates for You!" [10], and the group's account of the shutdown is that the FBI "literally pulled the plug on everything" [9].

What to watch

  • An Oracle advisory, a CVE, or a Mandiant write-up with indicators would give PeopleSoft operators something to scan and patch. For now there is only exposure to reduce.
  • A named corporate victim from the claimed Fortune 500 wave would move the reuse claim off the actor's word.
  • Whether the FBI investigation confirms PeopleSoft as the initial access vector or places the jobs portal defacement separately.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence40
Adoption
Not scored
Hype gap+40
Incentives75
Confidence60

Perspective Coverage

14 publishers
Builder
Builder 20%
Operator
Operator 67%
Investor
Investor 13%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Hackread observed the defacement at apply.fbijobs.gov on September 22, 2026, where the site displayed a page reading "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS" with the group's branding and a link to its dark web leak site.

    Reported SupportedView cited source
  2. [2]

    In a statement shared with Reuters, the FBI said it is "aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."

    Reported SupportedView cited source
  3. [3]

    The defacement stated, "THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS. rooting your systems since '19 ;)".

    Reported SupportedView cited source
  4. [4]

    ShinyHunters weaponized a similar PeopleSoft flaw, CVE-2026-35273, in June 2026 to break into enterprise networks and extort victims.

    Reported SupportedView cited source
  5. [5]

    The group had previously exploited a separate PeopleSoft vulnerability to breach more than 100 organizations, with universities among its main targets.

    Reported SupportedView cited source
  6. [6]

    404 Media first reported the alleged breach after receiving a sample containing approximately 5,000 purported FBI employee records, and said it verified that some information in the sample was accurate, including phone numbers corresponding to people with the same names and numbers associated with US Department of Justice personnel.

    Reported SupportedView cited source
  7. [7]

    The language ShinyHunters objected to appears in an FBI Internet Crime Complaint Center public service announcement published on May 15, 2026, titled "ShinyHunters: Cyber Criminal Group Attacks Learning Management System"; the group says the attack was connected to those FBI statements.

    Reported SupportedView cited source
  8. [8]

    The FBI describes apply.fbijobs.gov as its Oracle Application Portal, used to create applicant profiles, submit job applications and required documents, and track applications.

    Reported SupportedView cited source
  9. [9]

    "They literally pulled the plug on everything," ShinyHunters said of the FBI response after the intrusion was detected.

    Reported SupportedView cited source
  10. [10]

    Visiting the FBI jobs site now reads: "Scheduled Maintenance Underway. We're Sniffing Out Site Updates for You!"

    Reported SupportedView cited source
  11. [11]

    The group's statement was addressed to FBI Cyber Division Assistant Director Brett Leatherman and FBI Director Kash Patel.

    Reported SupportedView cited source
  12. [12]

    "Its recent playbook has emphasized abusing trusted identity paths through help-desk social engineering, malicious OAuth applications, and stolen SaaS integration tokens, rather than simply breaking through a technical perimeter," said Etay Maor, VP of threat intelligence at Cato Networks.

    Reported Supported Source: Etay Maor, VP of threat intelligence at Cato Networks, quoted by The Hacker NewsView cited source
  13. [13]

    Maor described ShinyHunters as a resilient criminal brand that has managed to outlast takedowns, arrests and forum seizures by evolving its methods and attracting new operators, suggesting it is more than a fixed set of people or infrastructure.

    Reported Supported Source: Etay Maor, Cato NetworksView cited source
  14. [14]

    About three months separate the June 2026 exploitation of CVE-2026-35273 from the September 21, 2026 intrusion claimed at the FBI.

    Derived Supported
  15. [15]

    130 days elapsed between the FBI IC3 advisory of May 15, 2026 and the defacement observed on September 22, 2026.

    Derived Supported
  16. [16]

    ShinyHunters told BleepingComputer the vulnerability allows remote code execution and that they used it Monday night to access FBI systems before moving laterally into FBI-managed AWS GovCloud infrastructure.

    Reported InsufficientView cited source
  17. [17]

    "The Oracle product we exploited the 0day in is PeopleSoft. We found another one yesterday and immediately exploited it on the FBI," ShinyHunters told BleepingComputer.

    Reported InsufficientView cited source
  18. [18]

    BleepingComputer has not independently verified the alleged zero-day, the lateral movement, or the amount of stolen data.

    Reported InsufficientView cited source
  19. [19]

    BleepingComputer has contacted Oracle and Google Cloud's Mandiant threat intelligence team to determine whether they are aware of a new PeopleSoft vulnerability or related exploitation activity.

    Reported InsufficientView cited source
  20. [20]

    There are currently no details of a PeopleSoft pre-authenticated RCE zero-day.

    Reported InsufficientView cited source
  21. [21]

    ShinyHunters says the PeopleSoft vulnerability used in the attack remains a zero-day and has not released technical details about the flaw.

    Reported InsufficientView cited source
  22. [22]

    ShinyHunters claims it stole between 2TB and 3TB of data from the agency, including information on current and former FBI employees, job applicants, and other internal records.

    Reported InsufficientView cited source
  23. [23]

    The group claims it compromised FBI Criminal Justice, HR, Medlink, and additional services during the intrusion.

    Reported InsufficientView cited source
  24. [24]

    ShinyHunters told BleepingComputer it is now using the same alleged PeopleSoft vulnerability to target corporations and the Fortune 500, after targeting the education sector.

    Reported InsufficientView cited source
  25. [25]

    The group claims it tried to erase evidence of its activity from compromised servers to make the zero-day harder to identify.

    Reported InsufficientView cited source
  26. [26]

    The claimed intrusion took place on the night of September 21, 2026.

    Derived Insufficient
  27. [27]

    Maor said: "One small operational clue is the September 23 timestamp on the group's post, while the news emerged on September 22 in the U.S. If that timestamp reflects the group's real operating environment, it points toward activity in Asia. It is not a definitive attribution, but it is a detail investigators will examine alongside the technical evidence."

    Reported Insufficient Source: Etay Maor, Cato NetworksView cited source

Sources

14 independent publishers whose own reporting we read for this story.

  1. 404media.co

    4 articles · September 23, 2026

    ‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees
  2. bleepingcomputer.com

    2 articles · September 22, 2026

    ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
  3. cyberdaily.au

    1 article · September 22, 2026

    ShinyHunters hacks FBI, challenges agency over “unfounded allegations” - Cyber Daily
  4. cyberinsider.com

    1 article · September 22, 2026

    ShinyHunters claims FBI breach via new Oracle PeopleSoft zero-day | CyberInsider
  5. cyberscoop.com

    2 articles · September 22, 2026

    ShinyHunters claims attack on FBI exposes almost all agents
  6. hackread.com

    1 article · September 22, 2026

    ShinyHunters Hacks FBI Jobs Portal, Claims It Stole Agents' Data
  7. infosecurity-magazine.com

    1 article · September 23, 2026

    ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day
  8. malwarebytes.com

    1 article · September 23, 2026

    ShinyHunters claims FBI breach was revenge for “false” report
  9. scworld.com

    1 article · September 23, 2026

    FBI probes ShinyHunters claims of massive agent data theft
  10. securityaffairs.com

    1 article · September 23, 2026

    ShinyHunters claims FBI breach after alleged PeopleSoft zero-day attack
  11. securityweek.com

    2 articles · September 23, 2026

    ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report
  12. thecyberexpress.com

    1 article · September 23, 2026

    Shiny Hunters Claim FBI Breach, Offer Sample of Alleged Stolen Data
  13. thehackernews.com

    2 articles · September 23, 2026

    ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
  14. therecord.media

    1 article · September 23, 2026

    FBI investigating alleged ShinyHunters breach of its jobs site

Topics and entities

Topics

Entities