Loading story…
ShinyHunters claims it exploited an alleged pre-authentication Oracle PeopleSoft zero-day for remote code execution against an FBI jobs webpage, defaced the site, and pivoted into FBI-managed AWS GovCloud infrastructure. The group says it exfiltrated roughly 2–3 TB of data involving current, former, and prospective FBI personnel, as well as agents’ spouses; reported sample records include names, home addresses, and phone numbers, some of which were reportedly verified against public records.
The group says the intrusion was not financially motivated and demands that the FBI retract or correct allegations in a May 15 bulletin linking ShinyHunters to harassment, threatening communications, and swatting. The claims, including the alleged PeopleSoft vulnerability, lateral movement, and data theft, remain unverified: the FBI, Oracle, and AWS had not publicly confirmed the incident. If authentic, the exposure could enable targeted harassment, coercion, extortion, or counterintelligence targeting of FBI personnel and their families.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
The FBI said it was aware of claims of unauthorized activity affecting FBIjobs.gov and was investigating. It did not confirm ShinyHunters' alleged PeopleSoft exploit, GovCloud access, or data theft.
ShinyHunters said the alleged FBI intrusion was not financially motivated and demanded that the FBI correct or retract statements accusing the group of harassment, threats, swatting, and false claims of compromising material. The FBI, Oracle, and AWS had not confirmed the alleged breach, vulnerability, lateral movement, or data theft.
ShinyHunters published an unverified claim that it breached the FBI via an alleged pre-authentication Oracle PeopleSoft remote-code-execution zero-day, defaced the FBI jobs site, pivoted into FBI-managed AWS GovCloud systems, and exfiltrated roughly 2–3 TB of data. The group said the alleged data included information on current, former, and prospective FBI personnel, including agents, applicants, and spouses; samples reportedly contained names, addresses, and phone numbers.
In its May 15 bulletin, the FBI said ShinyHunters used harassment tactics including threatening calls and text messages to victims and their families, and in some cases swatting. The bulletin also warned that extortionists may falsely claim to possess sensitive or compromising material.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourcemalware.news
Open sourcetechcrunch.com
Open sourcetheregister.com
Open source404media.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026
ShinyHunters has claimed a broad intrusion campaign against Oracle PeopleSoft servers, saying it compromised roughly 300 instances across more than 100 organizations, with universities and other education-sector entities appearing to be the primary victims. The group told reporters it exfiltrated sensitive student and administrative records, including applicant, financial aid, immigration, health, and contact data, and identified Nottingham University as one victim; the university acknowledged a cybersecurity incident. One member of the group also said an attempted breach of an FBI PeopleSoft server was intended to post a denial of the gang’s involvement in recent swatting incidents, but that effort allegedly failed. Reporting indicates the attacks are tied to data theft and extortion activity and may involve a gadget chain using older flaws alongside a possible zero-day, with impact varying by PeopleSoft configuration. Independent research found exposed directories containing tooling linked to the campaign, including MeshCentral agents, a defacement script, a credential-spraying tool, and infrastructure associated through TLS certificates with `azurenetfiles[.]net`. Investigators also observed a shell script that parsed `/etc/hosts`, attempted SSH access with common PeopleSoft and Oracle administrative accounts, and dropped a ransom note named `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT` on compromised internal PeopleSoft servers, while Oracle had not publicly commented on the allegations at the time of reporting.
Jul 3, 2026