> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# ShinyHunters claims FBI hack: 'This is NOT financially motivated'
- URL: https://f4n6.co.uk/security-feed/shinyhunters-claims-fbi-hack-this-is-not-financially-motivated/
- Published: 2026-09-22T18:17:58.000Z
- Updated: 2026-09-22T18:17:58.000Z
- Author: Jeff Davies
- Tags: #security-feed, ShinyHunters

## 1\. Executive summary

ShinyHunters (MITRE G1057) claims to have breached the FBI by exploiting a pre-authentication remote code execution zero-day in Oracle PeopleSoft on the FBI jobs webpage, then moving laterally into FBI-managed servers on AWS GovCloud and downloading approximately 2 TB to 3 TB of data on current, former and prospective FBI employees. The group defaced the site with a "This site has been seized by ShinyHunters" banner and states it is not seeking payment; it demands the FBI retract allegations made in a 15 May bulletin about the group's extortion tactics. The claims are single-sourced to a ShinyHunters spokesperson speaking to The Register, and neither the FBI, Oracle nor AWS had responded at press time. No CVE identifier, CVSS score or CISA-KEV listing exists in the verified reference data for the claimed PeopleSoft flaw, so its severity cannot be assessed and the vulnerability remains unconfirmed. For EMEA financial services the direct exposure is low, but the claimed technique, a pre-auth RCE in an internet-facing HR platform followed by lateral movement to cloud-hosted internal systems, is directly relevant to any organisation running public-facing PeopleSoft or comparable ERP instances.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The incident, if confirmed, affects a US federal agency rather than an EMEA financial entity, and the verified reference data contains no vulnerability classification, exploitation evidence or client-side impact that would trigger an article-specific obligation. Clients should treat this as threat intelligence rather than a reportable event.

## 3\. Technical analysis & attack chain

The following chain is reconstructed from ShinyHunters' own claims to The Register. Every step is single-sourced and unverified by the FBI, Oracle or AWS at press time.

1. Initial access. ShinyHunters claims it exploited a zero-day pre-authentication RCE vulnerability in Oracle PeopleSoft running the FBI jobs webpage (federal jobs recruitment portal).
2. Web defacement. The group replaced the site content with a "This site has been seized by ShinyHunters" banner and image. At press time the site displayed a maintenance message: "currently down for maintenance but will be back up soon!".
3. Lateral movement. The group claims it moved from the compromised web server onto the FBI's managed servers hosted on AWS GovCloud.
4. Data access and exfiltration. ShinyHunters claims it downloaded approximately 2 TB to 3 TB of data belonging to current, former and prospective FBI employees, and states "We hold data on all FBI employees and applicants".
5. Extortion demand (non-financial). Unlike the group's usual ransom demands, ShinyHunters states it is not seeking payment. It demands the FBI retract statements from a 15 May bulletin issued after the group's claimed breach of Instructure's Canvas platform, in which the FBI said ShinyHunters uses harassment strategies including threatening texts and calls to victims and family members, and in some cases swatting, and that extortionists may falsely claim to hold compromising material that frequently does not exist. ShinyHunters denies these allegations.

The claimed compromised FBI services are human resources, MedLink and Criminal Justice Information Services. The Register contacted Oracle to ask whether it is aware of a PeopleSoft pre-auth RCE zero-day and AWS on the alleged data theft; neither had responded at press time. No CVE identifier, patch, CVSS score or CISA-KEV entry for the claimed PeopleSoft flaw exists in the verified reference data, so clients cannot currently patch against a specific vulnerability. The claimed data types, HR, medical (MedLink) and CJIS, indicate that if the breach is real, the stolen material includes personnel and potentially health and criminal-justice records, which would be high-value for follow-on phishing and impersonation of FBI staff.

## 4\. Mitigation & containment

No vendor fix exists for the claimed PeopleSoft zero-day in the verified reference data, and no CVE is confirmed, so containment below is precautionary and based on the claimed technique rather than a specific flaw.

P1, within 24 hours:

- Inventory all internet-facing Oracle PeopleSoft instances, including recruitment, HR self-service and supplier portals, and confirm their exact versions and patch levels. If an instance is non-essential, take it offline or place it behind a VPN or IP-allowlisting reverse proxy until Oracle guidance appears.
- Review authentication exposure on PeopleSoft deployments: pre-authentication RCE claims mean the flaw would be reachable without credentials, so confirm that no servlet or endpoint is exposed unauthenticated. Restrict external access to the PeopleSoft servlet web profile and remove any direct internet exposure of the PIA (PeopleSoft Internet Architecture) where possible.
- Search web and EDR logs for unexplained defacement or unexpected content changes on public-facing PeopleSoft or ERP servers, and for outbound data transfers larger than 1 TB from DMZ or web-tier hosts.

P2, within 72 hours:

- Review IAM and network segmentation between public-facing web servers and internal or cloud-hosted HR, payroll and medical systems. The claimed chain moved from a web server to AWS GovCloud managed servers; verify that web tiers cannot reach HR databases or cloud management planes without additional authentication.
- Check cloud environments (AWS, Azure) for anomalous data-sync or snapshot-download activity from web-tier roles, and confirm web-tier roles have no read access to HR data stores.
- Contact Oracle support for any advisory on PeopleSoft pre-auth RCE and monitor NVD and CISA-KEV for a CVE. Do not treat the flaw as patched until a vendor advisory names it.

P3, within 7 days:

- Brief fraud and HR teams on the claimed FBI data theft: if genuine, stolen FBI employee and applicant records could support impersonation of federal officials in fraud schemes targeting financial institutions. Reinforce verification procedures for any inbound contact claiming to be from law enforcement or regulators.
- If the organisation runs PeopleSoft, schedule an external penetration test of internet-facing PeopleSoft components once Oracle guidance is available, and validate segmentation controls between web tier and HR data.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators:

| Behaviour                                                                                      | Where to observe                                                                     | Confidence                       |
| ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | -------------------------------- |
| Web defacement with "This site has been seized by ShinyHunters" banner text                    | Web server content, WAF logs, file-integrity monitoring on web roots                 | Single-sourced, claimed by actor |
| Large-volume data transfer (2-3 TB) from web/DMZ tier to external destination or cloud storage | NetFlow, proxy logs, cloud egress monitoring                                         | Single-sourced, claimed by actor |
| Lateral movement from public-facing PeopleSoft server to cloud-hosted managed servers          | EDR on web tier, cloud audit logs (assume-role, API calls from web-tier credentials) | Single-sourced, claimed by actor |

## 6\. Detection

Insufficient indicators to author detection rules. The source contains no file hashes, command-line strings, registry keys, mutexes or network artefacts from the intrusion. The defacement banner text is a claim about site content reported by the press, not an artefact recovered from a malicious file or command line, so it cannot support a YARA rule.

## Threat actor context

**ShinyHunters** · [G1057](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) · aka UNC6240, Bling Libra

[ShinyHunters](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

## 7\. Sources

- The Register, "ShinyHunters claims FBI hack: 'This is NOT financially motivated'", https://www.theregister.com/security/2026/09/22/shinyhunters-claims-fbi-hack-this-is-not-financially-motivated/5298385, 2026-09-22

## 8\. Adverse Trace position

We assess this incident as unconfirmed and single-sourced: every technical claim, the PeopleSoft zero-day, the lateral movement to AWS GovCloud and the 2-3 TB exfiltration, comes from a ShinyHunters spokesperson, and the FBI, Oracle and AWS had not responded at press time. ShinyHunters is a confirmed tracked actor (MITRE G1057), but the specific intrusion claims carry no independent corroboration, and no CVE, CVSS score or KEV entry exists in the verified reference data, so we assign no severity to the claimed vulnerability and clients should not reprioritise patching on the basis of this report alone. The demand is unusual, a retraction rather than a ransom, which fits the group's stated dispute with the FBI's 15 May bulletin but also gives the group a publicity motive that lowers the evidential weight of its claims. For EMEA financial services the actionable point is the technique pattern: internet-facing PeopleSoft and similar ERP portals are credible pre-auth RCE targets, and segmentation between those portals and cloud-hosted HR data is the control this story implicates. We will monitor for an Oracle advisory, a CVE assignment or CISA-KEV listing, and for independent confirmation of the breach, and will reissue this advisory if any of those appear.

---

[Read the original source →](https://www.theregister.com/security/2026/09/22/shinyhunters-claims-fbi-hack-this-is-not-financially-motivated/5298385?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*