ShinyHunters Extorted Boeing Spin-off Prior to Arrests

1. Executive summary

Jordanian authorities detained Saif Al-din Khader, the Amman teenager who uses the handle "Rey," on or around early October 2026, and he is reportedly cooperating with the FBI to identify other ShinyHunters members. At the time of his detention the group was extorting Jeppesen ForeFlight, the navigation and digital aviation unit Boeing sold to Thoma Bravo in November 2025, and sources familiar with the investigation say the stolen data could carry operational safety and security risks. The intrusion vector is CVE-2026-35273, a CVSS 9.8 critical missing-authentication flaw in Oracle PeopleSoft (CWE-306), which ShinyHunters exploited as a zero-day from June 2026 and which CISA added to its KEV catalogue on 2026-06-12. EMEA financial services firms running PeopleSoft for HR, payroll or benefits are exposed to the same mass-exploitation campaign, and the group has already bypassed the Mandiant WAF rules issued for organisations that could not patch immediately. The arrests disrupt the brand but not the affiliate model: the FBI is still pursuing freelancers who supply stolen SaaS credentials for a cut of paid ransoms.

2. Regulatory framing

No DORA Art. 17, 18, 19 or 24 row is claimed here: this advisory describes a third-party campaign and an arrest, not an incident at a client, so the incident-management and testing articles are not engaged by the facts as given.

3. Technical analysis & attack chain

Confirmed steps in the PeopleSoft campaign, from the sources:

1. ShinyHunters began exploiting CVE-2026-35273 as a zero-day in June 2026, before Oracle issued a fix.
2. The flaw is a missing-authentication condition (CWE-306) in Oracle PeopleSoft Enterprise PeopleTools. It allows a remote, unauthenticated attacker with network access over HTTP to take over the platform.
3. Oracle issued an out-of-band security alert and a fix. Mandiant published web application firewall rules for organisations that could not apply the update quickly enough.
4. In recent weeks ShinyHunters used a URL-encoding trick to bypass the Mandiant WAF rules.
5. Mandiant and the Google Threat Intelligence Group confirmed in a 25 September 2026 report that the group mass-exploited the flaw to steal data from dozens of systems across higher education, technology, healthcare, agriculture, transportation and government.
6. ShinyHunters gained access to the FBI recruitment site and other victims through this flaw. The FBI removed an Accenture contractor over the failure to patch that site; data on more than 5,000 FBI personnel was exposed, including unit, specialisation, and medical and psychiatric records.
7. The group was extorting Jeppesen ForeFlight when Khader was detained. Boeing confirmed the extortion claim concerns data from the former subsidiary. Jeppesen ForeFlight says its own investigation found no impact to operations or products.

The exploitation mechanism is a missing authentication check on a PeopleSoft endpoint reachable over HTTP, which lets an unauthenticated attacker reach functionality that should require a session. The URL-encoding bypass of the Mandiant WAF rules indicates the group is still adapting its request encoding rather than abandoning the vector, so signature-only WAF coverage is not a durable control. The sources do not describe the specific PeopleSoft endpoint, the request structure, or the post-exploitation tooling, and no malware, persistence mechanism, command-and-control channel or lateral-movement technique is named in any of the provided material. Treat the intrusion as data theft through an application-layer authentication gap, not as a host-based intrusion with an implant.

The affiliate model is the part that matters for defenders. Sources close to the investigation say the FBI is focusing on a handful of freelancers and affiliates who feed the group stolen credentials to SaaS platforms used by large companies, in exchange for a cut of any data ransom later paid. That means access to a victim can arrive through a compromised third party or a purchased credential rather than through CVE-2026-35273 at all. ShinyHunters has also been attributed to a February 2026 social-engineering intrusion at Odido, the largest Dutch mobile provider, in which an employee was tricked into logging in at a spoofed site and data on more than 6.2 million Dutch people was stolen. The Dutch police have asked the public to identify the native Dutch speaker in a recorded call from that incident.

Confidence caveats. The Jeppesen ForeFlight extortion detail rests on two unnamed sources familiar with the investigation, reported by KrebsOnSecurity, and is corroborated only by Boeing's acknowledgement that a threat actor made claims about data associated with Boeing and its former subsidiary. Boeing did not confirm the data was genuine, and Jeppesen ForeFlight denies operational impact. The claim that the stolen data could pose operational safety and security risks is single-sourced to those same unnamed sources and is not independently verified. The attribution of the PeopleSoft campaign to ShinyHunters is multi-source (Mandiant/GTIG, KrebsOnSecurity, BleepingComputer, The Register), but the specific claim that Khader led the group is reported and not adjudicated.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every internet-reachable Oracle PeopleSoft Enterprise PeopleTools instance. CVE-2026-35273 is in CISA KEV (added 2026-06-12) with a CVSS of 9.8, so any unpatched, HTTP-exposed instance is the priority. Apply the Oracle fix; do not rely on the Mandiant WAF rules alone, because the group has already bypassed them with URL-encoding.
• Where the Oracle patch cannot be applied inside 24 hours, take the instance off the public internet rather than leaving it behind WAF rules. Restrict access to a VPN or an allow-listed source range and log every request to the PeopleSoft web tier.
• Search PeopleSoft and adjacent logs for unauthenticated access to endpoints that should require a session, and for requests containing repeated or nested percent-encoding in path or query parameters. The URL-encoding bypass is the observable behaviour the sources name.

P2, within 72 hours:

• Review SaaS access for HR, payroll, benefits and recruitment platforms for credentials sourced from third parties. The affiliate model means a valid credential, not an exploit, may be the entry point. Enforce phishing-resistant MFA on these platforms and revoke sessions for any account whose credential appears in prior breach data.
• Confirm whether PeopleSoft or a comparable SaaS platform sits in your ICT third-party register, and whether the provider's contract gives you incident notification and audit rights, per DORA Art. 28 and Art. 30. Where a platform has changed ownership or been divested, verify the notification obligation survived the transaction.
• Brief HR and payroll staff on the Odido-style pattern: an employee tricked into logging in at a spoofed portal. Verify the domain before entering credentials on any PeopleSoft or payroll login page.

P3, within 7 days:

• Re-test WAF and application-layer controls against encoded request variants, not just the literal strings in the original Mandiant rules.
• Add the PeopleSoft exposure window to your supply chain risk review under NIS2 Art. 21(2)(d), covering credential provenance for SaaS access as well as vendor patching.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, file paths, registry keys) are present in the source material. The sources describe the campaign at the level of exploited component, victim sectors and actor behaviour only.

Behavioural indicators:

# No atomic indicators available in the source material.

6. Detection

The sources do not contain file hashes, mutex names, filenames, registry keys or command-line artefacts for this campaign. They do describe a request-level behaviour: exploitation of an unauthenticated PeopleSoft endpoint and the use of URL-encoding to bypass WAF rules. That is enough for a Sigma rule on the web-tier log pattern, but not enough for a YARA rule, because no file-level artefact is given. A YARA rule built on the CVE identifier or the actor name would detect reporting about the threat, not the threat, so none is emitted.

title: Oracle PeopleSoft Unauthenticated Access with Encoded Request Parameters
id: 8f2c1a44-6b7e-4d19-9c3a-0e5b7d2a1f60
status: experimental
description: Detects HTTP requests to Oracle PeopleSoft Enterprise PeopleTools endpoints that carry repeated or nested percent-encoding, consistent with the URL-encoding technique used to bypass WAF rules during exploitation of CVE-2026-35273.
author: Adverse Trace
date: 2026-10-07
references:

  - https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/
  - https://therecord.media/shinyhunters-cyberattacks-oracle-mandiant
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:

      - '/psp/'
      - '/psc/'
      - '/PeopleSoft/'
  selection_encoding:
    cs-uri-query|re: '(?i)(%25[0-9a-f]{2})|(%[0-9a-f]{2}){3,}'
  condition: selection_path and selection_encoding
falsepositives:

  - Legitimate applications that double-encode query parameters
  - Load balancers or proxies that re-encode URLs in transit
level: medium

Tune the selection_path values to the PeopleSoft URL prefixes in use at your organisation, and baseline the encoding pattern against normal application traffic before alerting.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

Threat actor context

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

7. Sources

• KrebsOnSecurity, "ShinyHunters Extorted Boeing Spin-off Prior to Arrests," https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/, 2026-10-07
• KrebsOnSecurity, "Dutch Police Arrest 'Reformed' Hacker in Shiny Hunters Investigation," https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/, 2026-09-28
• SecurityWeek, "Google Warns of ShinyHunters' Fresh Oracle PeopleSoft Campaign," https://www.securityweek.com/google-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign/
• BleepingComputer, "Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks," https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/
• The Register, "ShinyHunters claims it hacked 100 orgs by exploiting an Oracle PeopleSoft 0-day," https://www.theregister.com/cyber-crime/2026/06/11/shinyhunters-claims-oracle-peoplesoft-0-day-hit-100-orgs/5254443, 2026-06-11
• The Record (Recorded Future), "ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns," https://therecord.media/shinyhunters-cyberattacks-oracle-mandiant

8. Adverse Trace position

CVE-2026-35273 is a CVSS 9.8 critical missing-authentication flaw (CWE-306) in Oracle PeopleSoft, it is in CISA KEV as of 2026-06-12, and ShinyHunters has mass-exploited it against dozens of organisations and bypassed the interim WAF mitigations. That combination puts any EMEA financial services firm with an internet-reachable PeopleSoft instance in the exposed population, and the affiliate model means a stolen SaaS credential can substitute for the exploit. The Jeppesen ForeFlight extortion detail and the operational-safety claim rest on unnamed sources and are not confirmed by the company, so we treat the victim impact as reported rather than established; the PeopleSoft exploitation itself is multi-source and we treat it as confirmed. We will track the Oracle patch status and any further Mandiant/GTIG reporting on the encoding bypass, and we will update this advisory if the FBI names additional affiliates or if Jeppesen ForeFlight revises its position. Clients who cannot confirm their PeopleSoft patch state should treat the instance as compromised until log review says otherwise.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.