Threat Intel
Jordanian Teen Detained as ShinyHunters Extorted Boeing Spin‑Off
A 17‑year‑old from Amman, Jordan, suspected of leading the ShinyHunters hacking gang, was arrested while the group was extorting a Boeing divestiture. The gang exploited a zero‑day in Oracle PeopleSoft (CVE‑2026‑35273) to breach the FBI and other targets. Defenders should patch PeopleSoft immediately, deploy Mandiant WAF rules, and monitor for similar extortion tactics.
ShinyHunters, a prolific data‑theft and extortion group, was in the middle of a campaign against a Boeing divestiture when a 17‑year‑old suspect from Amman, Jordan, was detained by local authorities and is now cooperating with the FBI.
What Happened
The teenager, known online as “Rey,” took over the ShinyHunters brand after the arrest of Dutch hacker Pepijn van der Stap and publicly boasted about stealing data from the FBI and extorting the ransomware group Cl0p. The group’s attacks were enabled by a zero‑day flaw (CVE‑2026‑35273) in Oracle PeopleSoft, a SaaS platform used for HR and payroll.
Impact
ShinyHunters exploited the PeopleSoft vulnerability from June to gain access to the FBI’s internal site and other corporate networks. The breach was discovered after Oracle released a patch and Mandiant issued web‑application‑firewall rules for organizations that could not apply the fix immediately.
ShinyHunters used the PeopleSoft zero‑day to breach the FBI and other targets.
What to Do
- Apply the Oracle PeopleSoft patch for CVE‑2026‑35273 without delay.
- Deploy the Mandiant WAF rules if the patch cannot be applied immediately.
- Audit PeopleSoft logs for unauthorized access attempts and review user activity.
- Monitor for extortion or ransom demands that reference ShinyHunters or similar tactics.
- Educate staff about phishing and social‑engineering attempts that may accompany data‑exfiltration campaigns.
Related vulnerabilities
FBI Removes Accenture Contractor After Patch Failure Exposes Thousands of Employees in ShinyHunters Breach
The FBI terminated an Accenture contractor after a failure to apply an Oracle PeopleSoft patch enabled the ShinyHunters group to exfiltrate personal data of thousands of bureau employees. The breach exploited CVE‑2026‑35273 via a URL‑encoding trick that bypassed the WAF protecting the Environment Management Hub endpoint. Defenders should verify patch status, harden PeopleSoft deployments, and audit WAF rules for similar bypasses.
Read briefing
ShinyHunters Resumes Oracle PeopleSoft Exploitation via WAF Bypass
The extortion group ShinyHunters has re‑opened attacks on Oracle PeopleSoft servers by applying a URL‑encoding trick that evades WAF rules protecting the PSEMHUB endpoint. Vulnerable systems that have not applied the CVE‑2026‑35273 patch remain at risk of unauthenticated remote code execution. Defenders should verify WAF configurations, apply the Oracle patch, and monitor for suspicious access patterns.
Read briefing
Oracle PeopleSoft CVE-2026-35273 Exploitation: WAF Bypass and Web Shell Deployment
Attackers have resumed mass exploitation of Oracle PeopleSoft’s critical CVE‑2026‑35273, bypassing WAFs by URL‑encoding the PSEMHUB path to deploy JSP web shells. The campaign spans higher education, healthcare, IT services, and government, enabling unauthenticated remote code execution. Defenders should patch immediately, verify WAF rules, and monitor for shell uploads.
Read briefing
ShinyHunters Exploits CVE-2026-35273 with WAF Bypass
ShinyHunters (UNC6240) is actively exploiting CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules via URL encoding. Defenders should prioritize patching and consider disabling the Environment Management Hub (EMHub).
Read briefing