ShinyHunters Suspect Arrested in Netherlands as Group Mass-Exploits Oracle PeopleSoft CVE-2026-35273 and Breaches FBI Jobs Site
Dutch authorities arrested a 24-year-old, reportedly Pepijn van der Stap (alias "Umbreon"), around Sept. 16, 2026 on suspicion of aiding data thefts and extortions by ShinyHunters. Van der Stap was previously convicted in 2023 for data theft and extortion. Days after the arrest, remaining ShinyHunters members escalated, breaching the FBI jobs site apply.fbijobs.gov and reportedly extorting the Cl0p ransomware group. The stolen FBI data includes SSNs, personal data on more than 5,000 officials, and psychiatric and medical files. Sources say the escalation followed a takeover of ShinyHunters by a Jordanian teenager known as Rey of ScatteredLapsussHunters (SLSH), who may have planted the Umbreon imagery to implicate the Dutch suspect. Dutch media later reported investigators suspect Van der Stap tried to orchestrate at least two murders abroad, and the FBI publicly urged remaining members to surrender.
Detalhes técnicos
- ShinyHunters claims it breached the FBI site and other victims by exploiting CVE-2026-35273 in Oracle PeopleSoft, reportedly as a zero-day from June. Oracle has since patched the flaw.
- Mandiant published WAF rules as a mitigation, but BleepingComputer reported that ShinyHunters bypassed them with a URL-encoding trick.
- A Sept. 25 Mandiant/GTIG report confirmed mass exploitation against dozens of systems in higher education, technology, healthcare, agriculture, transportation and government.
- In the February 2026 Odido intrusion, a Dutch-speaking caller socially engineered an employee into logging in at a spoofed website, leading to theft of data on more than 6.2 million people.
- The FBI site was defaced with an ASCII Umbreon design identical to one used in the 2020 Hackforums hack.
- Mandiant's Austin Larsen estimates ShinyHunters is on track for nearly $100 million in extortion payments in 2026.
- Wired reported that ShinyHunters and SLSH briefly partnered to monetize credentials stolen by TeamPCP, then fell out.
Remediação
- Apply Oracle's patch for CVE-2026-35273 on PeopleSoft instances.
- Do not rely solely on the Mandiant WAF rules, since a URL-encoding bypass has been reported.
- Review PeopleSoft systems for signs of compromise and data theft.
- Train help desk and employees against voice phishing and spoofed login pages.
Linha do tempo
-
ShinyHunters Suspect Arrested in Netherlands as Group Mass-Exploits Oracle PeopleSoft CVE-2026-35273 and Breaches FBI Jobs Site
ler a análise desta fonte ocultar
Dutch authorities arrested a 24-year-old, reportedly Pepijn van der Stap (alias "Umbreon"), around Sept. 16, 2026 on suspicion of aiding data thefts and extortions by ShinyHunters. Van der Stap was previously convicted in 2023 for data theft and extortion. Days after the arrest, remaining ShinyHunters members escalated, breaching the FBI jobs site apply.fbijobs.gov and reportedly extorting the Cl0p ransomware group. The stolen FBI data includes SSNs, personal data on more than 5,000 officials, and psychiatric and medical files. Sources say the escalation followed a takeover of ShinyHunters by a Jordanian teenager known as Rey of ScatteredLapsussHunters (SLSH), who may have planted the Umbreon imagery to implicate the Dutch suspect. Dutch media later reported investigators suspect Van der Stap tried to orchestrate at least two murders abroad, and the FBI publicly urged remaining members to surrender.
Technical Details
- ShinyHunters claims it breached the FBI site and other victims by exploiting CVE-2026-35273 in Oracle PeopleSoft, reportedly as a zero-day from June. Oracle has since patched the flaw.
- Mandiant published WAF rules as a mitigation, but BleepingComputer reported that ShinyHunters bypassed them with a URL-encoding trick.
- A Sept. 25 Mandiant/GTIG report confirmed mass exploitation against dozens of systems in higher education, technology, healthcare, agriculture, transportation and government.
- In the February 2026 Odido intrusion, a Dutch-speaking caller socially engineered an employee into logging in at a spoofed website, leading to theft of data on more than 6.2 million people.
- The FBI site was defaced with an ASCII Umbreon design identical to one used in the 2020 Hackforums hack.
- Mandiant's Austin Larsen estimates ShinyHunters is on track for nearly $100 million in extortion payments in 2026.
- Wired reported that ShinyHunters and SLSH briefly partnered to monetize credentials stolen by TeamPCP, then fell out.
Remediation
- Apply Oracle's patch for CVE-2026-35273 on PeopleSoft instances.
- Do not rely solely on the Mandiant WAF rules, since a URL-encoding bypass has been reported.
- Review PeopleSoft systems for signs of compromise and data theft.
- Train help desk and employees against voice phishing and spoofed login pages.