EN PT-BR
← Voltar ao feed
critical education technology it services healthcare agriculture transportation government aerospace higher education law enforcement cybercrime telecommunications

ShinyHunters mass-exploits Oracle PeopleSoft CVE-2026-35273, breaches FBI jobs site; Dutch suspect arrested, member 'Rey' detained in Jordan

4 fonte(s) · 5 atualização(ões) · publicado 28/09/2026 12:08 · coletado há 4 dias

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 29/10/2026 00:09; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ thezdi.com ↗ bitdefender.com ↗ krebsonsecurity.com ×2 ↗

Dutch authorities arrested a 24-year-old, reportedly Pepijn van der Stap (alias "Umbreon"), in mid-September 2026 on suspicion of aiding ShinyHunters data thefts and extortions (krebsonsecurity.com). Afterwards the group escalated sharply. It breached the FBI job application portal (apply.fbijobs.gov), exposing Social Security numbers and personal data of more than 5,000 FBI personnel, some of it medical and psychiatric files (krebsonsecurity.com, bitdefender.com). It also claimed a hack of the Cl0p ransomware leak site. The FBI's cyber division chief, Brett Leatherman, publicly urged remaining members to surrender (bitdefender.com). A krebsonsecurity.com report of 7 October says a Jordanian teenager known as Rey (identified as Saif Al-din Khader), who had taken over the ShinyHunters brand, was detained in Amman while the group was extorting Jeppesen ForeFlight, the Boeing unit sold to Thoma Bravo in November 2025. He is reportedly cooperating with the FBI. Boeing acknowledged the claims, while Jeppesen ForeFlight said its operations and products were not affected. The group says initial access to the FBI site came from CVE-2026-35273 in Oracle PeopleSoft. According to Mandiant and GTIG, as reported by thehackernews.com (28 October), the flaw was exploited as a zero-day by UNC6240/ShinyHunters from 27 May to 9 June 2026, before Oracle's out-of-band alert of 10 June. Trend Micro's Zero Day Initiative (ZDI) (thezdi.com, 27 October) and thehackernews.com now report that CVE-2026-35273 is a chain of three distinct flaws patched under a single CVE. The flaw is on CISA's KEV catalog (thehackernews.com).

Entenda a falha

A vulnerabilidade

CVE-2026-35273 (CVSS 9.8, on CISA's KEV catalog) is a chain of three flaws in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 that ends in remote code execution as the PeopleSoft service account. It starts with an SSRF in the Integration Gateway (PSIGW, ZDI-CAN-31816). That SSRF reaches the Environment Management Hub (PSEMHUB), which offers an arbitrary file write (ZDI-CAN-31818) or an unsafe XMLDecoder deserialization (ZDI-CAN-31817). The Hacker News says no login is needed, while ZDI describes an attacker pivoting from low-privileged access. Oracle fixed all three under one CVE in its out-of-band alert of June 10, 2026; ZDI is coordinating separate CVEs, none published as of October 28.

Como funciona

A request to the PSIGW HttpListeningConnector names the HttpTargetConnector handler, a target URL and the full data to forward. The handler sends that content as-is to the chosen URL, here PeopleSoft on the loopback address, so PSEMHUB sees a request from localhost. PSEMHUB's validateClient compares the requester with allowedhosts.properties, which lists localhost by default, so the check passes. The ExecuteProcessActivityCommand handler, meant to write log entries, then writes caller-chosen content to a caller-chosen absolute path. Written to the PSEMHUB WAR path, this gives immediate RCE. Alternatively, a malicious XML file in the environment metadata directory is loaded with XMLDecoder when HubServlet next initializes, for example after a restart.

Por que é vulnerável

The PSIGW HttpTargetConnector handler does not validate the target or the traffic it forwards, so it works as a generic request relay. validateClient trusts the source address and Oracle allows localhost by default, so any SSRF defeats it; ZDI calls this default the decision that makes the protection ineffective. ExecuteProcessActivityCommand never checks that m_targetFile points to a legitimate log directory. HubMBeanPersistance feeds files from a writable directory into Java XMLDecoder, which instantiates objects during parsing, so the payload runs before the cast to Environment fails. The articles do not describe what Oracle's patch changes.

Onde está

Endpoint /PSIGW/HttpListeningConnector (HttpTargetConnector handler); validateClient and /envmetadata/config/allowedhosts.properties; PSEMHUB ExecuteProcessActivityCommand (m_line, m_targetFile); HubServlet calling startServerPeer in com.peoplesoft.pt.environmentmanagement.hub.Server, then HubMBeanPersistance reading envmetadata/data/environment/.

Como foi descoberta

ZDI (TrendAI) says it first reported the issue to Oracle on June 10, 2026, after an investigation by the post's author (Bobby Gould, per The Hacker News) with Minh Giang and Lucas Miller of TrendAI Research. The Hacker News gives June 10 as the date of Oracle's out-of-band fix, so the dates conflict and the exact sequence is unclear. Mandiant and GTIG attribute zero-day exploitation by ShinyHunters (UNC6240) to May 27 to June 9, mostly against universities. A September 25 report described a larger wave, with a WAF bypass by URL-encoding one character of /PSEMHUB/. ShinyHunters claims this CVE gave it access to the FBI jobs site, which is not independently confirmed. ZDI later published its analysis of three distinct flaws.

PoC pública

ZDI's public write-up walks through the whole chain with decoded example requests and the code paths involved: the SSRF to PSEMHUB, the file write and the XMLDecoder route. No separate exploit repository or tool is mentioned. It is analysis rather than a ready tool, but with Mandiant's reports of mass exploitation by ShinyHunters, the chain is clearly being used in practice. Patching is urgent. If it is not possible, disable or remove PSEMHUB per Oracle's alert, and do not rely on path-based WAF rules.

Publicada em: www.thezdi.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 00:24.

Detalhes técnicos

  • CVE-2026-35273 affects Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (thehackernews.com). It has a CVSS score of 9.8, and an unauthenticated attacker can take over the server over the network. Oracle fixed it in an out-of-band security alert on 10 June (thehackernews.com), and Mandiant published WAF rules as a stopgap (krebsonsecurity.com).
  • Exploitation as a zero-day ran from 27 May to 9 June, mostly against universities (thehackernews.com, citing Mandiant/GTIG). A larger September wave hit technology, IT services, healthcare, agriculture, transport and government organizations (thehackernews.com).
  • Three chained flaws, one CVE (thezdi.com, thehackernews.com, citing Bobby Gould of ZDI). ZDI is working with Oracle to assign a separate CVE to each, but none had been published as of the latest report (thehackernews.com).
    • Bug 1, PSIGW SSRF (ZDI-CAN-31816): a POST to /PSIGW/HttpListeningConnector with the HttpTargetConnector handler lets the attacker control both the target URL and the full payload, with no validation of the target. Pointing it at http://127.0.0.1:8000 makes the request originate from localhost (thezdi.com).
    • Trust bypass: the Environment Management Hub (PSEMHUB) restricts access with validateClient, which checks allowedhosts.properties. Loopback is allowed by default, so the SSRF passes the check. The attacker cannot reach PSEMHUB directly, so the SSRF is the necessary pivot from low-privileged access (thezdi.com, thehackernews.com).
    • Bug 2, PSEMHUB external control of file path (ZDI-CAN-31818): the ExecuteProcessActivityCommand handler lets the caller set both file content (m_line) and absolute path (m_targetFile) without validation. Writing a web shell into the PSEMHUB WAR path gives immediate RCE as the PeopleSoft service account (thezdi.com).
    • Bug 3, PSEMHUB deserialization of untrusted data (ZDI-CAN-31817): with any file write primitive, an attacker can place a malicious XML file in [docroot]/envmetadata/data/environment/. On the next HubServlet initialization (for example after a restart), HubMBeanPersistance loads each file with Java XMLDecoder, executing the payload before the cast to Environment throws. This avoids a JSP web shell and is less likely to be detected (thezdi.com, thehackernews.com).
  • ShinyHunters bypassed the Mandiant WAF rules with a well-known URL-encoding trick (krebsonsecurity.com, citing BleepingComputer). Per thehackernews.com, it encoded one character (/%50SEMHUB/ instead of /PSEMHUB/): the server decodes the path while many rules match plain text.
  • A 25 September Mandiant/GTIG report confirmed mass exploitation against dozens of systems in higher education, technology, healthcare, agriculture, transportation and government (krebsonsecurity.com, thezdi.com).
  • The FBI data exposed includes unit and specialization details. Some staff worked on sensitive China and Russia investigations (bitdefender.com). Reuters reportedly said the FBI removed an Accenture contractor for failing to patch the site (krebsonsecurity.com).
  • The FBI site was defaced with an ASCII Umbreon design identical to one used in the 2020 Hackforums hack (krebsonsecurity.com). Sources suggest Rey may have planted this imagery to implicate the Dutch suspect.
  • In mid-September ShinyHunters claimed to have stolen Cl0p source code, CMS plugins, Tor private keys and logs said to reveal member IP addresses. It threatened to publish which companies paid ransoms and how much unless it was paid (bitdefender.com).
  • In the February 2026 Odido intrusion, a Dutch-speaking caller socially engineered an employee into logging in at a spoofed site, leading to theft of data on more than 6.2 million people (krebsonsecurity.com).
  • Mandiant's Austin Larsen estimates ShinyHunters is on track for nearly $100 million in extortion payments in 2026. Wired reported that ShinyHunters and the ScatteredLapsussHunters (SLSH) collective briefly partnered to monetize credentials stolen by TeamPCP, then fell out (krebsonsecurity.com).
  • ShinyHunters now operates as a franchise, and its current users differ from the original, largely French, core. The FBI is reportedly focused on a handful of freelancers and affiliates who supply stolen SaaS credentials in exchange for a share of ransoms (krebsonsecurity.com).
  • Background: Rey's family computer was previously infected with password-stealing malware that exposed credentials his father used for Royal Jordanian Airlines portals. No link to the Boeing intrusion is stated (krebsonsecurity.com).
  • Dutch press reports that investigators suspect Van der Stap of trying to orchestrate at least two murders abroad. His employer, Neo Security, has found no evidence he acted against it or its clients (krebsonsecurity.com).

Remediação

  • Apply Oracle's patch (the 10 June out-of-band security alert fix) for CVE-2026-35273 on all PeopleSoft instances, and stay on a supported PeopleTools release (thehackernews.com). WAF rules alone are insufficient because of the URL-encoding bypass, and Mandiant states path-based WAF blocking is not a substitute for patching (thehackernews.com).
  • If patching is not yet possible, disable the Environment Management Hub service in multi-server setups, or remove the PSEMHUB application in single-server setups, per Oracle's alert (thehackernews.com).
  • Review PeopleSoft and SaaS logs for exploitation since at least 27 May 2026, and rotate credentials for exposed SaaS and portal accounts. Rotate all credentials reachable from the PeopleSoft tier.
  • Treat any host with a web shell as compromised and preserve evidence (thehackernews.com). Consider checking PeopleSoft hosts for unexpected files in the PSEMHUB WAR path and in envmetadata/data/environment/. This is an inference from the ZDI analysis (thezdi.com), not a stated recommendation.
  • Do not reuse credentials across portals, and train help desk and employees against voice phishing and spoofed login pages.
  • Prepare for extortion, and monitor for extortion contact and harassment aimed at employees and their families.

Relatos divergentes

  • Role of the arrested suspect: the FBI calls him "one of the alleged leaders" of ShinyHunters, while Dutch police say only that he played a role (bitdefender.com).
  • Arrest date: "around Sept. 16" (krebsonsecurity.com, 28 September) versus "15 September" (krebsonsecurity.com, 7 October). The later report is more specific.
  • Timing of the FBI breach: the FBI breach followed "days" after the arrest (krebsonsecurity.com) or was disclosed about a week later (bitdefender.com).
  • Initial access vector: the use of CVE-2026-35273 against the FBI site is ShinyHunters' own claim, and bitdefender.com says it is not independently confirmed. The Reuters detail on the unpatched contractor system reported by krebsonsecurity.com is consistent with it.
  • Rey's status: the earlier report (28 September) described him as the person who took over the group. The 7 October report says he has been detained and is cooperating with the FBI, so it is the more current.
  • Start of exploitation: the earlier record said the flaw was exploited as a zero-day "since June 2026" (krebsonsecurity.com). thehackernews.com, citing Mandiant/GTIG, places zero-day exploitation from 27 May to 9 June, before Oracle's 10 June alert. The later, more specific source is treated as more authoritative.
  • 10 June date: thehackernews.com says Oracle issued its out-of-band alert and fix on 10 June, while thezdi.com says ZDI reported the issue to Oracle on 10 June. The sources do not reconcile the two, and the exact disclosure sequence is unclear.
  • One CVE or three: Oracle patched the chain under a single CVE-2026-35273, but ZDI says three distinct flaws exist and is coordinating separate CVEs. None had been published as of thehackernews.com's report (28 October).

Linha do tempo

  1. thehackernews.com ↗ · pub. 28/10/2026 03:04 · coletado 28/10 06:00

    ShinyHunters-exploited Oracle PeopleSoft zero-day CVE-2026-35273 is three chained flaws, patched under one CVE

    The article adds the exploitation timeline: zero-day use by UNC6240/ShinyHunters from May 27 to June 9, mostly against universities, before Oracle's June 10 out-of-band alert, and a broader September wave across many sectors. It also adds the affected versions (PeopleTools 8.61 and 8.62), CVSS 9.8, CISA KEV listing, the /%50SEMHUB/ WAF bypass and the Oracle and Mandiant remediation guidance. It conflicts with the existing case on the date ZDI reported the flaw to Oracle.

    ler a análise desta fonte

    The article adds the exploitation timeline: zero-day use by UNC6240/ShinyHunters from May 27 to June 9, mostly against universities, before Oracle's June 10 out-of-band alert, and a broader September wave across many sectors. It also adds the affected versions (PeopleTools 8.61 and 8.62), CVSS 9.8, CISA KEV listing, the /%50SEMHUB/ WAF bypass and the Oracle and Mandiant remediation guidance. It conflicts with the existing case on the date ZDI reported the flaw to Oracle.

    The critical Oracle PeopleSoft bug CVE-2026-35273, exploited by ShinyHunters (UNC6240) since May, is three chained vulnerabilities rather than one, according to Bobby Gould of the Zero Day Initiative (ZDI). Oracle fixed all three in an out-of-band security alert on June 10 under a single identifier (CVSS 9.8). ZDI says it is working with Oracle to assign a separate CVE to each, but none had been published as of this week. Mandiant and GTIG attribute exploitation between May 27 and June 9, mostly against universities, so it was a zero-day. A larger September wave hit technology, IT services, healthcare, agriculture, transport and government organizations. The flaw is on CISA's KEV catalog.

    Technical Details

    • Affected: PeopleSoft Enterprise PeopleTools 8.61 and 8.62. An unauthenticated attacker can take over the server over the network.
    • Flaw 1: SSRF in the Integration Gateway (PSIGW) listening connector. The attacker controls both the forwarding address and the full payload, and the handler does not validate the destination.
    • Trust bypass: the Environment Management Hub (PSEMHUB) trusts hosts listed in allowedhosts.properties, which ships with loopback 127.0.0.1 allowed by default. Pointing the SSRF at loopback makes the request pass the check, exposing the internal admin interface.
    • Flaws 2 and 3: (a) a PSEMHUB log-writing command lets the caller control file content and path, allowing a web shell to be written to the application directory and commands to run as the PeopleSoft service account; (b) a malicious XML file is read by Java XMLDecoder when the service next starts, giving code execution without a web shell and leaving less for standard detection to catch.
    • WAF evasion (September wave, Mandiant): ShinyHunters bypassed WAF rules blocking /PSEMHUB/ by URL-encoding one character (/%50SEMHUB/). The server decodes the path while many rules match plain text.

    Remediation

    • Install Oracle's June 10 security alert fix and stay on a supported PeopleTools release. Mandiant states path-based WAF blocking is not a substitute for patching.
    • If patching is not yet possible, disable the Environment Management Hub service in multi-server setups, or remove the PSEMHUB application in single-server setups, per Oracle's alert.
    • Treat any host with a web shell as compromised, preserve evidence, and rotate all credentials reachable from the PeopleSoft tier. Prepare for extortion.
    • The sources do not settle whether patching removes access already gained. Mandiant's guidance assumes it does not, so hunt for web shells and malicious XML files.
  2. thezdi.com ↗ · pub. 27/10/2026 13:39 · coletado 27/10 15:01

    CVE-2026-35273: Oracle PeopleSoft SSRF-to-RCE chain mass-exploited by ShinyHunters, ZDI details three flaws

    ler a análise desta fonte

    Trend Micro's Zero Day Initiative (TrendAI) published a technical analysis of CVE-2026-35273, an Oracle PeopleSoft vulnerability chain that Mandiant reported on September 25, 2026 as under continued mass exploitation by ShinyHunters. ZDI reported the issue to Oracle on June 10, 2026. Oracle patched it under a single CVE, although researchers reported three distinct flaws across PeopleSoft components, and ZDI is coordinating separate CVE assignments. The chain starts with an SSRF in the Integration Gateway that bypasses the Environment Management Hub's host allow-list, then reaches RCE via an arbitrary file write or unsafe deserialization.

    Technical Details

    • Bug 1, PSIGW SSRF (ZDI-CAN-31816): a POST to /PSIGW/HttpListeningConnector with the HttpTargetConnector handler lets the attacker control both the target URL and the full payload. The handler performs no validation of the target. Pointing it at http://127.0.0.1:8000 makes the request originate from localhost.
    • validateClient bypass: PSEMHUB restricts access using validateClient, which checks the requester against allowedhosts.properties. Localhost is allowed by default, so the SSRF satisfies the check.
    • Bug 2, PSEMHUB external control of file path (ZDI-CAN-31818): the ExecuteProcessActivityCommand handler lets the caller set both file content (m_line) and absolute path (m_targetFile) with no validation. Writing a web shell into the PSEMHUB WAR path gives immediate RCE as the PeopleSoft service account.
    • Bug 3, PSEMHUB deserialization of untrusted data (ZDI-CAN-31817): using any file write primitive, an attacker can place a malicious XML file in [docroot]/envmetadata/data/environment/. On the next HubServlet initialization (for example after a restart), HubMBeanPersistance loads each file with Java XMLDecoder, executing the payload before the cast to Environment throws. This avoids a JSP web shell and is less likely to be detected.
    • The article states the attacker cannot reach PSEMHUB directly, so the SSRF is the necessary pivot from low-privileged access.

    Remediation

    The article does not give explicit remediation steps beyond noting that Oracle has issued a patch. Defenders should apply the Oracle patch for CVE-2026-35273 and consider reviewing PeopleSoft hosts for unexpected files in the PSEMHUB WAR path and envmetadata/data/environment/, which is an inference rather than a statement from the article.

  3. bitdefender.com ↗ · pub. 01/10/2026 07:53 · coletado 19/10 17:56

    FBI urges ShinyHunters members to surrender after Dutch arrest of alleged leader; group escalates with FBI portal breach and Cl0p extortion

    The article adds the FBI's public appeal, via a video from Brett Leatherman, for remaining ShinyHunters members to turn themselves in. It also notes that Dutch police describe the arrested 24-year-old only as having played a role, whereas the FBI calls him an alleged leader. New detail on the Cl0p incident: ShinyHunters claims to have stolen source code, CMS plugins, Tor private keys and member IP logs, and threatens to publish which companies paid ransoms and how much. The article also says the arrest came about a week before the FBI breach became public.

    ler a análise desta fonte

    The article adds the FBI's public appeal, via a video from Brett Leatherman, for remaining ShinyHunters members to turn themselves in. It also notes that Dutch police describe the arrested 24-year-old only as having played a role, whereas the FBI calls him an alleged leader. New detail on the Cl0p incident: ShinyHunters claims to have stolen source code, CMS plugins, Tor private keys and member IP logs, and threatens to publish which companies paid ransoms and how much. The article also says the arrest came about a week before the FBI breach became public.

    The FBI has publicly called on remaining ShinyHunters members to surrender. Cyber division assistant director Brett Leatherman released a video thanking Dutch police for arresting a 24-year-old in Amsterdam. The FBI calls him "one of the alleged leaders" of the group, while Dutch police say only that he played a role. He is also suspected of attempting to arrange two murders. Leatherman said the arrest changes the situation and could encourage others to share information with authorities. The arrest preceded the public disclosure of the FBI breach by about a week, and observers link a change of leadership to the group's sharp escalation afterwards.

    Technical Details

    • ShinyHunters compromised the FBI's job application portal. The theft included Social Security numbers and personal details of about 5,000 FBI staff, some of whom worked on sensitive China and Russia investigations. Some files held medical and psychiatric records.
    • According to ShinyHunters, initial access came from exploiting the recently patched flaw CVE-2026-35273 in Oracle PeopleSoft PeopleTools. This is the group's claim and the article does not independently confirm it.
    • In mid-September the group claimed to have stolen source code, CMS plugins, Tor private keys and logs (said to reveal member IP addresses) from the Cl0p leak site. It threatened to publish which companies paid Cl0p ransoms, and how much, unless it was paid.

    Remediation

    • The article gives no technical remediation. Defenders running Oracle PeopleSoft should ensure the fix for CVE-2026-35273 is applied.
  4. krebsonsecurity.com ↗ · pub. 07/10/2026 10:48 · coletado 19/10 17:55

    ShinyHunters Member 'Rey' Detained in Jordan Mid-Extortion of Boeing Spin-off Jeppesen ForeFlight; PeopleSoft CVE-2026-35273 Mass-Exploited

    ler a análise desta fonte

    A teenage suspect from Amman, Jordan, using the handle Rey (identified as Saif Al-din Khader), has reportedly been detained by Jordanian authorities and is cooperating with the FBI to identify other ShinyHunters members. According to KrebsOnSecurity sources, ShinyHunters was extorting Jeppesen ForeFlight, a navigation and digital aviation unit Boeing sold to Thoma Bravo in November 2025, when Rey was apprehended. The stolen data is said to include sensitive information that could pose operational safety risks. Boeing acknowledged the claims, while Jeppesen ForeFlight said its operations and products were not affected. The case follows the 15 September arrest in the Netherlands of Pepijn van der Stap (alias "Umbreon"), after which Rey took over the ShinyHunters brand and claimed hacks of the FBI and Cl0p.

    Technical Details

    • ShinyHunters began exploiting CVE-2026-35273 in Oracle PeopleSoft as a zero-day in June 2026. Oracle later issued a fix, and Mandiant published WAF rules as a stopgap.
    • In recent weeks the group bypassed Mandiant's suggested WAF rules with a well-known URL-encoding trick.
    • A 25 September Mandiant/GTIG report confirmed mass exploitation against dozens of systems in higher education, technology, healthcare, agriculture, transportation and government.
    • The compromised FBI recruitment website exposed data on more than 5,000 FBI personnel, including unit, specialization, and medical and psychiatric records. Reuters reported that the FBI removed an Accenture contractor for failing to patch it.
    • Sources say the FBI is now focused on a handful of freelancers and affiliates who supply stolen credentials for SaaS platforms in exchange for a share of ransoms.
    • ShinyHunters now operates as a franchise, and the people using the name differ from its original, largely French, core members.
    • Rey's family computer was previously infected with password-stealing malware, which exposed credentials his father used for Royal Jordanian Airlines portals. This is background only, and no link to the Boeing intrusion is stated.
    • The Dutch press reports that investigators suspect Van der Stap of trying to orchestrate at least two murders abroad. Neo Security, his employer, has found no evidence he acted against it or its clients.

    Remediation

    • Apply the Oracle patch for CVE-2026-35273 on all PeopleSoft instances. WAF rules alone are insufficient because of the URL-encoding bypass.
    • Review PeopleSoft and SaaS logs for exploitation since June 2026, and rotate credentials for exposed SaaS and portal accounts.
    • Do not reuse credentials across portals, and monitor for extortion contact and harassment aimed at employees and families.
  5. krebsonsecurity.com ↗ · pub. 28/09/2026 12:08 · coletado 19/10 17:55 primeiro registro

    ShinyHunters Suspect Arrested in Netherlands as Group Mass-Exploits Oracle PeopleSoft CVE-2026-35273 and Breaches FBI Jobs Site

    ler a análise desta fonte

    Dutch authorities arrested a 24-year-old, reportedly Pepijn van der Stap (alias "Umbreon"), around Sept. 16, 2026 on suspicion of aiding data thefts and extortions by ShinyHunters. Van der Stap was previously convicted in 2023 for data theft and extortion. Days after the arrest, remaining ShinyHunters members escalated, breaching the FBI jobs site apply.fbijobs.gov and reportedly extorting the Cl0p ransomware group. The stolen FBI data includes SSNs, personal data on more than 5,000 officials, and psychiatric and medical files. Sources say the escalation followed a takeover of ShinyHunters by a Jordanian teenager known as Rey of ScatteredLapsussHunters (SLSH), who may have planted the Umbreon imagery to implicate the Dutch suspect. Dutch media later reported investigators suspect Van der Stap tried to orchestrate at least two murders abroad, and the FBI publicly urged remaining members to surrender.

    Technical Details

    • ShinyHunters claims it breached the FBI site and other victims by exploiting CVE-2026-35273 in Oracle PeopleSoft, reportedly as a zero-day from June. Oracle has since patched the flaw.
    • Mandiant published WAF rules as a mitigation, but BleepingComputer reported that ShinyHunters bypassed them with a URL-encoding trick.
    • A Sept. 25 Mandiant/GTIG report confirmed mass exploitation against dozens of systems in higher education, technology, healthcare, agriculture, transportation and government.
    • In the February 2026 Odido intrusion, a Dutch-speaking caller socially engineered an employee into logging in at a spoofed website, leading to theft of data on more than 6.2 million people.
    • The FBI site was defaced with an ASCII Umbreon design identical to one used in the 2020 Hackforums hack.
    • Mandiant's Austin Larsen estimates ShinyHunters is on track for nearly $100 million in extortion payments in 2026.
    • Wired reported that ShinyHunters and SLSH briefly partnered to monetize credentials stolen by TeamPCP, then fell out.

    Remediation

    • Apply Oracle's patch for CVE-2026-35273 on PeopleSoft instances.
    • Do not rely solely on the Mandiant WAF rules, since a URL-encoding bypass has been reported.
    • Review PeopleSoft systems for signs of compromise and data theft.
    • Train help desk and employees against voice phishing and spoofed login pages.