The Federal Heist: How ShinyHunters Weaponized an Oracle PeopleSoft Zero-Day to Breach the FBI and Exfiltrate Agent Records
Date: September 23, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Threat Intelligence / Nation-State & Syndicate Attacks / Enterprise ERP Security
Tags: ShinyHunters, FBI, Oracle PeopleSoft, CVE-2026-35273, Zero-Day, Data Breach, ERP Security, Counterintelligence
Executive Summary
In what is rapidly emerging as one of the most audacious cyber-extortion operations of the decade, the prolific cybercrime syndicate ShinyHunters has claimed responsibility for a catastrophic breach of internal Federal Bureau of Investigation (FBI) personnel systems. Reported on September 22–23, 2026, by BleepingComputer, The Hacker News, and Infosecurity Magazine, the threat actors weaponized an unpatched zero-day vulnerability in Oracle PeopleSoft Enterprise PeopleTools (CVSS 9.8 / 10.0, linked to the CVE-2026-35273 exploit chain) to achieve unauthenticated remote code execution.
To substantiate their claims, ShinyHunters defaced the official FBI recruitment and careers website (fbijobs.gov) on September 22, taking the portal offline and replacing its landing page with extortion messages. According to disclosures provided by the syndicate, the breach yielded dozens of gigabytes of unredacted relational database dumps containing sensitive personnel dossiers on active FBI Special Agents, counterintelligence analysts, background investigation files, polygraph results, and federal law enforcement applicants spanning more than a decade.
This brazen attack follows on the heels of ShinyHunters' shocking takeover and defacement of the Cl0p ransomware syndicate's Tor leak site just 24 hours earlier. By demonstrating the capability to acquire, weaponize, and deploy zero-day exploits against tier-one federal law enforcement targets, ShinyHunters has fundamentally altered the threat profile of commercial cyber-extortion collectives.
Technical Deep-Dive: The PeopleSoft Zero-Day Exploitation Chain
Oracle PeopleSoft Enterprise represents the core enterprise resource planning (ERP) and Human Capital Management (HCM) backbone across major federal agencies, military branches, and global enterprises. Compromising a PeopleSoft deployment bypasses perimeter security layers, granting immediate access to core organizational records.+-----------------------------------------------------------------------------------+
| PEOPLESOFT ZERO-DAY INTRUSION PATH |
|---|+-----------------------------------------------------------------------------------+
ShinyHunters Operator FBI Ingress Gateway PeopleSoft PeopleTools Server
| | |
| 1. Dispatches Crafted HTTP Request | |
| to `/PSIGW/PeopleSoftServiceListening`| |
| [Serialized Java Gadget + Auth Bypass]| |
|----------------------------------------->|----------------------------------->|
| | |
| | 2. WebLogic / PeopleTools parses |
| | request without authentication |
| | |
| | [UNAUTHENTICATED DESERIALIZATION] |
| | - Bypasses JEP 290 object filter |
| | - Deserializes malicious gadget |
| | - Spawns WebLogic system process |
| | |
| 3. Interactive Web Shell Established | |
|<==============================================================================|
| |
| 4. Queries Backend Oracle DB Instance: |
| `SELECT * FROM PS_PERSONAL_DATA...` |
| Dumps Agent Dossiers, Clearances, Polygraph Records |
| |
| 5. Pivots to Public Web Frontend (`fbijobs.gov`) |
| Overwrites Index Page -> Public Defacement |
v v
1. The Vulnerability: CVE-2026-35273 (PeopleSoft PeopleTools RCE)
The vulnerability leveraged by ShinyHunters exists within the PeopleSoft Integration Broker, a core middleware subsystem running on Oracle WebLogic Server responsible for facilitating asynchronous data exchange, web services, and third-party integrations.
Under standard PeopleSoft architectures, the Integration Gateway exposes endpoints such as:
* /PSIGW/PeopleSoftServiceListeningServlet
* /PSIGW/HttpListeningConnector
The flaw represents a critical failure in request authentication and Java object deserialization:
1. Authentication Filter Bypass: By manipulating specific HTTP request headers (including forged PS-Authorization and internal routing parameters), an attacker can bypass the security interceptors protecting the Integration Gateway, tricking the servlet into treating the unauthenticated external request as an internally trusted administrative message.
2. Insecure Deserialization: The gateway deserializes structured binary payloads submitted via HTTP POST requests without enforcing strict class whitelisting. By packaging a tailored Apache Commons or Spring framework gadget chain into the request body, the attacker forces the underlying Java Virtual Machine (JVM) to execute arbitrary operating system commands with the privileges of the WebLogic service account.
2. Privilege Escalation & Database Exfiltration
Once command execution was achieved on the PeopleSoft PeopleTools application tier:
* Database Connection Hijacking: PeopleSoft application servers maintain pre-authenticated database connection pools to the backend Oracle Database instance (storing configuration credentials in psappsrv.cfg). The attackers extracted these connection strings, enabling direct querying of the database without having to crack individual user passwords.
* Mass Table Extraction: ShinyHunters systematically dumped primary HCM database tables, including:
* PS_PERSONAL_DATA (Names, Social Security Numbers, dates of birth, residential addresses)
* PS_JOB (Departmental assignments, job titles, field office locations)
* PS_SECURITY_CLEARANCE (Top Secret / SCI clearance statuses and review dates)
* PS_APPLICANT_LOG (Employment applications, interview assessments, and polygraph summaries)
3. Website Defacement as Psychological Leverage
To eliminate plausible deniability by the government and maximize publicity, ShinyHunters pivoted from the internal human resources network to the public-facing recruitment infrastructure hosting fbijobs.gov. Overwriting the web root files, the group placed a public defacement banner before federal administrators took the entire domain offline for emergency maintenance.
National Security & Counterintelligence Fallout
The ramifications of a confirmed breach of FBI personnel infrastructure are catastrophic:
Risk Domain
Operational & Human Consequence
Undercover Operations
Exposure of true identity, home addresses, and familial connections for active undercover agents, putting lives at immediate risk.
Foreign Counterintelligence
Hostile foreign intelligence services (such as Russia's SVR or China's MSS) can cross-reference leaked FBI rosters with border crossing logs, hotel registries, and international travel data to unmask counterintelligence officers.
Blackmail & Coercion
Unredacted polygraph logs, background check interviews, and financial disclosures provide adversaries with psychological leverage and extortion material to compromise federal staff.
Whistleblower & Source Exposure
Personnel notes referencing confidential human sources (CHSs) or law enforcement informants create severe physical security liabilities.
Enterprise ERP Defense & Hardening Blueprint
While this attack targeted a federal law enforcement agency, thousands of corporate enterprises operate identical Oracle PeopleSoft, SAP, and Workday ERP deployments. Organizations must implement immediate architectural hardening.
1. Apply Oracle Security Alert Patches Immediately
Organizations running Oracle PeopleSoft PeopleTools (versions 8.59, 8.60, 8.61) must review Oracle's Security Alert Advisory for CVE-2026-35273 and apply the official CPU/out-of-band patches immediately.
2. Isolate ERP Gateways from the Public Internet (Zero-Trust Enforcement)
Under no circumstances should PeopleSoft administrative interfaces or Integration Broker endpoints (/PSIGW/*) be exposed directly to the public internet:
* Place all ERP web portals behind a Zero Trust Network Access (ZTNA) gateway or enterprise VPN requiring hardware-backed FIDO2 multi-factor authentication.
* Enforce perimeter firewall rules allowing access to the Integration Gateway strictly from explicit, static partner IP addresses.
3. Restrict WebLogic Integration Handlers
If Integration Broker services must accept external webhooks:
* Review integrationgateway.properties and disable all unnecessary listening connectors.
* Implement strict URI filtering at the reverse proxy (e.g., F5 or NGINX) blocking public access to:
* /PSIGW/PeopleSoftServiceListeningServlet
* /PSIGW/HttpListeningConnector
* /PSIGW/PeopleSoftListeningConnector
4. Implement JEP 290 Java Deserialization Filters
Ensure that all JVM instances running WebLogic and PeopleSoft enforce rigorous process-wide serialization filters (JEP 290 / JEP 415) to block the instantiation of dangerous gadget classes even if an application-layer parser fails:h
-Djdk.serialFilter="!org.apache.commons.;!org.springframework.;!com.sun.org.apache.bcel.**;maxarray=100000;maxdepth=20;"
5. Enforce Database Encryption and Dynamic Data Masking
* Implement Oracle Transparent Data Encryption (TDE) across all database tablespaces storing sensitive personal data.
* Enable Oracle Database Vault to prevent application service accounts and database administrators from executing unauthorized bulk `SELECT *` exports against employee personal tables.
Indicators of Compromise (IoCs) & Threat Hunting Signatures
* Target URI Paths:
* `POST /PSIGW/PeopleSoftServiceListeningServlet`
* `POST /PSIGW/HttpListeningConnector`
* Suspicious User-Agent / Exploit Headers:
* Inbound HTTP headers containing serialized Java magic bytes (`\xac\xed\x00\x05`) or anomalous base64 strings in `PS-Authorization`.
* Database Query Spikes:
* Unscheduled, bulk query executions against `PS_PERSONAL_DATA`, `PS_JOB`, and `PS_EMPLOYEE_REVIEW` tables outside standard payroll/batch processing windows.
*For technical threat intelligence, zero-day exploit breakdowns, and enterprise ERP protection strategies, subscribe to Digital Spying.*