ShinyHunters Renews Mass Exploitation of Oracle PeopleSoft Flaw, Google Says
Sept. 25 (Reuters) – Google’s cybersecurity unit, Mandiant, said Friday that the hacking group ShinyHunters has renewed “mass exploitation” of a security flaw in Oracle’s PeopleSoft software, sidestepping defenses that organizations put in place after earlier attacks.
Mandiant, part of Alphabet-owned Google, disclosed the renewed campaign in a threat intelligence report released days after ShinyHunters claimed responsibility for stealing FBI personnel data. The group has also claimed credit for several other major data breaches.
The renewed activity is likely to raise alarms at organizations that depend on PeopleSoft for human resources, finance, student records and other critical functions. It also highlights how quickly attackers can adapt when defenders rely on partial mitigations rather than fully patching vulnerable systems.
According to Mandiant, ShinyHunters exploited a bug in Oracle’s PeopleSoft enterprise software in attacks from May 27 through June 9 that mainly affected universities. After defensive guidance was published in response, the hackers changed tactics, the report said.
The latest attacks targeted organizations that had implemented web application firewall rules but had not applied an update Oracle issued to patch the vulnerability, Mandiant said. The firm did not identify victims, but said dozens of systems were affected globally.
The affected organizations spanned higher education, technology, healthcare, agriculture, transportation and government, according to Mandiant.
ShinyHunters has said it accessed FBI data through a vulnerability in PeopleSoft. Reuters has not been able to corroborate that claim. Oracle did not respond to requests for comment.
In a statement issued Wednesday, the FBI said it was “aggressively investigating” the reported breach. Reuters has previously reported that ShinyHunters exposed the names of personnel working in sensitive FBI units and obtained medical and psychiatric records.
For security teams, the episode underscores a familiar problem: perimeter defenses such as web application firewalls can slow attackers, but they are not a substitute for patching. Organizations running PeopleSoft may need to verify whether Oracle’s fix has been applied, review logs for signs of exploitation, and assume that credential theft or data exfiltration may already have occurred if vulnerable systems were exposed.
(Reporting by Natalia Bueno Rebolledo and Mrinmay Dey in Mexico City, and Raphael Satter in Washington; Editing by Christopher Cushing)