ShinyHunters

Hackers breached the Pentagon's Defense Manpower Data Center (DMDC) human resources management system between October 2025 and July 2026 by exploiting a vulnerability in its file-sharing systems. The breach exposed sensitive personally identifiable information (PII) of over 3 million individuals, including active and deceased military personnel. Data stolen includes Social Security numbers, names, dates of birth, contact information, and military personnel details. The incident is linked to the ShinyHunters extortion gang, which also claimed responsibility for a separate breach of the FBI's FBIjobs.gov site using an Oracle PeopleSoft zero-day vulnerability.

Threat actor UNC6240, linked to ShinyHunters, is exploiting CVE-2026-35273, a critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft, to deploy web shells and establish persistent access. The attackers bypass web application firewall (WAF) protections by URL-encoding the 'P' character as '%50' in requests to the vulnerable PSEMHUB endpoint. Exploitation leads to fileless command execution, deployment of JSP web shells, and installation of the SIDEEYE backdoor and Neo-reGeorg tunneling toolkit for data exfiltration and lateral movement. Targets span multiple sectors including education, healthcare, government, and technology, with the threat actor demonstrating root- and SYSTEM-level access on compromised systems.

The ShinyHunters threat actor, tracked as UNC6240, is exploiting CVE-2026-35273 in Oracle PeopleSoft systems using a WAF bypass technique involving URL-encoded paths (e.g., '/%50SEMHUB/') to evade detection. This allows continued exploitation of unpatched servers where WAF rules were expected to block access. The attackers deploy JSP web shells (x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx), execute in-memory commands, and deploy the SIDEEYE backdoor via 'Ple64.exe' on Windows systems. They also use Neo-reGeorg for tunneling and MeshAgent for persistence on Linux systems, targeting sectors including education, government, healthcare, and technology.

The Clop ransomware gang's data leak site was compromised by the ShinyHunters extortion group through an unpatched path traversal vulnerability in Grav CMS version 1.7.43. ShinyHunters exploited the flaw to upload malicious files, deface the site, and claim theft of source code, plugins, server logs, and Tor private keys, subsequently issuing a ransom demand. Grav CMS confirmed the vulnerability, tracked as CVE-2026-42608, resides in the core of Grav and was fixed in Grav 2.0 but not backported to the 1.7 branch until version 1.7.53.4 was released following disclosure.

ShinyHunters, a cyber extortion group, claimed responsibility for breaching the U.S. Federal Bureau of Investigation (FBI), asserting they exfiltrated sensitive data on current and former agents and job applicants. The group reportedly exploited a zero-day vulnerability in Oracle PeopleSoft to gain remote code execution and deface the FBI's jobs portal, FBIjobs.gov, with a taunting banner. They linked the attack to retaliation for an FBI public service announcement criticizing their prior activities, particularly around the Canvas LMS breach. While the FBI has acknowledged awareness of the claims and is investigating, no technical evidence or data dumps have been independently verified yet.

The ShinyHunters extortion gang claims to have breached FBI systems using an unpatched zero-day vulnerability in Oracle PeopleSoft, enabling remote code execution and lateral movement into FBI-managed AWS GovCloud infrastructure. They allege exfiltration of 2–3TB of sensitive data, including personally identifiable and health-related information of current and former FBI employees and job applicants. ShinyHunters defaced the FBI Jobs website (apply.fbijobs.gov) with their branding and claim to be exploiting the same vulnerability against Fortune 500 companies. The group stated the attack was retaliation for an FBI FLASH report published in May 2026, and they have not ruled out releasing the stolen data.

The ShinyHunters cybercrime group breached the Clop ransomware gang's data leak site by exploiting an unauthenticated file upload vulnerability in Grav CMS. They defaced the Tor-based site with ASCII art of Umbreon, their logo, and claimed to have stolen server data including source code, system logs, and the private keys for Clop's onion service. ShinyHunters stated they plan to extort Clop and published a message via the compromised site, marking an escalation in an ongoing feud between the two threat groups.

Anthropic identified multiple threat actors, dubbed Generative Threat Groups (GTGs), leveraging its Claude AI models to automate cyber attacks, including reconnaissance, exploitation, and data exfiltration. These groups include state-sponsored, financially motivated, and ideologically driven actors from Russia, China, Iran, and elsewhere, conducting operations such as credential harvesting, supply chain compromises, AI model theft, and influence campaigns. Specific activities include exploiting a WordPress re-installation race condition, deploying web shells, stealing API keys, and building surveillance platforms. The report highlights the use of autonomous multi-agent frameworks that operate with minimal human intervention across global victims in government, tech, finance, and political sectors.

Microsoft identified two distinct attack campaigns targeting enterprise cloud environments. The first involved a large-scale phishing campaign using CEO impersonation and AI-generated content to trick finance teams into executing fraudulent ACH transfers. The second, more technically sophisticated campaign used social engineering around passkey and MFA updates to compromise Microsoft cloud identities, enabling persistent access through adversary-in-the-middle attacks and abuse of Microsoft Graph API for reconnaissance and data exfiltration. The activity is attributed to multiple threat actor groups, including Storm-3121 and Storm-3032 (UNC6671), with infrastructure linked to known cybercrime collectives.

Threat actors linked to ShinyHunters, Helix, and other extortion gangs are conducting passkey and single sign-on-themed phishing campaigns to compromise corporate Microsoft 365 accounts. The attacks begin with social engineering via phone or messaging, impersonating IT help desks to trick employees into visiting phishing sites or authorizing device-code authentication, enabling adversary-in-the-middle attacks. Attackers perform extensive reconnaissance using Microsoft Graph, persist by adding attacker-controlled MFA methods, and exfiltrate data from SharePoint, OneDrive, and Exchange over prolonged periods to evade detection.