Nila Kartika Wati
In the ever-evolving theater of global cyber warfare, few names evoke as much concern among enterprise security teams as "ShinyHunters." A notorious threat group that has operated in the shadows since 2019, the collective has recently pivoted to a new campaign, targeting critical enterprise infrastructure—specifically Oracle PeopleSoft environments—with surgical precision. New intelligence from cybersecurity giant Mandiant reveals a sophisticated, methodical approach to data exfiltration that has forced a scramble across the corporate sector to identify and patch vulnerabilities before sensitive data ends up on the group’s infamous Data Leak Site (DLS).
While some organizations have successfully thwarted these incursions, others have found themselves on the wrong side of the digital divide, watching as massive troves of proprietary and customer data are published to the dark web. The campaign serves as a sobering reminder that even the most robust enterprise software is only as secure as its weakest configuration.
The Anatomy of an Incursion: Main Facts
The current campaign centers on the exploitation of critical vulnerabilities within Oracle PeopleSoft, an enterprise resource planning (ERP) software suite that manages everything from human resources to financial operations for some of the world’s largest companies.
According to Mandiant, the threat actors are not merely running automated scripts; they are conducting active reconnaissance to map the internal architecture of their victims. Forensic analysis of a bash script recovered from a compromised staging environment paints a picture of a calculated adversary. Once inside the perimeter, attackers systematically mapped PeopleSoft configurations, examined process scheduler settings, and scrutinized WebLogic server XML configurations to identify high-value data targets.
Once the reconnaissance phase was complete, the attackers established outbound SSH connections to a specific IP address: 176.120.22.24. This address serves as the host for the ShinyHunters DLS. The exfiltration process was highly efficient, utilizing the zstd compression tool to shrink stolen data sets for rapid transit. In one documented instance, the attackers successfully moved 48GB of data from a single victim, underscoring the scale and speed of their operations.
A Chronology of Chaos
The resurgence of ShinyHunters is not an isolated event but rather the latest chapter in a long-standing chronicle of digital disruption. Since its emergence in 2019, the group has become synonymous with large-scale, high-impact data breaches.
2019–2023: Establishing a Reputation
ShinyHunters first gained notoriety for its ability to breach major corporations and aggregate vast quantities of user records. Their methodology has always been eclectic, ranging from sophisticated supply chain attacks to simple, effective social engineering. They have historically targeted companies across the retail, financial, and tech sectors, often selling data on illicit marketplaces before establishing their own dedicated leak site.
2024: The Snowflake Connection
One of the most defining moments for the group was the 2024 campaign that leveraged credentials harvested from the Snowflake cloud environment. This attack resulted in downstream breaches for major entities, including Ticketmaster and the Spanish banking giant Santander. This incident signaled a shift toward "cloud-first" exploitation, where attackers target the underlying platforms that host business data rather than the businesses themselves.
2025–2026: The PeopleSoft Pivot
The most recent phase of their activity involves a laser-focus on Oracle PeopleSoft. By exploiting zero-day vulnerabilities (such as CVE-2026-35273, as noted by Rapid7), the group has managed to bypass standard authentication measures. The current campaign, which reached a fever pitch in mid-2026, involves the systematic targeting of organizations that have failed to patch their ERP environments or have left development/staging environments exposed to the open internet.
The Modus Operandi: Tactics, Techniques, and Procedures (TTPs)
ShinyHunters is rarely a one-trick pony. Their success is attributed to their versatility, utilizing a "Swiss Army knife" approach to network penetration.
1. Exploiting Cloud Misconfigurations
The group excels at identifying "low-hanging fruit." This often includes S3 buckets left open, insecure API endpoints, or misconfigured cloud access policies that allow for lateral movement from a public-facing asset into the internal database.
2. Supply Chain Attacks
By compromising a vendor or a third-party service provider, ShinyHunters has repeatedly gained "trusted" access to the internal networks of much larger, more secure organizations. This was the mechanism behind the Salesforce-linked breaches, which eventually impacted Google and numerous other high-profile tech firms.
3. Social Engineering and Phishing
Despite their technical prowess, the group relies heavily on human fallibility. Voice phishing (vishing) and highly targeted business email compromise (BEC) campaigns are staples of their arsenal. By tricking employees into providing OAuth tokens or MFA codes, the group effectively renders complex security stacks irrelevant.
4. Direct Exploitation
The current PeopleSoft campaign highlights their ability to weaponize software vulnerabilities. By deploying custom scripts, they can automate the discovery and exfiltration process once a single, unpatched server is identified.
Official Responses and Remediation
The security community has not remained idle. Mandiant, in collaboration with Rapid7 and other intelligence partners, has released detailed Indicators of Compromise (IoCs) to help organizations scan their environments for signs of breach.
Advice for Oracle PeopleSoft Customers
Security researchers are urging all PeopleSoft administrators to take the following steps immediately:
- Audit Outbound Traffic: Monitor for unauthorized SSH connections, particularly those directed toward known malicious infrastructure or suspicious IP ranges.
- Patch Management: Ensure that the latest security patches for PeopleSoft and the associated WebLogic servers are applied immediately. CVE-2026-35273 should be the highest priority for remediation.
- Configuration Review: Conduct a thorough audit of all XML configurations and process scheduler settings. Remove any extraneous accounts or services that are not strictly necessary for production operations.
- Environment Segregation: Ensure that staging and development environments are strictly firewalled from production networks and are not accessible from the public internet.
The Broader Implications for Enterprise Security
The ShinyHunters campaign serves as a case study for the fragility of the modern digital enterprise. There are several critical takeaways for C-suite executives and IT security teams.
The Myth of the "Secure Perimeter"
The days of relying solely on firewalls and basic access controls are long gone. The ShinyHunters methodology demonstrates that attackers are increasingly living "off the land," utilizing legitimate tools and configurations within the target environment to achieve their goals. The "assume breach" mindset is no longer optional; it is a necessity.
The Cost of Technical Debt
Many of the organizations hit by ShinyHunters suffered because they were running outdated versions of enterprise software. Maintaining legacy systems is a massive security liability. The cost of upgrading and patching must be viewed not as an IT expense, but as a critical insurance policy against the catastrophic financial and reputational damage of a data breach.
Third-Party Risk Management
The ripple effect of the Snowflake and Salesforce breaches proves that a company’s security is only as strong as its weakest vendor. Organizations must perform rigorous due diligence on all cloud providers and third-party software vendors, ensuring that they share the same commitment to proactive threat hunting and security hygiene.
Transparency and Disclosure
Finally, the existence of the ShinyHunters DLS serves as a grim accountability mechanism. When a company is breached, the data doesn’t just disappear; it is made public. This shifts the stakes from mere data loss to a total breakdown of customer trust. As privacy regulations like GDPR and CCPA become more stringent, the financial penalties for such failures are compounding, making the investment in robust cybersecurity more economically rational than ever.
Conclusion
As we look toward the future, the activities of groups like ShinyHunters will likely become more automated and more persistent. The "PeopleSoft campaign" is likely just one of many that will emerge as attackers continue to probe the world’s most critical software ecosystems.
For organizations, the message is clear: technical brilliance alone is insufficient. Security must be integrated into the architecture of the business. By focusing on fundamental hygiene, aggressive patch management, and a culture of vigilance, companies can transition from being targets to being resilient. However, as long as there is value in stolen data, the "hunters" will continue to prowl. The defense, therefore, must be constant, evolving, and absolute.
Asro
Lina Hope
