Actor Profile

ShinyHunters is a financially motivated extortion gang known for data theft and extortion operations. The group targets organizations with vulnerable internet-facing applications to exfiltrate sensitive data and leverage it for ransom demands. ShinyHunters has historically focused on exploiting unpatched vulnerabilities in enterprise software to gain initial access and conduct large-scale data breaches.

TTPs (Tactics, Techniques, Procedures)

ShinyHunters is exploiting CVE-2026-35273, a vulnerability in Oracle PeopleSoft, using URL-encoding techniques to bypass web application firewall (WAF) protections. This evasion technique allows the group to circumvent security controls designed to block exploitation attempts. The attack chain likely involves initial access via the PeopleSoft vulnerability (T1190 - Exploit Public-Facing Application), defense evasion through obfuscation (T1027 - Obfuscated Files or Information, specifically URL encoding), and subsequent data exfiltration for extortion purposes (T1567 - Exfiltration Over Web Service).

Targets & Patterns

ShinyHunters is targeting organizations in the Enterprise Software sector that run vulnerable Oracle PeopleSoft servers exposed to the internet. The focus on PeopleSoft indicates targeting of large enterprises, educational institutions, government agencies, and healthcare organizations that commonly deploy this enterprise resource planning (ERP) system. The group exploits organizations that have implemented WAF rules but have not applied vendor patches, creating a false sense of security. The motivation is financial gain through data theft and extortion, leveraging access to sensitive HR, financial, and operational data typically stored in PeopleSoft systems.

Historical Context

ShinyHunters has been active since at least 2020 and has been linked to numerous high-profile data breaches involving the theft and sale of customer databases from various organizations. The group has previously demonstrated expertise in exploiting web application vulnerabilities and has been associated with the leak and sale of data from companies across multiple sectors. This campaign represents a continuation of their operational pattern: identifying vulnerable enterprise applications, exploiting them at scale, and using stolen data for extortion. The use of WAF bypass techniques demonstrates the group's evolving technical capabilities and adaptation to defensive measures.

Defensive Recommendations

  • Immediately apply Oracle security patches for CVE-2026-35273 on all PeopleSoft instances; WAF rules alone are insufficient protection
  • Review and update WAF rulesets to detect URL-encoded variants of exploit payloads, including multiple encoding layers and mixed-case encoding
  • Monitor for T1190 (Exploit Public-Facing Application) by analyzing web server logs for unusual PeopleSoft access patterns, particularly requests with URL-encoded characters targeting known vulnerable endpoints
  • Implement network segmentation to limit internet exposure of PeopleSoft servers and require VPN or zero-trust access for administrative interfaces
  • Deploy endpoint detection and response (EDR) on PeopleSoft servers to detect post-exploitation activity such as credential dumping, lateral movement, or data staging for exfiltration