Full Breakdown
ShinyHunters Resumes Mass Exploitation of Oracle PeopleSoft Vulnerability
By Drooid · · How we work
Renewed Exploitation of PeopleSoft
On September 25, Google’s cybersecurity unit reported that the hacking group ShinyHunters has resumed “mass exploitation” of a flaw in Oracle’s PeopleSoft enterprise software. The renewed campaign follows earlier attacks that ran from May 27 through June 9, which primarily targeted universities. The attackers adapted to defensive guidance issued after the initial wave and focused on organizations that had applied web-application firewall rules but had not installed Oracle’s patch for the vulnerability.
Background on ShinyHunters and Prior Breaches
ShinyHunters has previously claimed responsibility for several high-profile data breaches, including a disclosed theft of FBI personnel data. The group’s activities are tracked by Mandiant, which released a threat-intelligence report days after the FBI breach claim. Reuters has not been able to verify the FBI data theft allegation.
Scope and Affected Sectors
According to Mandiant, the latest exploitation affected dozens of systems worldwide across a range of sectors, including higher education, technology, healthcare, agriculture, transportation, and government. Victims have not been identified publicly, but the breadth of impacted industries underscores the vulnerability of organizations that rely on PeopleSoft for human-resources and other critical functions.
Official Responses
The Federal Bureau of Investigation stated it is “aggressively investigating” the reported breach. Oracle declined to comment when approached for comment. Google’s cybersecurity unit highlighted that the attackers bypassed the update Oracle issued to patch the PeopleSoft flaw, emphasizing the need for timely remediation.
Implications for Organizations
The renewed activity signals that even well-resourced institutions remain at risk if they delay applying security patches. Experts advise that organizations using PeopleSoft should verify that the Oracle update has been installed and review web-application firewall configurations to ensure comprehensive protection against similar exploitation attempts.