ShinyHunters Claims Unprecedented FBI Breach: Inside the Oracle PeopleSoft Zero-Day Attack and Dark Web Turf Wars

The rivalry between federal law enforcement and organized cybercrime syndicates reached a boiling point on Tuesday, September 23, 2026, when the extortion group ShinyHunters claimed to have breached the U.S. Federal Bureau of Investigation. The group alleges it compromised internal systems and exfiltrated data belonging to current and former FBI agents, along with thousands of job applicants. If true, it would be one of the more provocative escalations yet in the running conflict between threat actors and government agencies.

First reported by 404 Media, the attackers are framing the breach not as a simple financially motivated heist but as retaliation against a federal warning issued earlier this year. The FBI has acknowledged unauthorized activity on its public-facing jobs portal but hasn’t confirmed that core internal databases were exfiltrated. Regardless of the final tally, the technical mechanics of the intrusion, and the turf war behind it, are worth close attention from enterprise defenders and public-sector CISOs.

The breach: exploiting Oracle PeopleSoft zero-days

According to a statement posted on their dark web leak site, ShinyHunters claims to hold “very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job,” targeting specific internal services including Criminal Justice (CJ), HR, and Medlink. The group stated, “Whether it be a Special Agent or any other role within your agency… The following FBI services were compromised.”

A ShinyHunters spokesperson told The Register the intrusion relied on a new, previously undocumented Oracle PeopleSoft zero-day that grants pre-authenticated remote code execution (RCE). That fits the group’s recent pattern: in June 2026, it used a similar flaw, CVE-2026-35273, to breach more than 100 organizations, including universities and enterprise networks.

Oracle PeopleSoft Internet Architecture (PIA) typically runs on Oracle WebLogic servers. Pre-authenticated RCE chains in this environment have historically exploited the Environment Management component (PSEMHUB) or the Integration Broker (PSIGW) via server-side request forgery (SSRF) that chains into Java Virtual Machine (JVM) deserialization flaws. By bypassing the standard authentication layer, attackers can drop a Java webshell directly into the WebLogic deployment directory. That gives them full administrative control over the underlying HR and applicant-tracking systems without needing valid credentials.

The breach first showed up as a defacement of the FBIjobs.gov portal, plastered with a banner reading “This site has been seized by ShinyHunters.” The FBI’s incident response team moved quickly to contain it. Visitors soon after saw a standard bureau notice instead: “Scheduled Maintenance Underway. We’re Sniffing Out Site Updates for You!” That kind of message is a classic containment tactic, cutting off external connectivity while forensic teams hunt for persistence mechanisms and backdoors. In a statement to Reuters, the FBI said it is “aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.”

The motive: retaliation over the Canvas LMS fallout

Unlike typical ransomware operations aimed at squeezing out the largest possible payday, the FBI breach looks like retaliation. It goes back to May 2026, when ShinyHunters claimed responsibility for a breach of Instructure’s Canvas LMS, a learning management system used by thousands of schools worldwide. That incident reportedly exposed up to 275 million records, making it one of the largest education-sector breaches on record.

In response to the Canvas LMS extortion campaign, the FBI issued a Public Service Announcement (PSA) detailing the threat actor’s tactics and explicitly urging victims not to pay the ransom, which cut off the group’s revenue stream. ShinyHunters took the advisory as a personal affront, and in its own “counter PSA” described the FBI’s warnings as “substantial false allegations.”

“We were very disappointed to see an agency of your standing would resort to such circulation of disinformation in an attempt to ‘disrupt’ our operations, an effort that ultimately proved unsuccessful,” the group wrote. The exchange fits a broader shift: threat actors are increasingly willing to confront federal law enforcement directly and publicly rather than operate only in the shadows.

ShinyHunters vs. Clop: the dark web turf war

The FBI breach isn’t an isolated incident; it’s part of a wider turf war on the dark web. Just days before the FBI claim, ShinyHunters pulled off a humiliating heist against a rival: the Clop (Cl0p) ransomware gang. Between September 18 and 19, 2026, ShinyHunters hijacked Clop’s dark web leak site, the same infrastructure Clop uses to name and shame victims and publish stolen data.

The defacement came with a bizarre, aggressive extortion demand aimed at the rival gang: “IF YOU WANT TO SAVE YOUR BRAND AND NOT DIE BY MY HANDS: […] let’s see how rich you really are. 2.333% of my net worth is a 8 figure amount, I hope you can pay that much because that is the demand, negotiable. Get your bosses in front of the white board in the war room. Clock is ticking moron.”

This move showed off ShinyHunters’ technical reach and nerve. By compromising the infrastructure of an established ransomware syndicate, the group signaled to the criminal underground that it can dismantle its peers’ operational security, not just corporate networks.

Threat actor evolution: SaaS supply-chain and identity abuse

The FBI breach involved a zero-day exploit, but ShinyHunters’ broader 2026 playbook leans heavily on identity-based attacks. The group has increasingly abused OAuth tokens and third-party SaaS integrations, such as Salesforce, Drift, and Gainsight, to keep persistent, stealthy access to cloud environments. By stealing refresh tokens from compromised vendors, attackers can keep generating new access tokens, bypassing passwords and multi-factor authentication (MFA) entirely.

The group also relies heavily on help-desk social engineering, or vishing, to talk support staff into resetting passwords or bypassing MFA for high-value targets. Combining technical exploits like the PeopleSoft zero-day with social engineering makes them a tough adversary for modern enterprises.

In a recent manifesto, ShinyHunters explicitly rejected claims that it’s part of “The Com” (The Community), a decentralized, loosely organized cybercriminal ecosystem that includes groups like LAPSUS$ and Scattered Spider. The group dismissed the affiliation as “propaganda started by the Information Security Industry which has brainwashed past FBI and DOJ officials into formalizing this nonsense.” Intelligence firms disagree: they continue to track overlapping infrastructure and tooling, suggesting “ShinyHunters” may operate more as a fluid brand or franchise within a larger criminal collective than a rigid hierarchy.

Expert analysis: attribution and the shadow of OPM

Etay Maor, VP of threat intelligence at Cato Networks, called the claim an “unusually provocative move” that has to be taken seriously. “We have seen threat actors target businesses countless times, and nation states or nation-state-connected groups have compromised law-enforcement organizations before (the 2015 OPM breach remains the most notable example), but a cybercrime brand publicly claiming an FBI compromise is different,” Maor said.

Maor also pointed to a possible operational clue about attribution: “One small operational clue is the September 23 timestamp on the group’s post, while the news emerged on September 22 in the U.S. If that timestamp reflects the group’s real operating environment, it points toward activity in Asia. It is not a definitive attribution, but it is a detail investigators will examine alongside the technical evidence.”

He also said ShinyHunters is a resilient brand that has outlasted takedowns and arrests by evolving its methods. “Its recent playbook has emphasized abusing trusted identity paths… rather than simply breaking through a technical perimeter. That is the larger lesson here: organizations, including public-sector agencies, need to protect the identity and third-party trust relationships that attackers increasingly exploit.”

Mitigation for defenders

The alleged FBI breach is a wake-up call for organizations running Oracle PeopleSoft and leaning heavily on SaaS integrations. Defenders should move on the following immediately:

• Audit and patch Oracle PeopleSoft instances: Security teams need to verify whether their PeopleTools versions (specifically 8.61 and 8.62) are patched against known CVEs like CVE-2026-35273. Where patching is delayed, admins should disable public-facing components like PSEMHUB and the Integration Broker (PSIGW), or put them behind a strict Web Application Firewall (WAF) that inspects Java deserialization payloads.
• Implement Zero-Trust Network Access (ZTNA): HR and applicant-tracking systems should never be directly reachable from the public internet without rigorous ZTNA controls. Access should be restricted to managed devices with compliant security postures.
• Govern OAuth and SaaS integrations: CISOs should regularly audit third-party OAuth applications in their identity providers (Microsoft Entra ID, Okta, etc.). Unused or overly permissive tokens should be revoked immediately, with conditional access policies that block legacy authentication and flag anomalous token usage.
• Harden help desk protocols: To counter vishing attacks, help desk procedures should require out-of-band verification, such as a video call or manager approval, for any password reset or MFA bypass request. Moving to FIDO2/WebAuthn hardware keys cuts the risk of social engineering compared to SMS or push-based MFA.