FBI (Victim): news timeline & CVEs

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

UNC6240 bypasses WAFs to mass-exploit Oracle PeopleSoft CVE-2026-35273 and deploy web shells and SIDEEYE.

Google-owned Mandiant warns that ShinyHunters-linked UNC6240 is again mass-exploiting CVE-2026-35273, a CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle PeopleSoft. The group bypasses web-application firewalls by URL-encoding a single character in the PSEMHUB path, then uses Java deserialization to plant JSP web shells, a signed Ple64.exe loader for the SIDEEYE backdoor, MeshAgent, and Neo-reGeorg tunnels. The flaw was first used as a zero-day against academic institutions; Mandiant previously notified more than 100 organizations, mostly in the United States, and the new wave hits education, technology, healthcare, government, and other sectors. Separately, ShinyHunters claim they breached FBIJobs.gov with a different PeopleSoft zero-day and took about 2-3 TB of data, saying it was not for ransom.

The Hacker Newsupdated Sep 26, 19:03 UTC · 13h agofirst Sep 26, 11:46 UTC · 20h agoExploit / PoC in the wild 21 sources CVE-2026-352732· 1 read

ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'

ShinyHunters says it stole FBI personnel files via an Oracle PeopleSoft zero-day to rebut an FBI bulletin.

ShinyHunters told The Register it breached FBIJobs.gov through an Oracle PeopleSoft zero-day, then accessed FBI-managed servers on AWS GovCloud and stole thousands of files on current, former, and prospective employees. Sample files reviewed by journalists reportedly include home addresses, phone numbers, emails, Social Security numbers, job titles, field offices, and emergency contacts. The FBI said it is investigating a claimed compromise of FBIJobs.gov and possible employee PII exposure, and that the entry point is still undetermined. The group said it sought no extortion payment and framed the intrusion as a response to a May 2026 FBI FLASH report.

The Register · Securityupdated Sep 26, 19:03 UTC · 13h agofirst Sep 25, 18:23 UTC · 1d agoData breach in the wild 21 sources

ShinyHunters Claims Access to FBI Systems

ShinyHunters claims it breached FBI systems, defaced a recruitment site, and stole sensitive information.

SOCRadar reports that ShinyHunters claims it breached FBI systems, defaced part of an FBI recruitment website, and stole sensitive information. The allegation comes days after the group was reported to have hijacked Clop’s dark-web leak site. The item gives no independent confirmation, data volume, or technical details of how access was obtained.

SOCRadarupdated Sep 26, 19:03 UTC · 13h agofirst Sep 24, 10:41 UTC · 2d agoData breach 21 sources

FBI Hack Exposed FBI’s Own Hacking Unit

ShinyHunters' FBIJobs.gov breach exposed personal data on about 5,000 FBI staff, including Remote Operations Unit members.

404 Media reports ShinyHunters shared records on about 5,000 alleged FBI officials, including addresses, phone numbers, job titles, and in some cases spouses. Three entries reference remote operations units, the FBI hacking team historically associated with dark-web network investigative techniques. The FBI said it is investigating a claimed compromise of the FBIJobs.gov portal and has not determined whether the entry point was a third party or FBI systems. Reuters reported some titles relate to China or Russia investigations, and 404 Media said it verified portions of the data.

404 Mediaupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 22:15 UTC · 3d agoData breach in the wild 21 sources

FBI investigating alleged ShinyHunters breach of its jobs site

The FBI is investigating a breach of its jobs website by the ShinyHunters group, which claims to have stolen data on agents and applicants.

The FBI is investigating a breach of its job applications website, FBIjobs.gov, by the ShinyHunters cybercriminal group. The group defaced the website and claimed to have stolen information on current and former employees and applicants, providing samples of 5,000 FBI agent records to verify the claim. The breach is linked to a dispute over an FBI public service announcement that ShinyHunters says contains false claims about its activities.

The Recordupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 14:22 UTC · 3d agoData breach 21 sources

ShinyHunters claims FBI breach after alleged PeopleSoft zero-day attack

ShinyHunters claims to have breached the FBI via a PeopleSoft zero-day, stealing employee data as retaliation for a prior law enforcement advisory.

The ShinyHunters cybercrime group claims to have breached the U.S. FBI, allegedly using an Oracle PeopleSoft zero-day to steal 2-3 TB of data, including employee and applicant PII. The FBI is investigating the claim but has not confirmed a compromise. ShinyHunters states the attack was a response to a May 2026 FBI advisory, using the alleged breach as leverage to demand a retraction.

Security Affairsupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 13:56 UTC · 3d agoData breach 21 sources CVE-2026-35273

ShinyHunters claims FBI breach was revenge for “false” report

ShinyHunters claims it breached the FBI and stole personal data on agents and job applicants.

Extortion group ShinyHunters posted that it compromised FBI services including Criminal Justice, HR, and Medlink, and that it holds sensitive data on nearly all FBI agents and job applicants. It gives the bureau one week to remove or correct a May 15, 2026 FBI/IC3 advisory, while denying harassment, swatting, sextortion, and any link to The Com, and says the demand is not financially motivated. 404 Media reported that the group supplied a sample on roughly 5,000 agents, including names, home addresses, phone numbers, and spouse details.

Malwarebytes Labsupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 12:03 UTC · 3d agoData breach 21 sources

ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day

ShinyHunters claims FBI breach via PeopleSoft zero-day, alleging theft of data on 5000 employees.

ShinyHunters claims to have breached the FBI via a zero-day vulnerability in Oracle PeopleSoft, allegedly stealing data on 5000 FBI employees and applicants. The group posted a data sample and claims to have pivoted to AWS GovCloud servers, downloading 2-3TB of data. The attack appears motivated by retaliation for an FBI public service announcement, with the group also defacing the FBI jobs website.

Infosecurity Magazineupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 10:00 UTC · 3d agoData breach 21 sources

Risky Bulletin: Network of 10,000 AI servers masks Chinese malicious activity

Researchers uncovered 10,000 Chinese proxy servers masking malicious AI activity, while Ukrainian hackers leaked Russian naval secrets and ShinyHunters claimed an FBI hack.

Security researchers discovered a network of over 10,000 proxy servers originating from China that are being used to mask malicious AI activity, including bypassing region bans and conducting distillation attacks against frontier AI labs. Separately, a Ukrainian hacking group leaked technical documentation on more than 70 Russian naval projects, and the ShinyHunters group claimed to have hacked the FBI's job portal and stolen applicant data. A massive BGP incident caused by an Iranian AS affected internet access in more than 100 countries.

Risky Business NewsSep 23, 06:06 UTC · 4d agoThreat actor in the wild

ShinyHunters Claims FBI Breach Exposed Data of All Employees and Applicants

ShinyHunters claims it stole FBI employee and applicant data via an unverified PeopleSoft zero-day; the FBI is investigating.

ShinyHunters claims it breached FBI-linked systems and stole personal data on nearly all employees and applicants, including names, addresses, phone numbers, dates of birth, and spouse details. The group showed a sample of about 5,000 purported personnel records; some matched public records, but that does not confirm an FBI origin or the full claim. It alleged an unverified Oracle PeopleSoft zero-day and later access to an Amazon-hosted government cloud, plus defacement of FBIjobs.gov. The FBI says it is investigating unauthorized activity on that site and has not verified the theft, its scope, or the entry method.

GBHackersupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 05:06 UTC · 4d agoData breach 21 sources

ShinyHunters Allegedly Claims Breach of FBI Jobs Site and Stolen Agents’ Data

ShinyHunters claims it breached FBI jobs systems, defaced the portal, and stole personnel records; the FBI is investigating.

The FBI said it is investigating claims of unauthorized activity affecting FBIjobs.gov after apply.fbijobs.gov briefly showed a ShinyHunters seizure notice and the bureau took the jobs application service and Special Agent Applicant Portal offline. ShinyHunters told reporters it exploited an undisclosed unauthenticated remote-code-execution flaw in Oracle PeopleSoft, moved into FBI-managed AWS GovCloud, and downloaded two to three terabytes, including HR and medical-related data. A sample of 5,000 purported employee records included names, addresses, phone numbers, Social Security numbers, assignments, dates of birth, and relative details; Reuters partially matched at least 10 cases, but neither Reuters nor 404 Media proved the sample came from FBI systems. Oracle, AWS, and the FBI have not validated that account, and the wider breach remains unproven.

Cyber Security Newsupdated Sep 26, 19:03 UTC · 13h agofirst Sep 23, 02:43 UTC · 4d agoData breach in the wild 21 sources

ShinyHunters escalates dispute with FBI; claims to have seized job applicants’ site and acquired data

ShinyHunters claims it stole FBI employee and applicant data, including agents' home details.

ShinyHunters told 404 Media it breached multiple FBI-related services and stole data on FBI employees and job applicants. A group representative said the data includes agents' names, home addresses, phone numbers, and spouse information. Joseph Cox reported the claim; this excerpt does not include FBI confirmation or technical details of the intrusion.

DataBreaches.netupdated Sep 26, 19:03 UTC · 13h agofirst Sep 22, 18:43 UTC · 4d agoData breach 21 sources

Hacking group ShinyHunters claims it breached the FBI, stole agents’ and applicants’ data

ShinyHunters says it stole FBI agent and applicant data via PeopleSoft and a government cloud.

ShinyHunters claimed on its leak site that it stole sensitive data on almost all FBI agents and people who applied for FBI jobs. 404 Media reviewed a sample of names, home addresses, and phone numbers for agents and their spouses and verified part of it against public records. The hackers said they breached an Oracle PeopleSoft server, pivoted into an Amazon-hosted government cloud, took terabytes of data, and defaced the FBI jobs portal, demanding removal of an FBI report rather than payment. The FBI had not commented; the report also notes an earlier intrusion into an FBI wiretap system and a separate Handala leak of Director Kash Patel's email.

TechCrunch · Securityupdated Sep 26, 19:03 UTC · 13h agofirst Sep 22, 18:40 UTC · 4d agoData breach 21 sources

‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees

ShinyHunters claims a PeopleSoft zero-day breach exposing personal data on FBI employees and applicants.

ShinyHunters told 404 Media it breached FBI-related services with a zero-day in Oracle PeopleSoft, reached AWS GovCloud, and downloaded 2–3 terabytes. The group says the haul includes names, home addresses, phone numbers, dates of birth, and spouse details for FBI employees and applicants, plus PII and PHI on former staff. It provided a sample of about 5,000 records; some phone numbers matched the listed names in OSINT checks. The FBI jobs site was defaced and remained unavailable, and the FBI had not commented. The actors described the goal as coercion rather than a ransom demand.

404 Mediaupdated Sep 26, 19:03 UTC · 13h agofirst Sep 22, 16:48 UTC · 4d agoData breach in the wild 21 sources1

FBI

Timeline14 articles

Related CVEsby mentions

Appears with