ShinyHunters claims FBI hack: 'This is NOT financially motivated'
ShinyHunters claims an Oracle PeopleSoft zero-day let it steal 2–3 TB of FBI employee data.
ShinyHunters told The Register it exploited an Oracle PeopleSoft pre-authentication remote-code-execution zero-day on the FBI jobs website, defaced the page, and moved laterally to FBI systems on AWS GovCloud. The group claims it took about 2 to 3 terabytes on current, former, and prospective employees, including human resources, MedLink, and Criminal Justice Information Services. It says it is not seeking payment and instead wants the FBI to retract a May 15 bulletin alleging harassment, swatting, and false extortion claims. The FBI, Oracle, and AWS had not responded or confirmed the allegations at publication.
- Alleged PeopleSoft zero-day enabled remote code execution on the FBI jobs site.
- Group claims 2–3 TB from AWS GovCloud covering employees and applicants.
- No ransom is demanded; it wants an FBI bulletin retracted.
- The FBI, Oracle, and AWS had not confirmed the allegations.
Full article436 words · extracted from theregister.com · click to collapse
security
This time it's personal
ShinyHunters claims it hacked the FBI and stole more than 2 TB of employee data - and this time it’s personal. The gang wants the Feds to correct the record on how it operates.
“This is NOT financially motivated,” a Shiny spokesperson told The Register. “We want the FBI to correct or retract their statements they made, which included substantial false allegations.”
The FBI did not immediately respond to The Register’s request for comment.
REG AD
According to a ShinyHunters spokesperson, the extortion group exploited an Oracle PeopleSoft zero-day vulnerability on the FBI jobs webpage, which it says allowed remote code execution (RCE) on the servers. The group then defaced the website, replacing it with a “This site has been seized by ShinyHunters” banner and image shared with The Register.
REG AD
At press time, the site says it is “currently down for maintenance but will be back up soon!”
ShinyHunters also claims it moved laterally from the compromised site onto the FBI’s managed servers on AWS GovCloud, and downloaded about 2 TB to 3 TB of data belonging to current, former, and prospective FBI employees.
“We hold data on all FBI employees and applicants,” the spokesperson told us.
ShinyHunters claims the compromised FBI services include human resources, MedLink, and Criminal Justice Information Services.
Neither Oracle nor AWS immediately responded to our inquiries, including whether Oracle is aware of a PeopleSoft preauth RCE zero-day, and whether AWS has any insight into the alleged data theft. We will update this story if we receive any response.
Unlike most of the group’s smash-and-grab operations that involve a multimillion-dollar ransom demand to not leak the stolen files, ShinyHunters said it isn't seeking an extortion payment from the FBI.
Instead, it wants the federal cops to retract statements made about ShinyHunters in a May 15 bulletin, shortly after the gang broke into ed-tech giant Instructure's Canvas platform and claimed to have stolen data tied to hundreds of millions of students, teachers, and staff. The FBI said ShinyHunters uses “harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting.”
The security alert also said that extortionists “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.”
REG AD
Shiny claims none of this is true. “I have been doing my very best to combat these allegations,” they told us. “And this is the best way to do it.” ®