ShinyHunters claims FBI breach via PeopleSoft zero-day as UNC6240 resumes CVE-2026-35273 mass exploitation with WAF bypass

ShinyHunters says it stole 2-3 TB of FBI personnel and applicant data from FBIJobs.gov using an Oracle PeopleSoft zero-day, demanding retraction of a May 2026 FBI FLASH report rather than ransom; Mandiant links the crew to UNC6240's renewed CVE-2026-35273…

Beginning 2026-09-22, ShinyHunters claimed it breached the FBI by exploiting an unpatched Oracle PeopleSoft remote-code-execution zero-day on FBIJobs.gov, then moved laterally into FBI-managed AWS GovCloud infrastructure and stole two to three terabytes of data on current, former, and prospective employees and job applicants. A sample of roughly 5,000 records shared with 404 Media includes names, home addresses, phone numbers, emails, Social Security numbers, job titles, field offices, emergency contacts, and spouses; portions were verified against public records. Subsequent reporting says some records contain medical information, described as blood and urine samples and psychiatric reports. Three records reference the FBI's Remote Operations Unit (its hacking team), and Reuters reported some titles relate to China or Russia investigations. The group defaced apply.fbijobs.gov, says it made no ransom demand, and wants a May 2026 FBI FLASH report corrected or retracted; it later told 404 Media it will not publish the trove, though copies of the 5,000-record sample have already circulated. The FBI is investigating a claimed compromise of FBIJobs.gov, says the entry point (third party versus FBI systems) remains undetermined, has notified potentially affected personnel, and internally declared a 'cyber security incident'; the jobs portal, the bureau's main application site since 2017, remained offline as of 2026-09-28. Separately, Mandiant and Google Threat Intelligence identify ShinyHunters as UNC6240 and warn of renewed mass exploitation of CVE-2026-35273, a CVSS 9.8 unauthenticated RCE flaw in PeopleSoft's PSEMHUB endpoint. The actor bypasses string-based WAF rules by URL-encoding one path character ('%50SEMHUB'), which WebLogic decodes and routes to the vulnerable endpoint, then deploys single-line JSP web shells, the SIDEEYE backdoor (via a signed Ple64.exe loader), Neo-reGeorg tunneling, and MeshAgent (called MeshCentral in one report) for persistence and lateral movement. That campaign, which earlier hit more than 100 organizations mostly in the US including Nissan, NAIC, and the University of Nottingham, has expanded from education into government, healthcare, technology, IT services, agriculture, and transportation. Sources note ShinyHunters claims the FBI breach used a different, still-unknown PSEMHUB zero-day (with the same WAF bypass) rather than CVE-2026-35273, which the group also says it is exploiting against Fortune 500 targets. Vendors urge…