InfoSecBulletin Cybersecurity for mankind
Oracle PeopleSoft servers are under attack in ongoing data theft by the ShinyHunters gang, which claim to have stolen data from over 100 organizations.
BleepingComputer reported a big data theft attack hitting both cloud and on-site Oracle PeopleSoft customers. These customers got demands for money that were signed by the ShinyHunters gang.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
“The threat actor confirmed to BleepingComputer that they were behind the attacks, claiming to have stolen data from 300 instances across more than 100 organizations” it added.
ShinyHunters says they are using a “gadget chain” of old and new weaknesses to carry out the attacks. They also say that their attack isn’t working on every system and think the success of the attack may depend on how a system is set up.
They claim their initial goal was to breach an FBI portal running PeopleSoft to “publish a statement and set the record straight on some misinformation that has been spreading.” However, they said their attack was not successful, and they were unable to gain access to the instance.
Cybersecurity researcher “Michael R” found several exposed online directories containing tooling related to this attack.
“ShinyHunters, (or a group impersonating them) exposed several directories revealing ongoing targeting of PeopleSoft (Enterprise Resource Planning software) environments,” the researcher posted.
“Also visible were staging materials, including MeshCentral agents, and a defacement and credential spray script.”
The researcher shared the following IP addresses as IOCs related to these attacks:
142.11.200[.]186
142.11.200[.]187
142.11.200[.]188
142.11.200[.]189
142.11.200[.]190
108.174.202[.]99
176.120.22[.]24
Some of these IP addresses used a TLS certificate that has a common name of “azurenetfiles[.]net,” which is a domain previously linked to the ShinyHunters extortion gang.
Source: Michael R
If you use Oracle PeopleSoft, it is highly recommended that you check logs for any connections from the IP addresses listed above to see if you were attacked.
