InfoSecBulletin Cybersecurity for mankind
Oracle PeopleSoft servers are under attack in ongoing data theft by the ShinyHunters gang, which claim to have stolen data from over 100 organizations.
BleepingComputer reported a big data theft attack hitting both cloud and on-site Oracle PeopleSoft customers. These customers got demands for money that were signed by the ShinyHunters gang.
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
Australian Energy Giant Origin confirms unauthorized access and disclosure of customer data
Anthropic Unveils Claude Security Plugin for Code Flaw Scanning
Apple, ASUS Router, Meta, Windmill & Ubuntu Patch Critical Security Flaws
SolarWinds Patches 15 Critical Serv-U Flaws
Oracle fixes 1,400+ vulnerabilities; critical flaws threaten enterprise servers
Zimbra Patches 4 XSS and Critical SNMP Command Injection Flaws
Qilin ransomware gang exploiting critical Palo Alto VPN Flaw
“The threat actor confirmed to BleepingComputer that they were behind the attacks, claiming to have stolen data from 300 instances across more than 100 organizations” it added.
ShinyHunters says they are using a “gadget chain” of old and new weaknesses to carry out the attacks. They also say that their attack isn’t working on every system and think the success of the attack may depend on how a system is set up.
They claim their initial goal was to breach an FBI portal running PeopleSoft to “publish a statement and set the record straight on some misinformation that has been spreading.” However, they said their attack was not successful, and they were unable to gain access to the instance.
Cybersecurity researcher “Michael R” found several exposed online directories containing tooling related to this attack.
“ShinyHunters, (or a group impersonating them) exposed several directories revealing ongoing targeting of PeopleSoft (Enterprise Resource Planning software) environments,” the researcher posted.
“Also visible were staging materials, including MeshCentral agents, and a defacement and credential spray script.”
The researcher shared the following IP addresses as IOCs related to these attacks:
142.11.200[.]186
142.11.200[.]187
142.11.200[.]188
142.11.200[.]189
142.11.200[.]190
108.174.202[.]99
176.120.22[.]24
Some of these IP addresses used a TLS certificate that has a common name of “azurenetfiles[.]net,” which is a domain previously linked to the ShinyHunters extortion gang.
Source: Michael R
If you use Oracle PeopleSoft, it is highly recommended that you check logs for any connections from the IP addresses listed above to see if you were attacked.
