ShinyHunters Claims FBIJobs.gov Breach: New Zero-Day, CVE-2026-35273 Bypass, or Third-Party Failure?

On September 22, 2026, the ShinyHunters extortion group claimed it had compromised FBIJobs.gov, the FBI’s recruitment portal, and defaced apply.fbijobs.gov with a fake seizure banner. The group says it walked away with roughly 2 to 3 TB of data on FBI agents, staff and job applicants, including records pulled from HR, Criminal Justice and MedLink systems.

The FBI has confirmed it is investigating, and a week later both the general application portal and the special agent application portal are still offline. What the Bureau has not confirmed is the scope of the intrusion, the entry point, or even whether the breach started in its own environment or at one of the third-party providers that support the portal.

This post separates what is confirmed from what is only claimed, explains why CVE-2026-35273 sits at the center of the initial access question, and lists the checks PeopleSoft operators should run now.

Key Takeaways

Confirmed: unauthorized activity affecting FBIJobs.gov, an active FBI investigation, and both application portals offline.
Partially verified: a 5,000-record sample the group shared with journalists, which 404 Media and Reuters judged to be authentic.
Claimed only: the 2 to 3 TB total, access to internal systems such as MedLink and Criminal Justice, and a pivot into FBI-managed AWS GovCloud servers.
Leading hypothesis for initial access: Oracle PeopleSoft, based on currently available evidence. The FBI has not confirmed the entry point. On September 25, threat researchers reported that ShinyHunters is mass-exploiting CVE-2026-35273 again, using a one-character URL-encoding trick to slip past WAF rules on unpatched systems.
Motive: the group says the attack was not financial. It frames the breach as retaliation for a May 2026 FBI public service announcement about its operations.
Law enforcement: a Dutch court has ordered a suspect in the ShinyHunters investigation held for 90 days. No authority has publicly linked him to the FBIJobs.gov intrusion.

Timeline of Events

Date (2026)	Event
May 15	FBI IC3 publishes a public service announcement on ShinyHunters’ Canvas LMS campaign and urges victims not to pay.
May 27 to June 9	ShinyHunters exploits CVE-2026-35273 in Oracle PeopleSoft as a zero-day, primarily against higher education institutions. More than 100 organizations with potentially vulnerable endpoints are notified.
June 10	Oracle releases an out-of-band Security Alert for CVE-2026-35273.
September 16	Dutch police arrest a 24-year-old man from Amsterdam as part of the ShinyHunters investigation. News reports identify him as Pepijn van der Stap, formerly known as “Umbreon.”
September 18 to 19	ShinyHunters hijacks the Cl0p ransomware leak site, using Umbreon imagery.
September 22	apply.fbijobs.gov is defaced. ShinyHunters posts a statement on its leak site and sends 404 Media a sample of 5,000 alleged FBI employee records.
September 23	The FBI states on X that it is investigating and that the point of breach, third party or FBI enterprise, is still undetermined.
September 24	The special agent application portal is marked unavailable.
September 25	ShinyHunters tells The Register it used a PeopleSoft zero-day and reached FBI-managed AWS GovCloud servers. The same day, new threat research documents renewed CVE-2026-35273 exploitation through a WAF bypass.
September 28	The FBI says it is “working around the clock to investigate the cyber incident involving FBIJobs.gov” and has sent bureau-wide communications to potentially affected people. An internal memo reported by The New York Times says the Bureau assumes personal data of all FBI employees was exfiltrated. Both application portals remain offline.
September 29	The Rotterdam District Court orders the suspect held for 90 days. FBI Assistant Director Brett Leatherman describes him as one of the alleged leaders of ShinyHunters. Neither the FBI nor Dutch police has linked him to the FBIJobs.gov intrusion, and ShinyHunters denies any association with him.

Figure 1: The defaced apply.fbijobs.gov page with the “This site has been seized by ShinyHunters. rooting your systems since ’19 ;)” banner with the Umbreon ASCII art.

What ShinyHunters Claims vs. What Is Confirmed

In its leak-site statement, ShinyHunters said it holds data on almost all FBI agents and on everyone who applied for a job with the Bureau. It named Criminal Justice (CJ), HR and MedLink as compromised services. In later statements to reporters, a spokesperson extended the list to FBI PEGA, FBIJOBS and PHIRE, while the BBC reported claims covering FBI BEAST (background checks) and BICS (investigative information). The group also told The Register it stole personnel files from FBI-managed servers on AWS GovCloud.

None of these system-level claims has been confirmed by the FBI. The Bureau’s public position is narrower: it is aware of a criminal group claiming a compromise of the FBIJobs.gov portal with alleged impact on employee PII, it has not determined whether the breach originated at a third-party provider or inside the FBI enterprise, and it is working with the providers that support the portal. On September 28, the FBI described the event as a “cyber incident involving FBIJobs.gov” and said it had sent multiple bureau-wide communications within 24 hours of the first public reports.

An internal FBI memo reported by The New York Times says the Bureau is operating under the premise that the actor exfiltrated personal data of all FBI employees. We read this as a protective planning assumption for staff, not as confirmation of the group’s claims about specific systems.

The strongest independent evidence is the 5,000-record sample. 404 Media reported that it contains names, home addresses, phone numbers and details on employees’ spouses, and both 404 Media and Reuters judged it authentic. Reuters also said the stolen material includes a document describing staff roles in little-known or sensitive FBI units, and it was able to match the career details of eight people to public records, although it could not verify that every assignment was current.

404 Media also reported that the stolen data includes Social Security numbers, and Reuters found sensitive psychiatric and medical files of FBI staff among the documents ShinyHunters shared.

ShinyHunters is not demanding a ransom from the FBI. It says it wants the Bureau to retract what it calls false allegations in the May PSA and has threatened to publish the data otherwise.

Figure 2: ShinyHunters leak-site statement about the FBI attack The post disputes the May FBI report and giving the Bureau one week to retract it.

Figure 3: FBI statement on the FBIJobs.gov compromise The Bureau’s September 23 post on X says the point of breach, a thirt party or the FBI enterprise, is still undetermined.

The Initial Access Question: New Zero-Day or CVE-2026-35273?

ShinyHunters says it used a new, undisclosed Oracle PeopleSoft vulnerability that allows unauthenticated remote code execution. As of this writing there are no public technical details of such a flaw, and Oracle has not published a new advisory. The group’s own account is also inconsistent: other reporting quotes ShinyHunters as saying it got in through the recently patched CVE-2026-35273.

The better-documented candidate is CVE-2026-35273, a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in the PeopleSoft Environment Management Hub (PSEMHUB), triggered through Java deserialization in the hub servlet. ShinyHunters exploited it as a zero-day between May 27 and June 9, 2026, before Oracle’s June 10 Security Alert.

Research published on September 25 changes the picture. It shows that ShinyHunters modified its exploit to reach the vulnerable endpoint through /%50SEMHUB/ instead of /PSEMHUB/. %50 is simply the URL-encoded letter “P”. Many WAF and reverse proxy rules match the literal path before decoding, while WebLogic decodes it and routes the request to the vulnerable servlet. Organizations that blocked the path with a WAF rule but never patched were exposed again. The same research reports that the renewed wave put web shells on dozens of systems across higher education, technology, IT services, healthcare, agriculture, transportation and government.

The post-exploitation toolset documented in Mandiant’s September 25 report includes two single-line JSP web shells (x.jsp for command execution, u.jsp for chunked file uploads), a trojanized installer named Ple64.exe that loads a backdoor tracked as SIDEEYE, Neo-reGeorg tunnels (tunnel.jsp and tunnel.jspx) for SOCKS proxying into internal networks, and MeshAgent for persistent remote access. The report also notes fileless command execution that leaves no JSP on disk.

The report does not name the FBI as a victim of this campaign, and neither the FBI nor Oracle has publicly tied the FBIJobs.gov intrusion to CVE-2026-35273. Still, the timing, the actor, the product and the claimed technique (unauthenticated RCE in PeopleSoft) all line up. From a defender’s point of view, there are three hypotheses:

A genuinely new zero-day. Possible, but supported only by the group’s own statements, which conflict with each other.
An unpatched CVE-2026-35273 instance reached through the WAF bypass. This is the leading hypothesis, as it is the most consistent with currently available evidence. It is not confirmed. If it holds, the “zero-day” label is a claim, not a technical fact.
A third-party hosted PeopleSoft instance. The FBI has not confirmed the entry point, and its own wording keeps this possibility open.It could overlap with hypothesis 2 if the provider’s instance was the unpatched one.

Why This Data Is Dangerous

A single leaked address list is a privacy problem. The combination claimed here is a security problem:

Identity + home address + spouse details + unit assignment + medical records

Put together, those fields support physical targeting, doxxing and harassment of investigators, and they are valuable to foreign intelligence services trying to map who works where inside the Bureau. 404 Media noted that criminals from the same ecosystem have previously used stolen phone records to track and intimidate FBI agents investigating them.

If the MedLink, Criminal Justice or GovCloud claims hold up, the incident is also a segmentation failure. A public-facing recruitment application should not have a path to medical records or investigative systems. Whether that path ran through the FBI’s own network or through a shared third-party environment is exactly what the investigation has to answer.

Attribution Noise: The Umbreon Defacement

The defacement featured an ASCII-art Umbreon, the Pokémon that gave Pepijn van der Stap his old alias. It appeared a week after his arrest and before the arrest was made public. Available sources suggest that the imagery may have been a deliberate attempt by ShinyHunters’ current leadership to attribute the hack to him, amid an ongoing dispute over control of the brand. The same sources also noted that the Umbreon artwork had appeared in a 2020 defacement attributed to ShinyHunters, a year before van der Stap adopted the alias.

The official picture is still thin. Dutch police say only that a 24-year-old Amsterdam man was arrested in an investigation into the group, and on September 29 a Rotterdam court ordered him held for 90 days. FBI Assistant Director Brett Leatherman described him as one of the alleged leaders of ShinyHunters. ShinyHunters denies any association with him, and no authority has publicly linked him to the FBIJobs.gov intrusion.

Figure 4: The FBIJobs.gov defacement and the “Umbreon” RaidForums account Left: the deface apply.fbijobs.gov page. Right: the Umbreon account, with the same Pokémon avatar, selling a database of 2.3 million Dutch people in September 2021.

For CTI teams the lesson is simple: ShinyHunters is a brand with competing factions, not a fixed crew. Defacement art, handles and leak-site branding are weak attribution evidence on their own and should always be weighed against technical indicators.

ThreatMon Analyst Assessment

Finding	Status	ThreatMon Assessment
Intrusion affecting FBIJobs.gov	Confirmed	FBI investigation active; apply.fbijobs.gov and the special agent portal offline.
Threat actor	Self-attributed	ShinyHunters. Internal faction disputes complicate attribution to individuals.
Initial access	Claimed	The group has claimed both a new PeopleSoft zero-day and CVE-2026-35273. Exploitation of unpatched CVE-2026-35273 via the /%50SEMHUB/ WAF bypass is the leading hypothesis based on currently available evidence.
Point of breach	Undetermined	FBI says it may be a third-party provider or the FBI enterprise.
5,000-record sample	Partially verified	Judged authentic by 404 Media and Reuters.
Scope across all employees	FBI planning assumption	An internal memo reported by The New York Times assumes personal data of all employees was exfiltrated. Not a public confirmation.
Full 2 to 3 TB dataset	Unverified	Actor claim only.
MedLink, CJ, HR, BEAST, BICS access	Claimed	Would indicate a serious segmentation gap if confirmed.
AWS GovCloud access	Claimed	No independent confirmation.
Motive	Stated by actor	Non-financial; retaliation for the May 2026 FBI PSA, with a threat to publish.
Arrested suspect in the Netherlands	Detained for 90 days	The FBI calls him an alleged ShinyHunters leader. Not publicly linked to the FBIJobs.gov intrusion.

Detection and Mitigation for PeopleSoft Operators

Patch and reduce exposure

Apply Oracle’s Security Alert for CVE-2026-35273. WAF rules and path blocking are not a substitute for patching.
Disable the Environment Management Hub service, or remove the PSEMHUB application entirely if you do not use it.
Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter, and enforce the rule on the normalized path so encoded or mixed-case variants are caught too.

Hunt in logs and on hosts

Search PIA WebLogic access logs for requests to /PSEMHUB/ and any percent-encoded variant such as /%50SEMHUB/, especially bursts of 5 to 15 POST requests to /hub from external IPs (reserchers observed this pattern used to confirm exploitability).
Check every WebLogic node, not just the first one, for unexpected files in PSEMHUB.war and PORTAL.war: x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx, Ple64.exe.
Alert on cmd.exe, /bin/sh or bash spawned by the WebLogic Java process. JSP-based detections miss the fileless variant.
Look for unexpected MeshCentral agents and for archives (.tar, .tar.gz, .zst) or zstd, rsync, sshpass and curl processes running under PeopleSoft service accounts.
Monitor outbound SMB (TCP 445) and large transfers from the PeopleSoft tier.

If you find a web shell

Treat the host as compromised and preserve evidence.
Rotate every credential readable by the PeopleSoft service account: database connection strings in psappsrv.cfg, Integration Broker credentials, and any cloud keys reachable from the web tier.
Prepare for extortion contact and monitor leak sites for your data.

Do not forget third parties

If a vendor or managed service provider hosts PeopleSoft for you, ask for written confirmation of the CVE-2026-35273 patch status and EMHub exposure.
Verify that public-facing HR and recruitment portals cannot reach core HR, medical, investigative or cloud management systems.

Indicators of Compromise

Indicator	Type	Context
5.199.162[.]157	IPv4	Attack controller, scanner, HTTP callback receiver (Sept 2026)
104.219.234[.]138	IPv4	Exfiltration staging and remote management host (Sept 2026)
162.219.30[.]165	IPv4	SIDEEYE C2, TCP 3333 / 3334 (Sept 2026)
winmanage-me[.]network	Domain	MeshCentral infrastructure (Sept 2026)
142.11.200[.]186 to 142.11.200[.]190	IPv4 range	Staging servers (May to June 2026)
azurenetfiles[.]net	Domain	MeshCentral C2 masquerading as Azure (May to June 2026)
microsoft-entra[.]net	Domain	MeshAgent infrastructure
enroll.azuredevice[.]cloud	Domain	MeshAgent infrastructure
/%50SEMHUB/	URI pattern	WAF bypass path
3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3	SHA-256	Ple64.exe (SIDEEYE loader)
2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7	SHA-256	u.jsp upload stager

Note: x.jsp and the Neo-reGeorg tunnel hashes vary between victims, so hunt for them by file name and path rather than by hash.

Figure 5: ShinyHunters actor profile on the ThreatMon Platform

How ThreatMon Helps

ThreatMon continuously maps an organization’s external attack surface, including internet-facing enterprise applications such as Oracle PeopleSoft. For this campaign, that means flagging exposed PSEMHUB and Integration Broker endpoints, tracking ShinyHunters leak-site activity and new victim posts, and alerting on leaked credentials for administrative or service accounts on dark web forums and Telegram channels. The goal is to close the gap between a public portal and the internal systems behind it before an attacker finds it.

Conclusion

The FBIJobs.gov incident is a reminder that the dangerous part of a breach is often not the vulnerability but the path behind it. Whether ShinyHunters used a brand-new zero-day or an unpatched CVE-2026-35273 instance hidden behind a WAF rule, the defensive answer is the same: patch instead of filtering, remove admin components from the internet, hold third-party hosts to the same standard, and make sure a recruitment portal can never become a gateway to medical, investigative or cloud systems. We will update this post as the FBI’s investigation and Oracle’s guidance develop.