FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day
The FBI’s online portals for job applicants (at apply.fbijobs.gov) and special agent applicants (at fbijobs.gov/special-agents) are still unavailable, following what appears to be successful compromises by the ShinyHunters cyber extortion group.
Last week, the United States’ domestic intelligence and security service confirmed it was investigating ShinyHunters’ claim of having compromised personal information of FBI employees.
ShinyHunters told The Register they leveraged a currently unspecified and unconfirmed Oracle PeopleSoft zero-day vulnerability to breach the portals.
They also claimed to have breached FBI’s managed servers on AWS GovCloud and stole personnel files of current, former, and aspiring FBI employees.
They aren’t after money, they said: the attack and their very public disclosure of it was because they wanted to contest the allegations made against ShinyHunters in a recent public service announcement, which advised victim organizations not to pay the ransom.
The group claims to have gotten their hands on personal information of tens of thousands of FBI agents and prospective FBI employees, as well as medical information of the former.
According to the BBC, the group claims to have gained access to multiple platforms: FBIJobs, FBI BEAST (which handles background checks on employees and applicants), FBI MedLink (which stores medical records), and FBI BICS (which contains investigative information).
Also, according to Reuters, among the documents stolen is one that “provides data on roles of FBI staff in little-known or sensitive FBI units.”
“Reuters could not verify that all the job assignments were authentic or up-to-date, but it was able to match the career details or titles of eight people whose data was leaked to information in court filings, news articles, or public profiles on LinkedIn or to online posts on sites such as Instagram,” the publication noted.
ShinyHunters threatened to release the stolen information if the FBI doesn’t retract the “false allegations.”
Renewed exploitation of CVE-2026-35273
On Friday, Google Cloud / Mandiant’s analysts and incident responders published a technical rundown of how ShinyHunters are once more exploiting an Oracle PeopleSoft vulnerability (CVE-2026-35273) they initially exploited in May and June 2026 as a zero-day to target mostly academic institutions.
At the time, Oracle advised implementing the emergency patch and, if unable to do so, applying temporary mitigations such as restricting network access to PeopleSoft application and web servers to trusted internal networks (including blocking external access to the vulnerable endpoints at the network perimeter or firewall level).
“Relying solely on Web Application Firewall (WAF) body-inspection rules is insufficient, as these controls can be bypassed,” Mandiant noted at the time.
And they were right: according to the analysts, ShinyHunters recently modified their original exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and expanded their targeting to higher education, technology, IT services, healthcare, agriculture, transportation, and government institutions.
“The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/. This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure,” Mandiant’s analysts noted.
“The current campaign demonstrates that [ShinyHunters] adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch the vulnerability.”
Ofter gaining access, the extortion group deploys web shells, a legitimate RMM tool (MeshAgent) and performs fileless command execution.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!