Minacce · 44 giorni fa
La polizia olandese ha confermato l’arresto di un uomo di Amsterdam di 24 anni nel fascicolo su ShinyHunters, ma il quadro non punta a un colpo decisivo contro il gruppo. Il punto che conta oggi è un altro: il sospettato appare separato dal leader adolescente che, secondo il reporting, guida l’operazione in questa fase.
L’indagine resta legata alla campagna contro Oracle PeopleSoft e al caso di defacement del sito di lavoro dell’FBI, attribuiti a sfruttamento di CVE-2026-35273. Qui l’arresto non chiude la linea operativa; rafforza invece l’idea di una struttura già spezzata, in cui l’identità pubblica del gruppo può restare la stessa mentre comando e responsabilità scorrono su persone diverse.
Per chi monitora ShinyHunters, il dato utile è questo: un fermo può cambiare l’attribuzione, non necessariamente il ritmo delle attività. Finché la leadership resta frammentata, cronologia degli eventi e responsabilità tecnica possono continuare a non combaciare in modo pulito.
Sfruttamento noto · CISA KEV
CVSS 9.8 CRITICAL: vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Impiego noto in campagne ransomware. EPSS 97% (100º percentile).
Data di correzione federale CISA 15 giu · data superata
13 fonti che coprono questa storia
ShinyHunters suspect arrested in the Netherlands
A ShinyHunters suspect has been arrested in the Netherlands, Apple fixes an iOS zero-day found by Meta, recent Citrix zero-days see mass e [Read More
Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation
Pepijn van der Stap was convicted in 2023 for hacking multiple organizations, stealing their data, and extorting them.
Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation
Dutch police arrested a 24-year-old Amsterdam man in a ShinyHunters investigation, with a Rotterdam court appearance set for Sept.
The Record from Recorded Future
ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns
A vulnerability in a popular line of products from Oracle is being used in a new campaign by the prolific ShinyHunters hacking group, which recently claimed credit for an attack on the FBI’s jobs site.
Dutch police confirm arrest in ShinyHunters hacking investigation
Dutch police have confirmed that a 24-year-old Amsterdam man arrested earlier this month was detained as part of an investigation into the ShinyHunters hacking group.
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters.
ShinyHunters trades financial extortion for a reckless war of ego with the FBI
Cybercrime experts are stunned as ShinyHunters risks agent safety and intense federal heat in a bizarre attempt to force the retraction of an agency advisory.
The FBI's online portals for job applicants are still unavailable, following a successful breach by the ShinyHunters cyber extortion group.
Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
The extortion group has modified its exploit in new attacks targeting the PeopleSoft vulnerability CVE-2026-35273.
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
ShinyHunters-linked attackers exploit CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules to deploy web shells on dozens of systems.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft | Google Cloud Blog
This follow-up report details how UNC6240 (ShinyHunters) is mass-exploiting Oracle PeopleSoft (CVE-2026-35273) by bypassing WAF rules via a single URL-encoded character, providing full analysis of the attack pipeline, observed post-exploitation activity, IOCs, and remediation steps.
Part of the PlainSec briefing for 2026-09-30