CTI · reported · 2026-09-30

FBI Hackers Say They Won’t Publish Massive Trove of FBI Employee Data

Full story & timeline

Actors

ShinyHuntersUNC6240

Malware / tools

SIDEEYENeo-reGeorg

Campaigns

—

CVEs

CVE-2026-35273

Victim sectors

government

Geography

United StatesNetherlands

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1505 Server Software Component Persistence
T1116 Code Signing Stealth
T1572 Protocol Tunneling Command and Control
T1219 Remote Access Tools Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: SIDEEYE Backdoor C2 Beacon to PeopleSoft Exploitation Server
id: 9ba88d25-72f4-4380-aa2e-17da1ef482e7
status: experimental
description: Detects network connections to 162.219.30.165 over TCP 3333 and 3334, the C2 used by the SIDEEYE backdoor delivered through Oracle PeopleSoft PeopleTools exploitation (CVE-2026-35273) alongside Neo-reGeorg tunnels and MeshCentral agents in the UNC6240/ShinyHunters-related campaign.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft
  - https://www.reuters.com/world/shinyhunters-hackers-say-they-breached-federal-bureau-investigation-no-immediate-2026-09-22/
author: Tia N. List
date: 2026-09-30
tags:
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.command-and-control
  - attack.t1190
  - attack.t1505
  - attack.t1116
  - attack.t1572
  - attack.t1219
logsource:
  category: network_connection
  product: windows
detection:
  selection_c2:
    DestinationIp: '162.219.30.165'
    DestinationPort:
      - 3333
      - 3334
  condition: selection_c2
falsepositives:
  - Unlikely; the address has no legitimate business use, but shared hosting or sinkholing could reuse it
level: high

References

Source on GitHub