CTI · reviewed · 2026-09-25

ShinyHunters allegedly breached the FBI to steal personal data on agency employees, forcing the bureau's job portal offline. The group claim

Full story & timeline

Actors

ShinyHunters

Malware / tools

—

Campaigns

—

CVEs

—

Victim sectors

government

Geography

United States

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1102 Web Service Command and Control
T1491 Defacement Impact
T1567 Exfiltration Over Web Service Exfiltration

Indicators

Observables tied to this case, from the curated feed. raw sidecar

apply.fbijobs.gov domain · revoked · corroborated
azurenetfiles.net domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: MeshCentral C2 Beacon to Azurenetfiles Domain
id: f1e870d8-c9f2-42f2-b586-4fe6cc41ddd9
status: experimental
description: >
    Detects connections to azurenetfiles.net, the MeshCentral
    command-and-control host (wss://azurenetfiles.net:443/agent.ashx)
    Mandiant published for the Oracle PeopleSoft Environment
    Management (PSEMHUB) exploitation campaign attributed to
    ShinyHunters, the group alleged to have breached FBI systems via a
    PeopleSoft zero-day. Staging hosts 142.11.200.186 through
    142.11.200.190 accompany this C2.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
    - https://www.bleepingcomputer.com/news/security/shinyhunters-claims-fbi-hack-data-theft-in-peoplesoft-zero-day-breach/
author: Tia N. List
date: 2026/09/25
tags:
    - attack.t1102
    - attack.t1190
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        DestinationHostname|endswith: 'azurenetfiles.net'
    condition: selection_c2
falsepositives:
    - Legitimate file or cloud-storage traffic to a shared hosting domain (rare; correlate with PeopleSoft host context)
level: high