ShinyHunters Claim PeopleSoft Data Theft From More Than 100 Organizations
Summary
ShinyHunters claim they stole data from 300 Oracle PeopleSoft instances across more than 100 organizations. Nottingham University acknowledged a cybersecurity incident; a researcher also found exposed campaign tooling and scripts.
Key points
- ShinyHunters told BleepingComputer they stole data from 300 PeopleSoft instances across more than 100 organizations; the claim is not independently confirmed in the article.
- The group says attacks target cloud and on-premises PeopleSoft systems, with many targets in education, and that success may depend on instance configuration.
- ShinyHunters alleges use of old and zero-day vulnerabilities; Oracle had not responded to BleepingComputer's inquiry about a PeopleSoft zero-day.
- A researcher found exposed directories, staging materials, MeshCentral agents, and scripts, though the researcher cautioned that the materials could be from ShinyHunters or an impersonating group.
- A script found in server history parses /etc/hosts for PeopleSoft systems, tries SSH with common administrative accounts and then key-based authentication, and places a ransom note in PeopleSoft server directories.
- The group named Nottingham University as a victim and claimed its data was published on the group's leak site; the university acknowledged a cybersecurity incident but did not confirm the data-theft claim in the article.
- Organizations are advised to check logs for the listed IP addresses, investigate possible compromise, and consider temporarily removing affected servers from internet access if indicators are found.
Article Details
- Event Type
- Ongoing data theft and extortion attacks targeting Oracle PeopleSoft servers, attributed to ShinyHunters.
- Impact
- ShinyHunters claims to have stolen data from 300 instances across more than 100 organizations; the article says most affected organizations appear to be in education. The group told BleepingComputer that Nottingham University was a victim and that its data had been published on the group's leak site; the University acknowledged a cybersecurity incident.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | azurenetfiles[.]net | Domain used as the common name on a TLS certificate for some servers in the reported campaign; the article says it was previously linked to the ShinyHunters extortion gang. |
| IPV4 | 108[.]174[.]202[.]99 | IP address researcher Michael R shared as an IOC related to the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]186 | IP address researcher Michael R shared as an IOC related to the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]187 | IP address researcher Michael R shared as an IOC related to the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]188 | IP address researcher Michael R shared as an IOC related to the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]189 | IP address researcher Michael R shared as an IOC related to the PeopleSoft attacks. |
| IPV4 | 142[.]11[.]200[.]190 | IP address researcher Michael R shared as an IOC related to the PeopleSoft attacks. |
| IPV4 | 176[.]120[.]22[.]24 | IP address researcher Michael R shared as an IOC related to the PeopleSoft attacks. |
MITRE ATT&CK
T1021.004 · SSHThe script attempts to connect to PeopleSoft-related systems over SSH, using password authentication and then SSH keys as a fallback.T1059.004 · Unix ShellThe exposed attack material included a shell script that creates a ransom note on an internal PeopleSoft server.T1110.003 · Password SprayingThe reported attack script includes credential spraying against PeopleSoft-related systems.