ShinyHunters
Threat actorNames and who uses them
- ShinyHuntersOur name
- UNC6240Mandiant
- Bling LibraPalo Alto Networks
Known techniques
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1036.005Match Legitimate Resource Name or Location
- T1059.007JavaScript
- T1059.009Cloud API
- T1069.003Cloud Groups
- T1072Software Deployment Tools
- T1078Valid Accounts
- T1078.002Domain Accounts
- T1078.004Cloud Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1090.003Multi-hop Proxy
- T1105Ingress Tool Transfer
- T1110Brute Force
- T1190Exploit Public-Facing Application
- T1195.001Compromise Software Dependencies and Development Tools
- T1203Exploitation for Client Execution
- T1210Exploitation of Remote Services
- T1213.003Code Repositories
- T1213.006Databases
- T1219Remote Access Tools
- T1485Data Destruction
- T1491.001Internal Defacement
- T1528Steal Application Access Token
- T1530Data from Cloud Storage
- T1550.001Application Access Token
- T1552.001Credentials In Files
- T1560.002Archive via Library
- T1567Exfiltration Over Web Service
- T1573.002Asymmetric Cryptography
- T1580Cloud Infrastructure Discovery
- T1583.001Domains
- T1583.004Server
- T1585.002Email Accounts
- T1587.004Exploits
- T1588.002Tool
- T1588.007Artificial Intelligence
- T1589.001Credentials
- T1593.003Code Repositories
Malware and tools used
Source: MITRE ATT&CKSecurity timeline
- Zero-day reported by The Hacker NewsOracle PeopleSoft zero-day exploited by ShinyHunters found to be three chained flaws
- Vulnerability reported by Horizon3.aiAttackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
Recent news
Oracle PeopleSoft zero-day exploited by ShinyHunters found to be three chained flaws
Researchers report that the critical PeopleSoft bug exploited by ShinyHunters since May is three chained flaws rather than one. Oracle patched them in June under a single identifier, CVE-2026-35273. The chain begins with a server-side request forgery that reaches an internal management interface because PeopleSoft trusts its own loopback address.
Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, with a CVSS score of 9.8. Oracle patched it in its October 2026 Critical Patch Update, and Defused Cyber decoys recorded exploratory exploitation on 27 October. The Canadian Centre for Cyber Security has updated its advisory to say open source reporting indicates exploitation in the wild.