ShinyHunters Targets Oracle PeopleSoft in Large-Scale Data Theft Attacks The ShinyHunters extortion gang is actively targeting Oracle PeopleSoft servers in a widespread campaign, claiming to have stolen data from over 100 organizations. PeopleSoft, an enterprise software suite used for HR, finance, supply chain, and student administration, has been exploited across both cloud and on-premises instances. The threat actor confirmed to BleepingComputer that the attacks leverage a "gadget chain" of old and zero-day vulnerabilities, though success varies depending on system configurations. While Oracle has not publicly acknowledged the breaches, ShinyHunters stated their initial goal was to breach an FBI portal running PeopleSoft an attempt that ultimately failed. Most affected organizations are in the education sector, with Nottingham University already confirmed as a victim. The university’s data has been published on ShinyHunters’ leak site, and it has publicly acknowledged the incident. Cybersecurity researcher Michael R uncovered exposed directories linked to the attacks, revealing staging materials such as MeshCentral agents and credential-spraying scripts. Indicators of compromise (IOCs) include multiple IP addresses (e.g., `142.11.200[.]186`, `108.174.202[.]99`) and a TLS certificate tied to the domain `azurenetfiles[.]net`, previously associated with ShinyHunters. Analysis of exposed `.bash_history` files revealed a script that deploys a ransom note (`README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT`) on compromised PeopleSoft servers. The script scans for internal systems via `/etc/hosts` and attempts SSH access using common administrative accounts like psoft, oracle, and linuxadm, falling back to key-based authentication if passwords fail. Organizations running PeopleSoft are advised to review logs for connections from the identified IOCs to assess potential exposure.