ShinyHunters Hacked the FBI Through an HR Portal. It Is Hitting Everyone Else Through One URL-Encoded Character.

The version of this story that led the wires is simple. ShinyHunters, the crew best known for stealing student data from Canvas and customer data from Rockstar Games, got into the FBI, took two to three terabytes of personnel files, and came out holding medical and psychiatric records on special agents. The FBI has confirmed a breach. Reuters authenticated several of the documents. On Wednesday the bureau said it was "actively and aggressively investigating."

Here is what the headline leaves out. The front door was not a bespoke FBI system. It was an HR and applicant-tracking application. And the technique Mandiant published on 25 September is not exotic at all: it is one URL-encoded character that defeats a firewall rule thousands of organisations adopted instead of patching.

The front door was an HR system

ShinyHunters told BleepingComputer and The Register that initial access came through Oracle PeopleSoft, the ERP suite that runs HR, payroll, recruiting and student records across universities, government agencies and large enterprises. The group says it defaced apply.fbijobs.gov, the bureau's applicant portal, and then moved into FBI-managed infrastructure on AWS GovCloud. It named four systems it says it reached: FBIJobs, the background and applicant screening system known as BEAST, FBI MedLink, which holds personnel medical records, and BICS, which holds investigative information. Reuters could not corroborate those specific claims.

The technical detail that matters most in the whole affair is a screenshot. CyberInsider reported a page under the path /PSEMHUB/ on the jobs portal displaying Linux system information. PSEMHUB is the PeopleSoft Environment Management Hub, an administrative subsystem used to coordinate multi-server deployments. It is not the part of PeopleSoft that end users touch. It is the part that administrators do, and in a great many deployments it sits on the same network-accessible interface as the user-facing portal.

Mandiant and Google Threat Intelligence Group had already mapped this exact component three months earlier. On 10 June, Oracle issued an out-of-band Security Alert for CVE-2026-35273, a pre-authentication flaw that chains a server-side request forgery into Java deserialisation inside the WebLogic JVM, rated CVSS 9.8 and affecting PeopleTools 8.61 and 8.62. The flaw had been exploited as a zero-day from 27 May to 9 June, two full weeks before the advisory existed. Google traced 300-plus compromised application instances across more than 100 organisations, 68 percent of them in higher education, and spent the run-up to disclosure notifying exposed operators directly.

One character undid the workaround

Oracle's guidance gave administrators two paths: patch, or block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter. Mandiant's June post was explicit that WAF body-inspection rules were not a substitute for the patch. Plenty of teams took the second path anyway.

They are the ones being hit now. Mandiant's September report describes the same actor, tracked as UNC6240, modifying the exploit to skate past string-matching WAF rules by requesting /%50SEMHUB/ instead of /PSEMHUB/. The percent sign forty is an encoded capital P. A rule that matches the literal string before URL decoding does not fire. WebLogic decodes the path and routes the request to the vulnerable servlet regardless. Mandiant's advice is blunt: enforce blocking on the normalised path, because any percent-encoded, mixed-case or otherwise non-normalised variant will work.

The rest of the chain reads like a tutorial in how much mileage a single unauthenticated endpoint yields. Before exploiting a host, the actor fires five to fifteen POST requests carrying a serialised Java object and takes the returned hostname as proof of exploitability. From there it has two routes. It can drop JSP web shells into the PSEMHUB.war directory, sending a burst of requests so that every node behind a load balancer receives a copy, which means checking only the first WebLogic node will miss compromised siblings. Or it can run fileless: POST requests that return command output directly in the HTTP response, leaving no file on disk and showing up only as cmd.exe or /bin/sh processes spawned by the WebLogic Java process. Any detection engineered around JSP file creation is blind to the second method.

The shell set is small and deliberately WAF-avoiding. x.jsp takes hex-encoded commands rather than cleartext in the query string and rebuilds /bin/sh from an ASCII character array to dodge static string signatures. u.jsp writes Base64-encoded file chunks in 150-kilobyte increments to sidestep request-size limits. On Windows hosts, u.jsp staged a 5.2-megabyte binary called Ple64.exe, tracked as SIDEEYE: a trojanised installer masquerading as the Light Alloy media player, wrapped in a three-stage chain with VMProtect 3 protecting the middle layer, and signed with a valid Extended Validation certificate issued to a software development entity through Sectigo. Mandiant said it had asked Sectigo to revoke. SIDEEYE steals browser and desktop credentials, manages processes and files, opens reverse shells and proxies traffic, calling home over raw TCP on separate control and data ports.

Across compromised instances, roughly a quarter of the actor's commands ran as root or NT Authority\SYSTEM. The rest ran under PeopleSoft or WebLogic service accounts, which is still enough to read configuration files, database connection strings and application data.

What the FBI actually confirmed, and what it did not

The evidence tiers here do not deserve to be flattened, so it is worth separating them.

Confirmed: the FBI acknowledged the claim and confirmed the intrusion to The Register on Friday, and the jobs portal has been offline. Reuters partially authenticated a handful of documents by running two Social Security numbers against credit bureau data, matching the date of a pre-employment mental health evaluation against a former FBI analyst's public profile, and confirming the name and job title of a psychiatrist named in one file against a matching LinkedIn profile. One record noted an applicant took aspirin daily and was allergic to dust and cats. Another cited "symptoms of depression" in high school. A third carried an electrocardiogram result.

Claimed only: the two-to-three-terabyte figure, the GovCloud pivot, access to MedLink and the Criminal Justice system, the wiping of local evidence, and the headcount. The FBI has about 38,000 employees. The group initially claimed data on all of them, then told the BBC it had underestimated and now claims roughly 60,000 current and former staff.

There is also a live conflict in the sourcing about what was actually exploited. ShinyHunters told BleepingComputer it found a new unpatched zero-day and used it against the FBI the next night, and told The Register that the pre-authentication PeopleSoft bug used in the bureau attack still has no patch. Mandiant's September report describes renewed exploitation of CVE-2026-35273, the flaw Oracle patched in June. Those are two different claims, and Google's report does not say the bureau was hit through the recycled bug. Reporting on the Mandiant report noted plainly that it is not clear whether the FBI patched its systems or used the WAF workaround. Oracle has not responded to requests for comment from Reuters or The Register.

The May advisory the group is so annoyed about is itself the reason for caution. It stated that ShinyHunters has in the past used exaggerated claims of access to pressure victims into paying. The group says it wants the document retracted or corrected, describes its own operation as "a public relations and marketing initiative for our business," and told The Register that "we are just protecting our business as any other business would do." It has threatened to publish the full dataset and has declined to say what it will do if the FBI does not comply. That is a reputational campaign dressed as a grievance, and the payload is permanent.

The strategic tension

Two things can be true at once, and both of them are uncomfortable.

The first is that the FBI, one of the best-resourced investigative agencies on earth, appears to have been reached through an administrative component of an enterprise HR suite. Former FBI operative Eric O'Neill told Reuters the presence of medical data puts this near the magnitude of the 2015 Office of Personnel Management breach. "I would be shocked if Russian intelligence isn't knocking on their door and saying, 'We want that stuff, hand it over.'" Etay Maor of Cato Networks put the operational problem in one line for the BBC: "Passwords can be reset if stolen, but medical records cannot, so once this data is out, it stays compromised for good." Ciaran Martin, the former head of the UK's National Cyber Security Centre, called it, if confirmed, "as serious as it gets when it comes to data breaches."

The second is that this is not primarily a sophistication story. ShinyHunters is not a nation-state. It found a hole, told everyone about it, watched a large share of the market choose the cheaper mitigation, and then spent one afternoon encoding a letter. Mandiant's remediation list has not changed in three months. Patch. Disable EMHub, or remove PSEMHUB entirely if it is not needed. If you cannot, block the endpoint, then verify the block survives normalisation. Rotate everything reachable from the PeopleSoft tier. Ship web-tier logs off the host, because the actor has claimed to wipe local evidence. Search for unexpected .jsp, .jspx and .exe files in the web application directories, and for shell processes spawned by the WebLogic Java process, whether or not a file appears on disk.

The part that does not get fixed by any of that is the data model. An applicant tracking system should not be able to reach employee medical records. A recruiting web tier does not need network paths into the HR store that holds psychiatric evaluations. The architectural question in the FBI case, as one analysis framed it, is why an applicant portal could reach that data at all. Every organisation running PeopleSoft inherited the same default: administrative services on the same interface as the portal, with trust relationships that let one compromised host fan out across internal nodes. In June, the actor moved laterally by spraying hardcoded SSH credentials against hosts enumerated from a local hosts file. That is not a zero-day technique. That is an estate-shape problem.

For teams with internet-reachable ERP administrative components, the exposure question is binary and it can be answered today: can anyone on the internet reach your Environment Management Hub, and does your block still work after URL decoding? The follow-on question is harder, because it is not a patching question at all. Which of your systems hold data that cannot be rotated, and what sits between the internet and that data?

That second question is the kind that does not get asked during a compliance cycle and does get asked the week after an intrusion. At DMC, we work with hardware and platform teams on exactly this ground: attack-surface inventory across internet-reachable administrative planes, hardening decisions when a management interface becomes the weakest link, and the sequencing question of what to fix first when the estate is larger than the team. If you are stress-testing how your own ERP tier would hold up, let's talk.