ShinyHunters Hacker Detained in Jordan After Oracle PeopleSoft Zero‑Day Breach of FBI Applicant Portal
What Happened — Jordanian authorities detained Saif al‑Din Khader (alias “Rey”), a known member of the ShinyHunters hacking group. Rey is cooperating with the FBI and local investigators, providing access to his devices and communications. The arrest follows ShinyHunters’ recent claim that it exploited an Oracle PeopleSoft zero‑day to breach the FBI’s job‑applicant portals and exfiltrate personnel and medical records.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of threat‑actor activity and rapid evidence collection to support incident response and forensic audit trails.
- Highlights the importance of maintaining up‑to‑date vulnerability management (zero‑day patches) as a control‑assurance prerequisite across frameworks.
- Shows how a robust third‑party and supply‑chain risk program can surface hidden exposures when external actors target critical government systems.
Who Is Affected – Federal agencies, public‑sector IT providers, and any organization using Oracle PeopleSoft or similar HR platforms.
Recommended Actions
- Verify that all PeopleSoft instances are patched against known zero‑day exploits and document the remediation as audit evidence.
- Strengthen incident‑response playbooks to include forensic acquisition of attacker devices and chain‑of‑custody procedures.
- Incorporate threat‑intel feeds on active hacking groups into continuous monitoring dashboards to detect early indicators of compromise.
Source: Help Net Security
Technical Notes
- Attack vector: exploitation of an Oracle PeopleSoft zero‑day vulnerability.
- Data types stolen: personnel files, employment history, and medical information of current, former, and prospective FBI employees.
- No public disclosure of the vulnerability identifier; the exploit remains unpatched in the wild at time of reporting.
Source: Reuters, BBC