{"uuid": "b82d287d-795a-4a78-805e-cd4f12db147e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35273", "type": "seen", "source": "https://t.me/baseleeak/409", "content": "\ud83d\udd25 Retaliation & PR: How ShinyHunters Breached the FBI for \"Marketing\"\nWhile the Pentagon is still recovering from the exposure of 3 million service members' records, the Federal Bureau of Investigation (FBI) is facing its own, arguably more embarrassing, security fiasco. The notorious ShinyHunters cybercrime group has breached FBIJobs.gov, exfiltrating the personal data of nearly every active agent, employee, and applicant.\n\ud83c\udfaf The Motive: Money?\nNo. This was pure \"retaliation\" and a PR stunt. In May 2026, the FBI issued a public Public Service Announcement (PSA) warning against ShinyHunters' tactics, labeling them as mere extortionists, swatters, and blackmailers.\nThe threat actors took offense. They claimed the FBI breach was a \"marketing campaign to protect our business and fight disinformation.\" Their demand? The FBI's leadership must delete or revise the May PSA. In exchange, they promised not to sell the database.\n\ud83d\udee0 Technical Vector: How Did They Get In?\nUnlike past major breaches (such as the Snowflake campaign) that relied heavily on stolen credentials, this attack was purely technical:\n1. Application Vulnerability: The attack targeted a flaw within the web application hosted on the public-facing FBIJobs.gov server.\n2. Missing Patches: Mandiant analysts discovered that hackers exploited a critical, newly discovered flaw in Oracle PeopleSoft (CVE-2026-35273). A patch had been available since June 2026, but the FBI simply... failed to apply it.\n3. Data Volume: Once inside the server, ShinyHunters claimed to have exfiltrated between 2 and 3 terabytes of data.\n\ud83d\udce6 Inside the Archives (Spoiler: It's Worse Than It Looks)\nTo prove the breach, the group shared a sample of 5,000 records with journalists. The FBI has officially acknowledged the incident and sent out internal alerts: the bureau is operating under the assumption that every employee's data has been compromised.\nThe leaked data includes:\n\u2022 Full names, home addresses, personal phone numbers, SSNs, and emergency contact details.\n\u2022 Information on employee spouses.\n\u2022 \ud83e\ude78 The most absurd part: Medical screening results for special agents (ranging from blood and urine analysis to medical notes like \"banana allergy\").\n\ud83d\udd75\ufe0f\u200d\u2642\ufe0f The Real-World Danger\nFor undercover operatives and counterintelligence officers, this is a national security nightmare. Stolen samples already show data of personnel assigned to sensitive desks (including operations involving Russia, China, and Iran). Their residential addresses are now exposed, leaving them and their families vulnerable to physical and digital targeting.\n\u2696\ufe0f An Ironic Twist\nWhile ShinyHunters was busy issuing ultimatums to the Bureau, the Dutch National Police quietly arrested one of the group's key members in Amsterdam.\nImmediately following the arrest (around September 28\u201329), the group's tone shifted dramatically. They walked back their threats, stating they would fully refrain from leaking or selling the FBI database. It seems the \"marketing campaign\" went a step too far.\nThe takeaway: Even if you are the world's leading law enforcement agency, patching Oracle PeopleSoft on time is not a luxury\u2014it's basic hygiene.\n\n++++", "creation_timestamp": "2026-09-30T09:41:35.000000Z"}