~# cat ep3/notes.md

49:45

#EP 3

ShinyHunters, PeopleSoft, and Two Citrix Zero-Days

ShinyHunters' claimed FBI breach and Mandiant's PeopleSoft findings, kept in separate lanes, plus two exploited Citrix NetScaler zero-days hiding in a log handler. Patch your edge and watch your logs.

Watch on YouTube

The FBI breach, ShinyHunters, and Oracle PeopleSoft

ShinyHunters claimed a breach of the FBI’s jobs platform and tied it to Oracle PeopleSoft. Separately, Mandiant documented a renewed mass-exploitation campaign against a known PeopleSoft vulnerability. How much those overlap is not something we can confirm, so they stay in separate lanes.

What Mandiant documented (attributed)

  • The vulnerability is CVE-2026-35273, an Oracle PeopleSoft flaw disclosed in June. PeopleSoft is widely used across government, education, and healthcare.
  • ShinyHunters exploited it as a zero-day between May 27 and June 9 against academic institutions. Oracle patched it June 10 with workaround guidance.
  • The group then restarted exploitation and adapted to the published guidance, targeting organizations that applied workarounds but did not patch. Web shells went out across higher education, technology, IT services, healthcare, agriculture, transportation, and government.
  • The WAF bypass: one mitigation was blocking the vulnerable /PSEMHUB/ endpoint at a WAF. ShinyHunters requested /%50SEMHUB/ instead, where %50 is the encoded letter “P”. Many WAFs compare the literal path before decoding, so the rule misses it, while WebLogic decodes it and routes to the vulnerable endpoint anyway. Mandiant notes the group could rotate to other encodings.
  • Post-exploitation: JSP web shells, a backdoor Google tracks as SIDEEYE, and the Neo-reGeorg tunneling toolkit to pivot inside.

What ShinyHunters claimed (their words, unverified)

  • They told BleepingComputer they breached FBI systems through PeopleSoft, moved laterally into FBI-managed AWS GovCloud, and stole 2 to 3 TB of data on current and former employees and applicants.
  • They described a new PeopleSoft zero-day, and separately confirmed using the WAF bypass against FBI Jobs while still claiming an additional unknown flaw in the same PSEMHUB component.
  • BleepingComputer said it could not independently verify the alleged zero-day, the lateral movement, or the amount of data.
  • They framed the attack as retaliation for an FBI FLASH report about the group. That is their stated motive, not an established fact.

We are not asserting whether the FBI was patched or whether a genuinely new zero-day was involved. Nobody reporting on it publicly has that information.

What the FBI said

  • It acknowledged it is investigating claims of unauthorized activity affecting FBIjobs.gov.
  • An internal memo obtained by the New York Times said the agency is operating under the premise that employee personal information is being exfiltrated.
  • Data samples obtained by Reuters, 404 Media, and the BBC reportedly contained sensitive personal, medical, and operational information.

The arrest

Dutch police arrested a 24-year-old suspected ShinyHunters member in Amsterdam. Brian Krebs reported he was a key figure in the group. An arrest is not a shutdown: the campaign and the extortion operation keep running.

The monitoring argument

We know about ShinyHunters because they are loud. They deface sites, talk to reporters, and hand out samples, because publicity is the leverage. A patient actor exploiting the same PeopleSoft exposure has the opposite incentive: get in quietly, collect, and leave nothing that makes news. Same vulnerability, same techniques, and no headline. Your own telemetry is the only way you would know.

The brag is a gift. It tells you what to hunt for. If you only react to a defacement and a news cycle, you are defending against the loud attackers and blind to the patient ones.

CIS Controls:

  • 8, Audit Log Management. Mandiant advises searching WebLogic access logs for /PSEMHUB/ and encoded variants like /%50SEMHUB/. That only works if the logs exist, are kept, and get reviewed: 8.2 (collect logs), 8.3 (enough storage), 8.9 (centralize). Collect database logs too.
  • 13, Network Monitoring and Defense. Lateral movement is where quiet actors show themselves. Neo-reGeorg tunnels over normal HTTP and HTTPS, and egress and east-west monitoring catch it whether or not the actor goes public. 13.1, which depends on 12.2.
  • 7, Continuous Vulnerability Management. The second wave exists because organizations mitigated instead of patching. A workaround is a speed bump. 7.7: actually remediate.

Citrix NetScaler: two exploited zero-days

NetScaler is Citrix’s line of application delivery controllers and VPN gateways: load balancing, SSL offload, authentication, and remote access. It is internet-facing by design and sits in a large share of enterprise networks, which is why a foothold on one is so valuable. It is also not NetScaler’s first time here (CitrixBleed and earlier pre-auth bugs).

The two bugs

  • Citrix confirmed CVE-2026-88771 and CVE-2026-88772 are exploited in attacks and fixed them in bulletin CTX697096, alongside six other vulnerabilities.
  • CVE-2026-88771 (CVSS 9.5): unauthenticated command execution from improper input validation, affecting all NetScaler ADC and Gateway deployments including the default configuration.
  • CVE-2026-88772 (CVSS 9.5): a memory overflow leading to RCE or denial of service when DTLS is enabled, which is the default on VPN virtual servers.

The disclosure mess

The industry knew before Citrix said anything. Citrix admins on Reddit reported suppliers and security teams privately telling them to shut their NetScalers down. The Dutch NCSC reportedly pre-notified organizations before Citrix published. An actively exploited RCE in a default configuration reached the world through everyone except the vendor.

How the injection works

  • The vulnerable code was a Perl script, ns_monuploadd_err.pl, meant to recover the filename of a crashed process’s core file. It used a grep | sed | awk pipeline to pull a name out of log files and never checked that the result was a core filename and a numeric process ID. It trusted whatever followed NSPPE in the log.
  • That untrusted string was interpolated into a second backtick find command, so an injected semicolon became a command separator.
  • The command runs as root, because nearly everything on a NetScaler does.
  • Any endpoint that logs attacker-controlled request data can deliver it: failed logins, request parameters, even User-Agent headers. Poison a log entry, then wait for the script to parse it.
  • It does not fire instantly. It waits for the maintenance script, up to 24 hours, so a compromise may not be obvious in real time. watchTowr says it found a way to force it and is holding that back.

CIS Controls:

  • 12, Network Infrastructure Management, and 4, Secure Configuration. An unpatched, internet-facing edge appliance is your riskiest asset. Citrix says upgrade now, and reduce internet exposure until you can.
  • 7, Continuous Vulnerability Management. Zero-day plus default config plus in-the-wild exploitation is the worst case. Edge patch cadence is not a quarterly-window conversation.
  • 8, Audit Log Management. The vulnerability abuses the logging pipeline itself. Watch for malformed NSPPE/pitboss log strings and unexpected root-level command execution on the appliance.

OWASP: OS Command Injection (A03: Injection). Unvalidated input concatenated into a shell command, a decades-old bug class that still takes down enterprise edge gear. The fix is the textbook remediation: per watchTowr, Citrix replaced the shell pipeline with native Perl file handling, extracted only strictly validated fields (a packet-engine name and a numeric PID) with a narrow regex, and ran find through Perl’s list form so no shell is ever invoked.

The takeaway

Patch your edge and watch your logs. PeopleSoft shows why monitoring matters even when you cannot see the attacker. NetScaler shows what happens when a perimeter appliance ships an injection bug in its own log handler. Both come back to the unglamorous controls that decide whether you find out from your SIEM or from a headline.

Sources