AKMSecure Insights

ShinyHunters' FBI Claim Points to a Machine Identity Problem

Written by AKMSecure | Sep 29, 2026, 1:32:00 PM

On September 22, the cybercrime group ShinyHunters claimed it had broken into FBI systems. The group told BleepingComputer that it used an unpatched zero-day in Oracle PeopleSoft to take over the server behind FBIjobs.gov, then moved into FBI HR systems, a service called Medlink, and infrastructure hosted in AWS GovCloud. It says it took 2 to 3 terabytes of data on current and former employees and job applicants.The FBI has said it is “aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating.” The zero-day, the movement into GovCloud and the volume of data have not been independently verified. This analysis reflects what had been reported as of September 23.

What has been reported so far?

  • Entry point: a claimed remote code execution zero-day in PeopleSoft, the HR and recruiting platform behind the FBI’s jobs portal. Oracle has not commented publicly. PeopleSoft was already a target this year; The Hacker News notes that a separate flaw, CVE-2026-35273, was exploited in June.
  • Movement: from the PeopleSoft server into HR systems, Medlink, and FBI systems in AWS GovCloud. No report has described how that movement happened.
  • Data: names, home addresses, phone numbers and family details for employees and applicants. Nextgov/FCW reported that sample names provided by the group matched FBI employees.
  • Visible impact: the jobs portal was defaced, and CyberScoop reported that it and the Special Agent Application Portal went offline.

Why does the second step matter more than the first?

A recruiting portal has to face the internet. Zero-days in widely deployed enterprise software will keep appearing, and no team can patch a flaw before the vendor knows it exists. Agencies should plan on some internet-facing application being compromised at some point.

The size of the breach depends on what that application server is trusted to reach. To do its job, an HR application connects to databases, identity systems, file storage and cloud services. It authenticates to each of them with machine credentials: database passwords, API keys, cloud access keys, service account tokens, and certificates with their private keys.

Those credentials are usually long-lived and stored on the server in configuration files, environment variables or local key stores. An attacker with code execution on the server can use everything the server can use.

How do attackers move from one server into a cloud environment?

The reports do not say how the claimed pivot into GovCloud was done. In cloud intrusions generally, the most common path is to collect credentials from the compromised host and use them directly. The credentials are valid, so the systems receiving them have no reason to reject the connection.

This is the gap Zero Trust architecture is meant to close. NIST SP 800-207 calls for access to be granted per session and evaluated continuously, instead of being granted to anything that presents a valid credential.

What should federal security teams check now?

  • List the credentials stored on each internet-facing application server and the systems each one unlocks.
  • Remove standing access the application does not need, especially direct paths from the web tier to bulk personnel data.
  • Shorten credential lifetimes and replace static secrets wherever the platform allows it.
  • Watch for an Oracle advisory and a CISA Known Exploited Vulnerabilities entry for PeopleSoft, and patch as soon as a fix is available.

Where does Autonomous Key Management fit?

Autonomous Key Management™ (AKM) does not prevent an application zero-day. It addresses the step that follows: what an attacker can do with the machine credentials they find.

AKM replaces PKI certificates and static keys for machine-to-machine connections. Two endpoints are provisioned once with a shared crypto seed. From then on they generate quantum-resilient symmetric keys that refresh with every session, with no certificate authority involved, and every session is independently verified.

For an attack like the one ShinyHunters describes, that changes three things:

  • There is no long-lived certificate, private key or static API secret on the server for an attacker to copy and reuse from another system.
  • A captured session key has no value once the session ends.
  • Trust between the web tier and the data tier is checked on every session, which matches the per-session access model in NIST SP 800-207 and the DoD Zero Trust Reference Architecture.

An attacker who controls a host can still act as that host while they hold it. AKM limits how far that access carries once they lose it, and removes the reusable credentials that let a single compromised server open up other systems.

About AKMSecure

AKMSecure delivers a patented Autonomous Key Management™ protocol built to replace outdated PKI approaches with a dynamic, quantum-secure, air-gapped-capable architecture. Instead of relying on persistent credentials that can be stolen, reused, or abused, AKM enables independently verified sessions with no standing privileges left behind. The result is a model that better aligns with Zero Trust principles, reduces certificate-based risk, and supports resilient operations across enterprise IT, OT and Tactical Edge environments. Built to NSA-grade security standards and deployable as a lightweight SDK, AKMSecure helps organizations modernize trust at the protocol layer without rebuilding everything around it.