ShinyHunters (UNC6240 / UNC6661 / UNC6671): Vishing-to-SaaS Data Theft and PeopleSoft Exploitation

Attacker objective. ShinyHunters is a financially motivated extortion collective, active since at least 2019, that steals data and demands payment under threat of leaking it. It does not encrypt. Sekoia assesses the name now covers decentralised clusters sharing one brand and tied to The Com. [#1] [#8]

Google tracks the live intrusion work as three clusters. UNC6661 and UNC6671 gain access by voice phishing. UNC6240, the canonical ShinyHunters, runs the extortion and the 2026 Oracle PeopleSoft exploitation. [#2]

Track A: vishing to SaaS data theft. Operators call staff as IT support, send them to a victim-branded sign-in page, capture the SSO password and MFA code, then enroll an MFA device they control. [#2] Okta documents kits that let the caller steer the victim's browser in step with the call, which defeats push and number matching. [#6] Obsidian saw Okta FastPass enrolled from an emulated Android device named "Passkey". [#9] The actor then pulls data from SharePoint, OneDrive, Salesforce, Slack and similar platforms, and in one case authorized an add-on that deletes the "Security method enrolled" email. [#2]

Track B: PeopleSoft exploitation. UNC6240 exploited CVE-2026-35273 (CVSS 9.8) as a zero-day from 27 May to 9 June 2026, before Oracle's 10 June alert. [#3] In September it returned with a one-character URL-encoding trick that bypassed WAF rules and deployed web shells on dozens of systems. [#4] Post-exploitation used MeshCentral agents disguised as Azure services, an SSH credential-spray script, zstd archives and a Tor-hosted leak site. [#3] [#4]

Current status. Law enforcement reported detentions and arrests in September and October 2026. [#12] [#13] Nothing in the sources shows the extortion or exploitation stopping, and the brand reportedly changed hands during the arrests, so treat the threat as live.

Highest-value defensive angle. The first reliable signal is in the identity provider, not on an endpoint: an MFA factor change shortly after a failure-heavy sign-in. [#5] [#9] Patching PeopleSoft is the only reliable fix for Track B, because path-based WAF rules were already bypassed. [#4]

Defender priority: alert on every MFA activation, reset or device enrollment that follows failed sign-ins (Q8, Q9), and on any Java process on a PeopleSoft host that starts a shell (Q5). Patch CVE-2026-35273 and block /PSEMHUB and /PSIGW/HttpListeningConnector on the normalized path.

Web Hunter decisions

• Atomic IOCs come from Tier 1 only. Every hash, address and domain shipped in Section 10 appears verbatim in a saved GTIG report (sources 2, 3 or 4). Each source is snapshotted under the pack's sources folder for the provenance gate.
• Dropped. Two further indicators appeared only in third-party aggregator pages and in no vendor report. They are not in the pack.
• Typo reconciled. MITRE lists one extortion mailbox as shinycorp@tutonota[.]com. GTIG writes shinycorp@tutanota[.]com. The pack lists the GTIG spelling and keeps the MITRE variant as a hunt string.
• No victim names. Victims named in sources are not repeated here. The pack is written around tradecraft so it ports to any environment.
• Related packs. The library already holds a PeopleSoft CVE-2026-35273 pack (v0.3, June 2026) with six endpoint queries for the June zero-day activity, plus packs for UNC6671 vishing and AiTM, a Teams-vishing cluster, a Salesloft-Drift OAuth campaign, and Scattered Spider. This pack covers ShinyHunters as one actor. It repeats the June PeopleSoft infrastructure so it stands alone, and adds the September renewed exploitation (the %50SEMHUB WAF bypass, web shells, SIDEEYE, Neo-reGeorg, new addresses and domains) and the full Okta, Microsoft 365, Google Workspace and Salesforce track. See the PeopleSoft pack for its June-specific detail.

Contradictions and gaps

• The June report lists five staging addresses and one mirror address. The September report lists three different addresses. They are different infrastructure generations, not a conflict.
• GTIG's 19 January source IPs are residential-proxy and VPN addresses from January 2026. They are perishable and shared, so the pack uses them for hunting only.
• Okta's indicator list and kit analysis are available only to Okta security contacts. This pack uses only what Okta published openly.
• GTIG says the x.jsp, tunnel.jsp and tunnel.jspx hashes vary per deployment. Hunt those by name and path, not by hash.
• Attribution is layered: UNC6661, UNC6671 and UNC6240 are separate clusters that GTIG links by shared extortion infrastructure. Do not assume one operator.

Overall confidence: High. At least two Tier 1 sources agree on every central claim. Perishability is high for the IP lists and low for tradecraft.

Hunt hypotheses (ordered by fidelity)

Attack chain

Items marked (inferred) are analyst mappings the cited sources do not state. Steps 8 to 10 follow GTIG's June and September reports; steps 1 to 7 follow GTIG's January report, Okta, Obsidian and Mandiant's guide.

Action vocabulary: detect alert or block, hunt search and review, enrich add context only. Sources: Tier 1 reports 2, 3, 4 and MITRE 1; Obsidian 9 for Okta behavior.

Gaps: nothing in endpoint telemetry sees the phone call, the lookalike page rendered on a personal phone, or SaaS-native exports. Detection for Track A depends on identity-provider and SaaS log ingest.

Technique IDs come from MITRE G1057 (source 1) and GTIG (sources 2 to 4). Entries marked (inferred) are analyst mappings.

These checks need no Falcon query. Run them in the product named in each row.

N1 · Okta System Log: MFA lifecycle and emulator

Where: Admin Console, Reports, System Log, or the System Log API.

eventType eq "user.mfa.factor.activate" or eventType eq "user.mfa.factor.reset_all" or eventType eq "device.enrollment.create"

Pivot on actor, client.ipAddress and client.userAgent.rawUserAgent. Look for Genymobile and for a device named Passkey.

N2 · Entra ID: security-info registration

Where: Entra admin center, Monitoring, Audit logs, filter Category = UserManagement.

Activity: User registered security info / User deleted security info

Compare the source IP to the user's normal sign-in locations and to Conditional Access results.

N3 · Microsoft 365: scripted SharePoint and OneDrive downloads

Where: Exchange Online PowerShell.

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-14) -EndDate (Get-Date) -Operations FileDownloaded,FileAccessed -ResultSize 5000 |
  Where-Object { $_.AuditData -match 'WindowsPowerShell' } |
  Select-Object CreationDate, UserIds, Operations

Group by user and count. Mandiant's threshold was 50 documents of 3 or more types in 5 minutes.

N4 · Google Workspace: add-on authorization and mail deletion

Where: Admin console, Reporting, Audit and investigation, OAuth log events and Gmail log events.

OAuth log: App name contains ToogleBox Recall. Gmail log: event is delete or permanent delete and subject matches MFA enrollment wording.

A deleted 'Security method enrolled' message is the signal; check outbound mail deleted the same hour.

N5 · Salesforce: bulk export and connected-app token use

Where: Developer console or Workbench against EventLogFile.

SELECT EventType, LogDate, LogFile FROM EventLogFile WHERE EventType IN ('BulkApi','ReportExport','Login','RestApi') AND LogDate = LAST_N_DAYS:14

Look for new connected apps, API calls from unfamiliar addresses, and Data Loader user agents. For Experience Cloud, review guest-user API volume.

N6 · PeopleSoft web tier: exploitation attempts and web shells

Where: Shell on each WebLogic node (check every node behind the load balancer).

PS_CFG_HOME=/u01/app/psoft/ps_config_homes/csprd   # adjust to your install
grep -Eih 'psemhub|%50semhub|psigw/httplisteningconnector' $(find "$PS_CFG_HOME"/webserv -name '*access*log*') | head -200
find "$PS_CFG_HOME"/webserv/*/applications/peoplesoft/PSEMHUB.war \( -name '*.jsp' -o -name '*.jspx' -o -name '*.exe' \) -ls
find "$PS_CFG_HOME"/webserv/*/applications/peoplesoft/PSEMHUB.war/envmetadata -type f -ls

Any JSP, JSPX or EXE that is not part of the shipped product is hostile. Five to fifteen POSTs to the hub servlet from one address is target verification.

N7 · PeopleSoft hosts: credential and config reads

Where: Shell with auditd, or EDR file-read telemetry.

ausearch -i -f psappsrv.cfg
ausearch -i -f config.xml

Reads of psappsrv.cfg and WebLogic config.xml by a shell or Java child are reconnaissance. Rotate every credential stored there if a web shell is found.

N8 · Proxy, DNS and mail: lookalike domains

Where: DNS, web proxy and mail gateway logs.

Match: ^(my-?)?<yourorg>(sso|internal|support|okta|azure|access)\.(com|net|support)$

Also match ticket-<yourorg>.support and on<yourorg>zendesk.com. Hits mean staff were sent to a lookalike page.

N9 · Mail gateway and phone system: extortion contact

Where: Mail gateway search and phone-system call records.

Sender or reply-to contains shinycorp@tutanota.com, shinygroup@onionmail.com, shinycorp@tuta.com or shinygroup@tuta.com

Brief executives and the help desk. Expect harassing texts and calls to staff and their families.

Q1 to Q6 run on Falcon sensor telemetry. Q7 to Q13 run on identity and SaaS logs ingested into Falcon Next-Gen SIEM. Their field names depend on your parser, so each carries a validate-in-tenant note. Run one against a sample row before relying on it.

// HUNT: DNS resolution of ShinyHunters MeshCentral C2 and Microsoft-lookalike domains
// MITRE: T1583.001, T1219, T1036.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor DNS telemetry (DnsRequest)
// FALSE POSITIVES: none expected -- attacker-registered lookalike domains with no legitimate use
// LOOKBACK: 90d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(azurenetfiles\.net|microsoft-entra\.net|enroll\.azuredevice\.cloud|winmanage-me\.network)$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextBaseFileName])
| sort(@timestamp, order=desc)

// HUNT: Connections to PeopleSoft-campaign staging, C2 and exfiltration hosts
// MITRE: T1105, T1573.002, T1090, T1048, T1219
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor network telemetry (NetworkConnectIP4)
// FALSE POSITIVES: none expected -- GTIG-attributed attacker infrastructure
// LOOKBACK: 90d
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["142.11.200.186","142.11.200.187","142.11.200.188","142.11.200.189","142.11.200.190","176.120.22.24","5.199.162.157","104.219.234.138","162.219.30.165"])
| table([@timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, ImageFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Masqueraded MeshCentral agents and the SIDEEYE loader (name or SHA-256)
// MITRE: T1036.005, T1219, T1105
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: a sanctioned MeshCentral deployment that reuses the name meshagent64-v2.exe
// LOOKBACK: 90d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (ImageFileName=/(meshagent(32|64)-(azure-ops|v2)|Ple64)\.exe$/i or SHA256HashData=/^(f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc|d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f|c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f|68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309|3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3)$/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Linux post-exploitation tooling (meshctrl RunCommand, sshpass spray, zstd staging, fanout, marker file)
// MITRE: T1059.007, T1021.004, T1110.003, T1560.002, T1491.001
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon Linux sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: sshpass in admin automation; zstd in backup and log-rotation jobs
// TUNING: split the alternation: treat meshctrl.js RunCommand, _fanout.sh and the README marker as high-confidence on their own, and require sshpass or zstd to run as the PeopleSoft/WebLogic service account or from /tmp before alerting
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(meshctrl\.js\s+RunCommand|sshpass\s+-p|zstd\s+-3\s+-T0|_fanout\.sh|npm\s+list\s+global\s+authenticode|README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Java process (WebLogic/PeopleSoft) spawning a shell
// MITRE: T1190, T1505.003, T1059.003, T1059.004
// CONF: high
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2), Linux and Windows
// FALSE POSITIVES: Java application servers that shell out for deployment, backup or health-check scripts
// TUNING: scope to PeopleSoft/WebLogic hosts with a Falcon host group or ComputerName filter, baseline 14 days, then exclude the specific scripts those hosts legitimately launch; keep alerts for base64 -d, curl, /dev/tcp, tasklist and start /b
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(java|javaw)(\.exe)?$/i
| FileName=/^(cmd\.exe|sh|bash|dash)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Outbound SMB (TCP/445) from a host to a public address
// MITRE: T1187, T1190
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Falcon sensor network telemetry (NetworkConnectIP4)
// FALSE POSITIVES: cloud file shares (for example Azure Files) reached over TCP/445 by design
// TUNING: exclude the public ranges of your sanctioned cloud file services, then restrict to server host groups
// LOOKBACK: 14d
#event_simpleName=NetworkConnectIP4
| RemotePort=445
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16","100.64.0.0/10"])
| table([@timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, ImageFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Okta events from an emulated-Android (Genymobile) client
// MITRE: T1098.005, T1078.004, T1556.006
// CONF: high
// FP: low
// COST: low
// REQUIRES: Okta System Log ingest (okta_system_log) -- field names are parser-dependent; ⚠ validate in tenant
// FALSE POSITIVES: none expected; a QA or mobile-development team using an emulator against a test Okta org
// LOOKBACK: 30d
#repo=okta_system_log
| "client.userAgent.rawUserAgent"=/Genymobile|Geny\s?Mobile/i
| table([@timestamp, "actor.alternateId", eventType, "outcome.result", "client.ipAddress", "client.userAgent.rawUserAgent", "client.geographicalContext.country"])
| sort(@timestamp, order=desc)

// HUNT: Okta successful MFA factor activation, reset or device enrollment (post-vishing signal)
// MITRE: T1098.005, T1556.006
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Okta System Log ingest (okta_system_log) -- field names are parser-dependent; ⚠ validate in tenant
// FALSE POSITIVES: new-hire onboarding, self-service device replacement
// TUNING: join to Q9 (failure-heavy sign-in) and to help-desk tickets; deprioritise users enrolled in the first 14 days of employment
// LOOKBACK: 14d
#repo=okta_system_log
| eventType=/^(user\.mfa\.factor\.(activate|reset_all|update)|device\.enrollment\.create)$/
| "outcome.result"=SUCCESS
| table([@timestamp, "actor.alternateId", eventType, "client.ipAddress", "client.userAgent.rawUserAgent", "client.geographicalContext.country", "debugContext.debugData.tunnels"])
| sort(@timestamp, order=desc)

// HUNT: Okta failure-heavy sign-in chain followed by MFA enrollment (run over a 1h-4h window)
// MITRE: T1566.004, T1078.004, T1098.005
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Okta System Log ingest (okta_system_log) -- field names are parser-dependent; ⚠ validate in tenant
// FALSE POSITIVES: forgotten-password plus device-replacement in one session
// TUNING: raise the failure threshold to 8 for large tenants, and drop hits where the enrollment source IP matches the user's usual egress
// LOOKBACK: 4h
#repo=okta_system_log
| eventType=/^(core\.user_auth\.login_failed|core\.user\.factor\.attempt_fail|app\.ad\.login\.bad_password|user\.mfa\.factor\.activate)$/
| case {
    eventType=/factor\.activate$/ | kind := "enroll";
    * | kind := "fail";
  }
| groupBy(["actor.alternateId"], function=[count(as=Events), {kind="fail" | count(as=Failures)}, {kind="enroll" | count(as=Enrollments)}, min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| Failures >= 5
| Enrollments >= 1
| sort(Failures, order=desc, limit=100)

// HUNT: Okta activity from UNC6661/UNC6671 published source IPs
// MITRE: T1078.004, T1090
// CONF: medium
// FP: low
// COST: low
// REQUIRES: Okta System Log ingest (okta_system_log) -- field names are parser-dependent; ⚠ validate in tenant
// FALSE POSITIVES: shared residential or VPN addresses reassigned to an unrelated subscriber since January 2026
// LOOKBACK: 90d
#repo=okta_system_log
| rename(field="client.ipAddress", as=SrcIP)
| in(SrcIP, values=["24.242.93.122","23.234.100.107","23.234.100.235","73.135.228.98","157.131.172.74","149.50.97.144","67.21.178.234","142.127.171.133","76.64.54.159","76.70.74.63","206.170.208.23","68.73.213.196","37.15.73.132","104.32.172.247","85.238.66.242","199.127.61.200","209.222.98.200","38.190.138.239","198.52.166.197"])
| table([@timestamp, "actor.alternateId", eventType, "outcome.result", SrcIP, "client.userAgent.rawUserAgent"])
| sort(@timestamp, order=desc)

// HUNT: Microsoft 365 scripted bulk SharePoint/OneDrive download (PowerShell user agent)
// MITRE: T1213.002, T1530, T1059.001
// CONF: high
// FP: medium
// COST: medium
// REQUIRES: Microsoft 365 Unified Audit Log ingest (SharePoint/OneDrive) with UserAgent captured -- field names are parser-dependent; ⚠ validate in tenant
// ⚠ validate in tenant: Workload, Operation, UserAgent, UserId, ClientIP (Unified Audit Log fields; names vary by parser)
// FALSE POSITIVES: sanctioned migration, backup and eDiscovery tooling
// TUNING: exclude service accounts and automation IPs that run these jobs; raise the file-count threshold if your tenant has heavy scripted sync
// LOOKBACK: 24h
Workload=/^(SharePoint|OneDrive)$/
| Operation=/^(FileDownloaded|FileAccessed|FileSyncDownloadedFull)$/
| UserAgent=/PowerShell/i
| groupBy([UserId, ClientIP], function=[count(as=Files), count(SourceFileName, distinct=true, as=DistinctFiles), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| Files >= 25
| sort(Files, order=desc, limit=100)

// HUNT: Google Workspace authorization of the ToogleBox Recall add-on
// MITRE: T1070.008, T1098.003
// CONF: high
// FP: low
// COST: medium
// REQUIRES: Google Workspace token/OAuth audit log ingest -- scope with #repo= to your Workspace repository; ⚠ validate in tenant
// FALSE POSITIVES: deliberate installation by the account owner
// LOOKBACK: 30d
@rawstring=/ToogleBox\s*Recall/i
| table([@timestamp, @rawstring])
| sort(@timestamp, order=desc)

// HUNT: Salesforce bulk-API / report-export / Data Loader activity and known actor user agents
// MITRE: T1213.006, T1567, T1530
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Salesforce Event Monitoring (EventLogFile or real-time) ingest -- field names are parser-dependent; ⚠ validate in tenant
// FALSE POSITIVES: administrators and integration users running Data Loader on purpose
// TUNING: allowlist named integration users and admin egress IPs, then alert on ROWS_PROCESSED outliers per user against a 30-day baseline
// LOOKBACK: 14d
#repo=salesforce_eventlogfile
| EVENT_TYPE=/^(BulkApi|BulkApiResultEvent|ReportExport|RestApi|ApiEvent)$/
| USER_AGENT=/(data.?loader|RapeForce|RapeFlake)/i
| table([@timestamp, USER_NAME, SOURCE_IP, EVENT_TYPE, USER_AGENT, ROWS_PROCESSED, CONNECTED_APP_NAME])
| sort(@timestamp, order=desc)

Q7 to Q13 are identity and SaaS detections. Deploy them as scheduled searches in Next-Gen SIEM rather than as endpoint IOAs.

Alert packages

Ready-to-paste alert text and triage steps for the three highest-fidelity detections.

// >> YOU NEED:  ComputerName   (from the alert)
// >> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"
// Host-scoped: what this host resolved and connected to
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| ComputerName="REPLACE_WITH_HOSTNAME"
| table([@timestamp, DomainName, RemoteAddressIP4, RemotePort, ContextBaseFileName])
| sort(@timestamp, order=asc)

// >> YOU NEED:  SHA256HashData   (from the alert)
// >> FILL IN:   SHA256HashData="REPLACE_WITH_HASH"
// Environment-wide: every host that ran the same binary
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| SHA256HashData="REPLACE_WITH_HASH"
| groupBy([ComputerName], function=[count(as=Runs), min(@timestamp, as=FirstSeen)], limit=500)
| sort(FirstSeen, order=asc, limit=100)

// >> YOU NEED:  ComputerName   (from the alert)
// >> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"
// Host-scoped: everything the shell ran
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ComputerName="REPLACE_WITH_HOSTNAME"
| ParentBaseFileName=/^(sh|bash|dash|cmd\.exe|java|javaw)(\.exe)?$/i
| table([@timestamp, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=asc)

// Environment-wide: other hosts where a Java process started a shell in the window
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(java|javaw)(\.exe)?$/i
| FileName=/^(cmd\.exe|sh|bash|dash)$/i
| groupBy([ComputerName], function=[count(as=Spawns), min(@timestamp, as=FirstSeen)], limit=500)
| sort(Spawns, order=desc, limit=100)

// >> YOU NEED:  actor.alternateId   (from the alert)
// >> FILL IN:   "actor.alternateId"="REPLACE_WITH_USER"
// Host-scoped equivalent: the user's full Okta timeline
#repo=okta_system_log
| "actor.alternateId"="REPLACE_WITH_USER"
| table([@timestamp, eventType, "outcome.result", "client.ipAddress", "client.userAgent.rawUserAgent"])
| sort(@timestamp, order=asc)

// >> YOU NEED:  client.ipAddress   (from the alert)
// >> FILL IN:   SrcIP="REPLACE_WITH_IP"
// Environment-wide: every user seen from the same address
#repo=okta_system_log
| rename(field="client.ipAddress", as=SrcIP)
| SrcIP="REPLACE_WITH_IP"
| groupBy(["actor.alternateId"], function=[count(as=Events), min(@timestamp, as=FirstSeen)], limit=500)
| sort(Events, order=desc, limit=100)

The IdP source addresses are residential-proxy and VPN endpoints from January 2026. Mandiant advises hunting and correlating on them, not broad blocking. Use the CSV only for the nine infrastructure addresses, four domains and six hashes.

type,value,action,severity,expiration,description,tags
domain,azurenetfiles.net,detect,high,2027-04-16,ShinyHunters MeshCentral C2 or staging domain,campaign:ShinyHunters
domain,microsoft-entra.net,detect,high,2027-04-16,ShinyHunters MeshCentral C2 or staging domain,campaign:ShinyHunters
domain,enroll.azuredevice.cloud,detect,high,2027-04-16,ShinyHunters MeshCentral C2 or staging domain,campaign:ShinyHunters
domain,winmanage-me.network,detect,high,2027-04-16,ShinyHunters MeshCentral C2 or staging domain,campaign:ShinyHunters
domain,REPLACE_WITH_ORG_SSO_LOOKALIKE,detect,high,2027-04-16,Your own brand lookalike found via Q1 or N8,campaign:ShinyHunters
ipv4,142.11.200.186,detect,high,2027-01-16,Staging host,campaign:ShinyHunters
ipv4,142.11.200.187,detect,high,2027-01-16,Staging host,campaign:ShinyHunters
ipv4,142.11.200.188,detect,high,2027-01-16,Staging host,campaign:ShinyHunters
ipv4,142.11.200.189,detect,high,2027-01-16,Staging host,campaign:ShinyHunters
ipv4,142.11.200.190,detect,high,2027-01-16,Staging host,campaign:ShinyHunters
ipv4,176.120.22.24,detect,high,2027-01-16,Clearnet mirror of the ShinyHunters data leak site,campaign:ShinyHunters
ipv4,5.199.162.157,detect,high,2027-01-16,Attack controller, scanner and HTTP callback receiver,campaign:ShinyHunters
ipv4,104.219.234.138,detect,high,2027-01-16,Exfiltration staging and remote-management host,campaign:ShinyHunters
ipv4,162.219.30.165,detect,high,2027-01-16,C2 for SIDEEYE backdoor,campaign:ShinyHunters
sha256,f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc,prevent,critical,2027-04-16,meshagent64-azure-ops.exe,campaign:ShinyHunters
sha256,d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f,prevent,critical,2027-04-16,meshagent64-v2.exe,campaign:ShinyHunters
sha256,c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f,prevent,critical,2027-04-16,meshagent32-azure-ops.exe,campaign:ShinyHunters
sha256,68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309,prevent,critical,2027-04-16,meshagent,campaign:ShinyHunters
sha256,3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3,prevent,critical,2027-04-16,Ple64.exe,campaign:ShinyHunters
sha256,2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7,detect,high,2027-04-16,u.jsp,campaign:ShinyHunters
# Not imported: hashes GTIG says vary per deployment (hunt by name and path)
# x.jsp 48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494
# tunnel.jsp 419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86
# tunnel.jspx ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07
# .bash_history (attacker command history) 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35
# Do not import the IdP source IPs below: they are sources of sign-ins, not destinations of endpoint connections

# GTIG January 2026 SaaS-intrusion source IPs. Residential proxy and VPN. HUNT ONLY, do not block.
# Pattern note: Mullvad, Oxylabs, NetNut, 9Proxy, Infatica and nsocks networks appear in these intrusions.

24.242.93.122  AS11427  UNC6661
23.234.100.107  AS11878  UNC6661
23.234.100.235  AS11878  UNC6661
73.135.228.98  AS33657  UNC6661
157.131.172.74  AS46375  UNC6661
149.50.97.144  AS201814  UNC6661
67.21.178.234  AS400595  UNC6661
142.127.171.133  AS577  UNC6671
76.64.54.159  AS577  UNC6671
76.70.74.63  AS577  UNC6671
206.170.208.23  AS7018  UNC6671
68.73.213.196  AS7018  UNC6671
37.15.73.132  AS12479  UNC6671
104.32.172.247  AS20001  UNC6671
85.238.66.242  AS20845  UNC6671
199.127.61.200  AS23470  UNC6671
209.222.98.200  AS23470  UNC6671
38.190.138.239  AS27924  UNC6671
198.52.166.197  AS395965  UNC6671

# CQL list for in():
"24.242.93.122","23.234.100.107","23.234.100.235","73.135.228.98","157.131.172.74","149.50.97.144","67.21.178.234","142.127.171.133","76.64.54.159","76.70.74.63","206.170.208.23","68.73.213.196","37.15.73.132","104.32.172.247","85.238.66.242","199.127.61.200","209.222.98.200","38.190.138.239","198.52.166.197"

OKTA SYSTEM LOG
  eventType: user.mfa.factor.activate | user.mfa.factor.reset_all | user.mfa.factor.update | device.enrollment.create
  failure chain: core.user_auth.login_failed | core.user.factor.attempt_fail | app.ad.login.bad_password  (5+ then success)
  user agent: com.okta.android.auth/... Android/... Genymobile/Phone   regex: Genymobile|Geny\s?Mobile
  device display name: Passkey   (FastPass / Okta Verify enrollment)
  sign-in flow: about 10 minutes, repeated failures, then success, then enrollment
MICROSOFT 365
  SharePoint/OneDrive FileDownloaded or FileAccessed with UserAgent containing WindowsPowerShell
  threshold used by Mandiant: 50+ distinct files and 3+ extensions in 5 minutes per session
  SearchQueryPerformed regex: \bpoc\b|proposal|confidential|internal|salesforce|vpn
  Exchange SoftDelete|HardDelete|MoveToDeletedItems where subject matches new MFA / factor / method / device / security enrollment wording
GOOGLE WORKSPACE
  OAuth authorize event for app name ToogleBox Recall (Gmail add-on and Apps Script scopes)
SALESFORCE
  Data Loader activity; BulkApiResultEvent and ReportEventStream volume outliers
  user agents reported for related campaigns: RapeForce, RapeFlake
PEOPLESOFT / WEBLOGIC
  POST /PSEMHUB/hub  |  POST /%50SEMHUB/hub  |  /PSIGW/HttpListeningConnector with loopback addresses in parameters
  5 to 15 POSTs with a serialized Java object to one server = target verification
  new .jsp / .jspx / .exe under PSEMHUB.war or PORTAL.war; files under PSEMHUB.war/envmetadata/transactions/
  XML files recently changed under envmetadata/data/environment/ (XMLDecoder on restart)
  java or javaw parent starting cmd.exe, sh, bash with base64 -d, curl, /dev/tcp, tasklist, start /b
  outbound TCP/445 from PeopleSoft hosts to the internet
LINUX STAGING AND MOVEMENT
  node meshctrl.js RunCommand --id <agent> --run 'bash /tmp/<abbrev>_fanout.sh'
  sshpass -p ... ssh -o StrictHostKeyChecking=no
  pv ... | zstd -3 -T0 -o exfil.tar.zst
  npm list global authenticode ; MeshCentral 1.1.59 ; acme-client npm package
  /tmp/meshagent  /tmp/meshagent.msh  /tmp/meshagent.db
  marker file README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in WebLogic and Process Scheduler directories
EXTORTION
  72-hour Bitcoin demand; Tox negotiation; Limewire-hosted samples; Tor leak site named SHINYHUNTERS
  mailboxes: shinycorp@tutanota[.]com, shinygroup@onionmail[.]com, shinycorp@tuta[.]com, shinygroup@tuta[.]com
  harassing texts and calls to staff and family; DDoS; swatting (FBI PSA)

MeshCentral server 1.1.59 and MeshAgent (Windows, Linux) - legitimate RMM abused for C2
meshctrl.js (MeshCentral CLI) driven by node
acme-client (npm) for Let's Encrypt certificates on the C2 name
sshpass, ssh, pv, zstd - spray, copy, archive
x.jsp (hex-encoded command web shell), u.jsp and u2.jsp (chunked upload and exec)
Neo-reGeorg (tunnel.jsp, tunnel.jspx) - SOCKS over HTTP
SIDEEYE backdoor delivered by trojanized installer Ple64.exe (EV-signed; GTIG requested revocation)
ToogleBox Recall - Google Workspace add-on that permanently deletes email
Genymobile / Genymotion Android emulator - used to enroll FastPass
Bland AI - voice agent used to script vishing calls (MITRE, source 1)
ConnectWise and other RMM tools for initial access (MITRE)
TruffleHog - repository secret scanner (Huntress, source 10)
S3 Browser, WinSCP, AWS CLI - cloud storage discovery and deletion (MITRE)
Salesforce Data Loader; modified AuraInspector (Huntress, source 10)
Limewire (proof samples), Tox (negotiation), Tor (leak site)

[ ] Oracle Security Alert for CVE-2026-35273 (issued 10 Jun 2026) applied on every PeopleSoft web tier
[ ] EMHub service disabled, or PSEMHUB application removed
[ ] /PSEMHUB and /PSIGW/HttpListeningConnector blocked on the NORMALIZED, case-insensitive path (not a literal string match)
[ ] Credentials readable by the PeopleSoft service account rotated if any exposure is suspected
[ ] Outbound TCP/445 from server networks to the internet denied
[ ] Phishing-resistant MFA (FastPass, FIDO2 passkeys) enforced for all admins, then all users
[ ] SMS, voice, email and push-only factors removed where phishing-resistant options exist
[ ] MFA enrollment allowed only from managed devices or trusted networks, with re-authentication
[ ] Help desk requires live video ID check, manager approval and callback to a number on file
[ ] Okta ThreatInsight on; super admin restricted to corporate network zones
[ ] Entra: Conditional Access covers Register security information and Global Administrator sign-in
[ ] Google Workspace third-party API access restricted; alert on ToogleBox Recall
[ ] Salesforce Event Monitoring on; Data Loader and API access limited to named profiles
[ ] Microsoft Purview Audit on and PowerShell user agents captured for SharePoint and OneDrive
[ ] Integration tokens inventoried, scoped, IP-restricted and rotated

Verify after deployment. Over 14 days, confirm that Q5 and Q8 return only explained hits, that /%50SEMHUB/hub returns 403 from the proxy, and that no MFA factor was added from an untrusted network.

Each step carries its prerequisites, reboot requirement and rollback. Replace every REPLACE_WITH value before use, and test in non-production first.

Playbook 1 · PeopleSoft exposure reduction (T1190, T1505.003; M1051, M1042, M1030)

Step 1.1 · Deny the EMHub and Integration Gateway paths at the reverse proxy

What it does: Blocks /PSEMHUB and /PSIGW/HttpListeningConnector on the normalized, case-insensitive path, so the percent-encoded variant /%50SEMHUB/ is blocked too.

Prerequisites: A reverse proxy in front of the PIA web tier; confirm EMHub is not needed for your patching workflow (Mandiant calls the block non-breaking for PIA users).

Reboot required: No. Reload the proxy; no OS reboot.

Configuration

# nginx: add inside the server block that fronts PIA
location ~* ^/psemhub(/|$)                 { return 403; }
location ~* ^/psigw/httplisteningconnector { return 403; }

# Apache httpd equivalent
<LocationMatch "(?i)^/psemhub(/|$)">
    Require all denied
</LocationMatch>
<LocationMatch "(?i)^/psigw/httplisteningconnector">
    Require all denied
</LocationMatch>

# nginx: validate and reload
nginx -t && nginx -s reload

Verify

for p in /PSEMHUB/hub /%50SEMHUB/hub /psemhub/hub /PSIGW/HttpListeningConnector; do
  printf '%s -> ' "$p"
  curl -sk -o /dev/null -w '%{http_code}\n' "https://REPLACE_WITH_PIA_HOST$p"
done
# Expect 403 for all four lines

Rollback

# Remove the location blocks above, then reload
nginx -t && nginx -s reload
# Apache: remove the LocationMatch blocks, then
apachectl configtest && apachectl graceful

Step 1.2 · Apply Oracle's Security Alert and disable EMHub

What it does: Fixes CVE-2026-35273 at the source. Path blocking alone was already bypassed.

Prerequisites: Change window; backup or snapshot of PS_CFG_HOME and the web tier; patch tested in non-production; Oracle Security Alert for CVE-2026-35273.

Reboot required: WebLogic domain restart; no OS reboot unless Oracle's alert says otherwise.

Configuration

# 1) Follow Oracle's Security Alert for CVE-2026-35273 (issued 10 Jun 2026).
# 2) Multi-server: disable the Environment Management Hub service.
#    Single-server: remove the PSEMHUB application.
# 3) Restart the WebLogic domain, then repeat the Step 1.1 verification.

Verify

# After restart, the EMHub servlet must not answer
curl -sk -o /dev/null -w '%{http_code}\n' "https://REPLACE_WITH_PIA_HOST/PSEMHUB/hub"
# Expect 403 or 404. Then confirm the applied patch level in the PeopleTools patch inventory.

Rollback

# Restore the pre-change snapshot of PS_CFG_HOME and the web tier.
# Oracle security patches are not individually uninstallable, so keep the snapshot until the change is accepted.

Playbook 2 · Linux application servers (T1110.003, T1021.004, T1560.002; M1032, M1027, M1047)

Step 2.1 · Key-only SSH with a low retry count

What it does: Gives the sshpass credential-spray script nothing to guess.

Prerequisites: Working key-based access for every admin and for break-glass. Keep a second session open. OpenSSH 8.2 or later reading /etc/ssh/sshd_config.d.

Reboot required: No. Reload sshd.

Configuration

# /etc/ssh/sshd_config.d/99-huntpack-hardening.conf
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
MaxAuthTries 3

# apply
sshd -t && systemctl reload sshd

Verify

sshd -T | grep -Ei '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin|maxauthtries) '
# Expect: no, no, no, 3

Rollback

rm /etc/ssh/sshd_config.d/99-huntpack-hardening.conf
sshd -t && systemctl reload sshd

Step 2.2 · auditd rules for the attacker's tools and the web directory

What it does: Records sshpass and zstd execution and any write under PSEMHUB.war, giving Q4 and Q5 a second source.

Prerequisites: auditd installed and running; the rules file is not in immutable mode (-e 2).

Reboot required: No, unless auditd is set immutable, in which case a reboot loads the rules.

Configuration

# /etc/audit/rules.d/99-huntpack-shinyhunters.rules
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/sshpass -k sshpass_exec
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/zstd -k zstd_exec
-w /u01/app/psoft/ps_config_homes/csprd/webserv -p wa -k psemhub_write   # adjust to your PS_CFG_HOME

sudo augenrules --load

Verify

sudo auditctl -l | grep -E 'sshpass_exec|zstd_exec|psemhub_write'
sudo ausearch -k sshpass_exec -ts today

Rollback

sudo rm /etc/audit/rules.d/99-huntpack-shinyhunters.rules
sudo augenrules --load

Playbook 3 · Deny outbound SMB from servers (T1187; M1037)

Step 3.1 · Drop outbound TCP/445 to public addresses

What it does: Stops NetNTLM coercion and SMB exfiltration from the PeopleSoft tier. Do the same at the perimeter firewall for server networks.

Prerequisites: nftables active; no server uses SMB to a public service such as Azure Files.

Reboot required: No.

Configuration

sudo nft add table inet huntpack
sudo nft add chain inet huntpack out '{ type filter hook output priority 0; policy accept; }'
sudo nft add rule inet huntpack out ip daddr != { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } tcp dport 445 counter drop

Verify

sudo nft list table inet huntpack
# The counter increments on blocked attempts; Q6 should go quiet

Rollback

sudo nft delete table inet huntpack

Playbook 4 · Entra ID Conditional Access (T1098.005, T1556.006; M1032, M1036)

Step 4.1 · Block security-info registration from untrusted locations (report-only first)

What it does: Prevents an attacker from adding an MFA method from their own network after stealing a password and code.

Prerequisites: Microsoft Graph PowerShell with Policy.ReadWrite.ConditionalAccess; named locations configured with your trusted networks marked trusted; a break-glass group.

Reboot required: No.

Configuration

Connect-MgGraph -Scopes 'Policy.ReadWrite.ConditionalAccess','Policy.Read.All'
$params = @{
  displayName = 'HuntPack - Block security info registration from untrusted locations'
  state       = 'enabledForReportingButNotEnforced'
  conditions  = @{
    users        = @{ includeUsers = @('All'); excludeGroups = @('REPLACE_WITH_BREAKGLASS_GROUP_ID') }
    applications = @{ includeUserActions = @('urn:user:registersecurityinfo') }
    locations    = @{ includeLocations = @('All'); excludeLocations = @('AllTrusted') }
  }
  grantControls = @{ operator = 'OR'; builtInControls = @('block') }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params

Verify

Get-MgIdentityConditionalAccessPolicy -Filter "displayName eq 'HuntPack - Block security info registration from untrusted locations'" | Select-Object DisplayName, State
# Review the report-only results in Entra sign-in logs for two weeks, then set state to 'enabled'

Rollback

$id = (Get-MgIdentityConditionalAccessPolicy -Filter "displayName eq 'HuntPack - Block security info registration from untrusted locations'").Id
Remove-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $id

Step 4.2 · Require phishing-resistant authentication for Global Administrators (report-only first)

What it does: Applies the built-in phishing-resistant authentication strength to the most valuable role.

Prerequisites: Admins registered with FIDO2 keys or passkeys first, or they will be locked out; a break-glass group.

Reboot required: No.

Configuration

$params = @{
  displayName = 'HuntPack - Global Administrators require phishing-resistant MFA'
  state       = 'enabledForReportingButNotEnforced'
  conditions  = @{
    users        = @{ includeRoles = @('62e90394-69f5-4237-9190-012177145e10'); excludeGroups = @('REPLACE_WITH_BREAKGLASS_GROUP_ID') }
    applications = @{ includeApplications = @('All') }
  }
  grantControls = @{ operator = 'OR'; authenticationStrength = @{ id = '00000000-0000-0000-0000-000000000004' } }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params

Verify

Get-MgIdentityConditionalAccessPolicy -Filter "displayName eq 'HuntPack - Global Administrators require phishing-resistant MFA'" | Select-Object DisplayName, State

Rollback

$id = (Get-MgIdentityConditionalAccessPolicy -Filter "displayName eq 'HuntPack - Global Administrators require phishing-resistant MFA'").Id
Remove-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $id

Playbook 5 · Okta (T1098.005, T1078.004; M1032, M1036)

Step 5.1 · Tighten enrollment, network zones and admin access in the Admin Console

What it does: Limits where factors can be enrolled, blocks anonymizer networks, and restricts the admin console.

Prerequisites: Okta super administrator; a list of corporate egress ranges; FastPass or FIDO2 enrolled for admins; menu names can vary by release and SKU.

Reboot required: No.

Configuration

1. Security > General: set Okta ThreatInsight to log and enforce at the threat level you accept.
2. Security > Networks: add a zone for corporate egress ranges, and a dynamic zone for anonymizers and proxies if your SKU offers it; mark the anonymizer zone as blocked.
3. Security > Authenticators > Enrollment: edit the enrollment policy so Okta Verify and FastPass enrollment requires re-authentication and runs only from the corporate zone.
4. Security > Authentication policies: for the Okta Admin Console app, add a rule that requires a phishing-resistant authenticator and the corporate zone.
5. Record the previous value of each setting before saving.

Verify

System Log search, last 24 hours:
eventType eq "user.mfa.factor.activate"
# Every hit should come from the corporate zone and carry a managed device

Rollback

Reverse each console change using the previous values recorded in step 5.
Blocking a zone can lock out remote staff; keep a super-admin session open while testing.

Playbook 6 · Salesforce and Google Workspace (T1213, T1567, T1070.008; M1047, M1026)

Step 6.1 · Limit Salesforce export paths and keep event logs

What it does: Reduces who can bulk-export and makes bulk activity visible.

Prerequisites: Salesforce admin; Event Monitoring licence; a list of integration users that need API access.

Reboot required: No.

Configuration

1. Setup > Event Monitoring Settings: enable the event types you ingest (login, API, bulk-result, report export).
2. Profiles and permission sets: remove API Enabled and Export Reports from profiles that do not need them.
3. Profiles: set Login IP Ranges for integration and admin profiles.
4. Digital Experiences: review each guest user profile and remove object and API access it does not need.

Verify

SELECT Profile.Name, COUNT(Id) FROM User WHERE IsActive = true AND Profile.PermissionsApiEnabled = true GROUP BY Profile.Name
# Only profiles with a business need should appear

Rollback

Restore the previous profile permissions from the change record. Removing API Enabled can break integrations, so test with one profile first.

Step 6.2 · Restrict third-party app access in Google Workspace

What it does: Stops users authorizing add-ons such as ToogleBox Recall, which can permanently delete mail.

Prerequisites: Google Workspace super administrator.

Reboot required: No.

Configuration

Admin console > Security > Access and data control > API controls > Manage third-party app access: set unconfigured third-party apps to restricted for Gmail scopes, and allowlist only approved apps.
Admin console > Reporting > Audit and investigation > OAuth log events: add an alert on app name containing ToogleBox.

Verify

Audit and investigation > OAuth log events, filter App name contains ToogleBox. Expect no authorization events.

Rollback

Set the access setting back to its previous value. Restricting apps can break approved add-ons, so allowlist them first.

Containment order follows Mandiant's guidance (source 5): because these intrusions use valid credentials rather than malware, revoking sessions and restricting identity operations comes before host cleanup.

Gaps. The phone call and the lure page on a personal phone are outside endpoint telemetry; only help-desk process and user training cover them. File creation of JSP web shells has no Falcon query in this pack, so N6 and the host auditd rule cover it. Extortion contact is covered by mail-gateway search (N9) and legal process. Integration-token reuse is partly outside endpoint telemetry and depends on SaaS audit ingest.

Validation. Run Section 11 before promoting: telemetry ready, 14-day baseline, safe positive tests, then staged promotion.