[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnfxXtnMio6QXt9SIUeWIzzpDOgQOFTkm8BDKJWQUtcU":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":36},"69e249f1-b487-4c00-b9db-226fa9d4f4ef","ShinyHunters Extorted Boeing Spin-off Prior to Arrests","shinyhunters-extorted-boeing-spin-off-prior-to-arrests-2c4e6a","A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle \"Rey,\" was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by the employer of Rey's father -- Royal Jordanian Airlines.","A teenager suspected of leading the ShinyHunters data theft group, known as 'Rey,' has been detained in Jordan and is reportedly cooperating with the FBI. At the time of his arrest, ShinyHunters was in the process of extorting a business unit recently divested by Boeing. The group exploited a vulnerability in Oracle's PeopleSoft software to steal data from numerous organizations across various sectors.","ShinyHunters leader 'Rey' arrested, cooperating with FBI; Boeing unit extorted.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F10\u002Fshinyhunters-extorted-boeing-spin-off-prior-to-arrests\u002F",null,"2026-10-07T13:48:45+00:00","2026-10-07T14:00:05.918664+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Rey",{"name":23,"type":19},"Umbreon",{"name":25,"type":26},"Oracle","vendor",{"name":28,"type":29},"PeopleSoft","product",{"name":31,"type":26},"Boeing","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":12,"name":34,"slug":35},"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":44,"icon":12,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":12,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":32,"icon":12,"name":34,"slug":35},[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-35273","Vulnerability in Oracle's PeopleSoft exploited by ShinyHunters",[25,31,28],{"controls":61,"vendors":148},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,103,111],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":92,"product_name":100,"url":101,"description":102},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":120,"name":121,"problem":122,"products":123},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",[149,155],{"slug":150,"name":151,"logo_path":152,"roles":153},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[154],"reported_by",{"slug":156,"name":25,"logo_path":157,"roles":158},"oracle","\u002Fvendor-logos\u002Foracle.png",[159],"affected",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":175},"shinyhunters-exploited-unpatched-peoplesoft-flaw-to-extort-boeing-spin-off","ShinyHunters Exploited Unpatched PeopleSoft Flaw to Extort Boeing Spin-off","The ShinyHunters group exploited a known vulnerability in Oracle's PeopleSoft enterprise software to steal sensitive data from multiple organizations, including a recently divested Boeing business unit. This incident highlights the compounded risk that corporate divestitures introduce — spin-off entities often inherit legacy systems and security debt without maintaining the parent company's security posture or patching cadence. The fact that a known software vulnerability was the attack vector means timely patching or compensating controls could have prevented the breach entirely. Extortion following data theft underscores that the impact of poor vulnerability management extends well beyond technical disruption into reputational and financial harm.",[165,166,167,168,169,170,171,172,173,174],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 3: Data Protection","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 AC-17: Remote Access","NIST CSF ID.RA-1: Asset Vulnerabilities are Identified and Documented","NIST CSF RS.MI-3: Newly Identified Vulnerabilities are Mitigated","ISO 27001 A.12.6.1: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (where EU data subjects are involved)",{}]