Executive Summary
On September 15, 2026, Dutch authorities arrested 24-year-old Pepijn van der Stap (aka Umbreon) from Amsterdam in connection with the notorious ShinyHunters cybercriminal group. Van der Stap, who was previously convicted in 2023 for data theft and extortion while working at cybersecurity firm Hadrian, was arrested again while still on probation and currently employed as offensive security lead at Neo Security. The arrest follows ShinyHunters' high-profile claim of breaching the FBI's job application site using CVE-2026-35273, though the group denies any connection to van der Stap.
This incident highlights the growing trend of insider threats and the blurred lines between cybersecurity professionals and cybercriminals. With ransomware groups increasingly recruiting individuals with legitimate security backgrounds, organizations face heightened risks from trusted insiders who may leverage their privileged access and knowledge for malicious purposes.
Why This Matters Now
The arrest exposes critical vulnerabilities in cybersecurity hiring practices and insider threat detection. With cybercriminals increasingly infiltrating security teams and leveraging legitimate credentials for attacks, organizations must urgently reassess their vetting processes and implement continuous monitoring of privileged users.
Attack Path Analysis
ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft using URL-encoding to bypass WAF protections on FBI's job application site. The attackers escalated privileges within the compromised system, moved laterally to access sensitive databases, established command and control channels for data extraction, and successfully exfiltrated terabytes of FBI employee data before claiming responsibility as a marketing demonstration.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Exploited CVE-2026-35273 vulnerability in Oracle PeopleSoft on apply.fbijobs.gov using URL-encoding technique to bypass web application firewall rules
Related CVEs
CVE-2026-35273
CVSS 9.8Oracle PeopleSoft vulnerability that can be exploited through URL-encoding techniques to bypass web application firewall rules and gain unauthorized access.
Affected Products:
Oracle PeopleSoft – Multiple versions
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Valid Accounts
Process Injection
Exfiltration Over Web Service
Data from Local System
Active Scanning
Obtain Capabilities
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Public-facing web applications are protected against attacks
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: 500.09
DORA – Testing of ICT Business Continuity Policy
Control ID: Article 8
CISA ZTMM 2.0 – Data Access and Handling
Control ID: DA.L2
NIS2 Directive – Cybersecurity Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Law Enforcement
FBI breach exposes critical vulnerabilities in government job application systems, compromising sensitive personnel data and requiring enhanced zero-trust segmentation and egress controls.
Computer/Network Security
ShinyHunters targeting demonstrates urgent need for improved WAF bypass protection, Oracle PeopleSoft patching, and enhanced threat detection capabilities across cybersecurity infrastructure.
Government Administration
Government entities face elevated data theft risks requiring immediate implementation of encrypted traffic controls, anomaly detection, and comprehensive zero-trust network architectures.
Information Technology/IT
Oracle PeopleSoft systems vulnerable to URL-encoding WAF bypass attacks necessitate enhanced egress security policies and multicloud visibility for comprehensive data protection.
Sources
- Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigationhttps://thehackernews.com/2026/09/dutch-police-arrest-24-year-old.htmlVerified
- Dutch Police Arrest Reformed Hacker in Shiny Hunters Investigationhttps://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/Verified
- Attackers Bypass WAFs to Exploit Oracle PeopleSofthttps://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.htmlVerified
- Dutch Police Official Statement on ShinyHunters Arresthttps://x.com/Pol_Ops_Int/status/2104607979559342174Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely have constrained the ShinyHunters attack against FBI systems by limiting lateral movement through network segmentation and reducing data exfiltration scope via egress controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The initial application compromise may still have occurred, but CNSF monitoring would likely have detected anomalous traffic patterns and provided visibility into the exploitation attempt against the PeopleSoft system.
Control: Zero Trust Segmentation
Mitigation: Zero trust architecture would likely have constrained the attacker's ability to escalate privileges by enforcing identity-based access controls and limiting resource access to authenticated workloads with verified permissions.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have significantly reduced the attacker's lateral movement capabilities by blocking unauthorized inter-system communications and restricting access to connected databases containing employee records.
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility capabilities would likely have detected the establishment of unauthorized communication channels and identified suspicious coordination patterns across the distributed FBI infrastructure during the extraction operation.
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls would likely have constrained the volume and scope of data exfiltration by enforcing outbound traffic policies and detecting large-scale data transfers exceeding normal baseline patterns.
While the public disclosure would still have occurred, the overall impact would likely have been reduced due to constrained lateral movement and limited data exfiltration scope from earlier CNSF controls.
Impact at a Glance
Affected Business Functions
- Law Enforcement Operations
- Criminal Investigation Services
- Digital Evidence Processing
- Cybercrime Response
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of FBI employee personal information, job application data, and sensitive government personnel records from terabytes of stolen data during the FBI jobs portal breach
Recommended Actions
Key Takeaways & Next Steps
- • Implement Inline IPS with Suricata signatures to detect and block CVE-2026-35273 exploitation attempts and URL-encoding bypass techniques
- • Deploy Cloud Firewall with egress filtering to prevent unauthorized data exfiltration to external destinations and detect anomalous outbound traffic patterns
- • Enable Zero Trust Segmentation with least privilege access controls to limit lateral movement from compromised web applications to backend database systems
- • Implement Encrypted Traffic controls with high-performance encryption to protect sensitive data in transit and prevent interception during exfiltration
- • Deploy Multicloud Visibility & Control with centralized monitoring to detect suspicious automation patterns and repeated malformed requests targeting application vulnerabilities
