PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data

Mandiant attributes active data-exfiltration activity to the ShinyHunters group, reporting that attackers conducted reconnaissance in PeopleSoft environments, mapped configurations and WebLogic XML, established outbound SSH connections to an IP (176.120.22.24) hosting a data leak site, compressed stolen data with zstd, and published datasets (one victim lost ~48GB). The report notes multiple large victims since 2019, outlines techniques used (cloud misconfigurations, software vulnerabilities, stolen OAuth tokens, supply-chain and social engineering), and points to IOCs and mitigations provided by Mandiant and Rapid7.