Lateral Movement via sshpass targeting Oracle/PeopleSoft (ShinyHunters TTP)

Ethan Andrews@eandrews

•updated Jun 10, 2026•7•0•12

Detects automated credential spraying and lateral movement attempts using the sshpass utility targeting common Oracle/PeopleSoft usernames. This specific combination of parameters and targeted accounts matches the bash script deployment mechanism utilized by the ShinyHunters extortion gang.