Automated SSH Lateral Movement via sshpass to Oracle/PeopleSoft Accounts

Ibrahim Saud@tektrix

•updated Jun 22, 2026•12•0•8

Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.