ShinyHunters Infrastructure Communication

Ibrahim Saud@tektrix

•updated Jun 22, 2026•9•0•34

Identifies network connections to known ShinyHunters IP addresses or domains associated with the recent Oracle PeopleSoft exploitation campaign. This rule monitors both endpoint network events and perimeter firewall/proxy logs for outbound communication to the specified malicious infrastructure.