ShinyHunters PeopleSoft fan-out lateral movement via sshpass

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects automated lateral movement attempts using sshpass to perform password spraying or authentication against PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule specifically flags the use of sshpass with lax security settings (StrictHostKeyChecking=no), identifying a pattern associated with the uon_fanout.sh post-exploitation script.