ShinyHunters zstd Data Compression Pre-Exfiltration on PeopleSoft Host

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the use of the zstd compression utility on PeopleSoft application servers by privileged service accounts such as psoft, oracle, or linuxadm. This behavior is indicative of data staging or archiving activity consistent with ShinyHunters pre-exfiltration tactics.