ShinyHunters PeopleSoft Data Archiving for Exfiltration via tar/zip/zstd

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the use of archive utilities (tar, zip, 7z, gzip, zstd) to bundle sensitive PeopleSoft configuration and application directories (e.g., ps_config_homes, psoft/psft). This behavior is consistent with data staging for exfiltration, frequently associated with the ShinyHunters threat group activity targeting exposed PeopleSoft environments.