ShinyHunters Data Extortion Group Compromises Over 100 Organizations Using Oracle PeopleSoft Zero-Day Vulnerability
ShinyHunters Exploits Oracle PeopleSoft Zero-Day, Breaching Over 100 Orgs, Primarily in Higher Education
Impact Scope
People Affected
Over 100 organizations
Affected Companies
Industries Affected
Geographic Impact
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
CVE Identifiers
Full Report(when first published)
Executive Summary
The financially motivated threat group ShinyHunters has been identified as the actor behind a widespread campaign exploiting a zero-day vulnerability in Oracle PeopleSoft. The critical flaw, CVE-2026-35273, is an unauthenticated remote code execution (RCE) vulnerability with a CVSS score of 9.8. Between late May and early June 2026, the group used this exploit to breach over 100 organizations globally before a patch was available. A joint report from Mandiant and Google's Threat Intelligence Group revealed that the campaign disproportionately targeted the higher education sector, which accounted for 68% of victims, primarily in the United States. The University of Nottingham has been publicly named as a victim. In response to active exploitation, CISA has added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, demanding federal agencies remediate by June 15, 2026.
Threat Overview
- Threat Actor: ShinyHunters (also tracked as UNC6240)
- Targeting: Over 100 organizations, with a heavy focus on higher education (68%), primarily in the U.S. and U.K.
- Attack Vector: Exploitation of a zero-day RCE vulnerability, CVE-2026-35273, in Oracle PeopleSoft Enterprise PeopleTools.
- Objective: Initial access for data theft and extortion. The group exfiltrates sensitive data and posts it on their data leak site to pressure victims into paying.
- Timeline: Attacks were observed between May 27 and June 9, 2026. Oracle released a security alert on June 10, and CISA added the CVE to its KEV list on June 12.
Technical Analysis
The core of the attack is the exploitation of CVE-2026-35273. This vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) allows an unauthenticated attacker with network access to the system to execute arbitrary code, leading to a complete takeover.
MITRE ATT&CK TTPs
T1190 - Exploit Public-Facing Application: ShinyHunters used the zero-day exploit against internet-facing Oracle PeopleSoft instances to gain initial access.T1071.001 - Web Protocols: The attackers used customized MeshCentral agents for command and control (C2), communicating over standard web protocols to disguise their traffic.T1105 - Ingress Tool Transfer: After gaining access, the attackers downloaded their post-exploitation toolkits, including the MeshCentral agents.T1567 - Exfiltration Over Web Service: The group exfiltrated large volumes of data (e.g., 40 GB from the University of Nottingham) to be used for extortion.T1048 - Exfiltration Over Alternative Protocol: The use of MeshCentral, a remote management tool, for C2 and data staging can be considered an alternative protocol for exfiltration.
Mandiant's analysis noted the use of customized MeshCentral agents, an open-source remote management tool. By disguising these agents as legitimate cloud endpoints, ShinyHunters could maintain persistence and execute commands stealthily.
Impact Assessment
The impact on affected organizations, particularly universities, is severe. PeopleSoft systems often serve as the central hub for student information systems (SIS), human resources (HR), and financial data. A successful breach can lead to:
- Massive Data Theft: Exfiltration of sensitive personally identifiable information (PII) for students, faculty, and staff, including names, addresses, financial details, and academic records.
- Extortion Demands: ShinyHunters is a data extortion group, meaning they will demand payment to prevent the public release of stolen data.
- Regulatory Fines: Breaches involving student or employee data can lead to significant fines under regulations like GDPR or state-level privacy laws.
- Reputational Damage: A public breach can severely damage an institution's reputation, affecting student enrollment and trust.
- Operational Disruption: Remediation efforts can be costly and time-consuming, potentially disrupting core administrative functions.
IOCs — Directly from Articles
No specific Indicators of Compromise (IPs, domains, hashes) were provided in the source articles.
Cyber Observables — Hunting Hints
Security teams may want to hunt for the following patterns to identify potentially compromised PeopleSoft systems:
process_namepsft.exe, psappsrv.exeprocess_nameMeshCentral.exe, MeshAgent.exenetwork_traffic_pattern*.meshcentral.comlog_sourcefile_pathC:\Program Files\PeopleSoft\Detection & Response
- Prioritize Patching: Immediately apply the risk reduction measures provided by Oracle for CVE-2026-35273. Given it's a KEV, this should be treated as an emergency.
- Hunt for Compromise: Proactively hunt for signs of compromise on all PeopleSoft servers, focusing on the period from late May 2026 onwards. Use the observables above as a starting point.
- Network Monitoring (D3-NTA: Network Traffic Analysis): Scrutinize all outbound network connections from PeopleSoft servers. Block and alert on any connections to unknown or suspicious domains, especially those related to remote access tools like MeshCentral.
- Log Review: Analyze web server access logs for PeopleSoft front-end servers, looking for unusual URL requests or patterns that might indicate exploit attempts.
Mitigation
- Apply Oracle's Mitigations: Follow Oracle's guidance to remediate CVE-2026-35273. This is the most critical step. (D3-SU: Software Update)
- Restrict Access: Limit network access to PeopleSoft systems. If possible, they should not be directly exposed to the internet. Use a Web Application Firewall (WAF) to filter and monitor traffic. (D3-ITF: Inbound Traffic Filtering)
- Egress Filtering: Implement strict outbound network traffic rules (egress filtering) for servers hosting PeopleSoft, allowing connections only to known-good, required destinations. This can prevent C2 communication and data exfiltration. (D3-OTF: Outbound Traffic Filtering)
- Principle of Least Privilege: Ensure that the service accounts running PeopleSoft applications have the minimum necessary privileges to function, limiting the potential impact of an RCE. (D3-UAP: User Account Permissions)
Timeline of Events
Article Updates
June 15, 2026
University of Nottingham confirms 454,600 student records, including passport numbers, stolen by ShinyHunters via Oracle PeopleSoft zero-day.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Applying the vendor-supplied security measures from Oracle is the most direct way to prevent exploitation of CVE-2026-35273.
Filter Network Traffic
Implementing strict ingress and egress filtering can prevent attackers from reaching the vulnerable application and block C2 communication or data exfiltration.
Behavior Prevention on Endpoint
Using EDR or other behavior-based tools to detect anomalous process creation (e.g., PeopleSoft server spawning a remote access tool) can help identify post-exploitation activity.
User Account Management
Ensure service accounts for applications like PeopleSoft run with the principle of least privilege to limit an attacker's capabilities after a successful RCE.
D3FEND Defensive Countermeasures
Deploy a Web Application Firewall (WAF) in front of all internet-facing Oracle PeopleSoft applications. Configure the WAF with rulesets specifically designed to protect PeopleSoft environments. Even without a specific signature for CVE-2026-35273, a well-configured WAF can block anomalous HTTP requests, common exploit patterns (like command injection or directory traversal), and requests from known malicious IP addresses. This provides a critical layer of defense that can mitigate zero-day exploits before a patch is available. The WAF should be set to block by default and only allow legitimate, expected traffic patterns to the PeopleSoft application.
Implement strict egress filtering on the network segments hosting your Oracle PeopleSoft servers. These critical backend servers should have no reason to initiate connections to arbitrary destinations on the internet. Create explicit firewall rules that only allow outbound traffic to a pre-approved list of destinations, such as Oracle update servers or internal logging infrastructure. This 'deny-by-default' posture would have severely hindered ShinyHunters' ability to establish command and control using their MeshCentral agents or exfiltrate the 40GB of data. This technique effectively contains the breach, turning a full-blown data theft incident into a more manageable, isolated compromise.
Utilize an Endpoint Detection and Response (EDR) solution on all PeopleSoft servers to monitor process lineage. The core PeopleSoft server processes (e.g., 'psappsrv.exe') should have a very predictable set of child processes. Create detection rules that alert on any anomalous process creation, such as 'psappsrv.exe' spawning 'cmd.exe', 'powershell.exe', or any unrecognized binary. This is a highly effective method for detecting post-exploitation activity resulting from an RCE. In this case, it could have detected the execution of the custom MeshCentral agent, allowing security teams to respond before significant data exfiltration could occur.
Timeline of Events
ShinyHunters begins exploiting the Oracle PeopleSoft zero-day.
Data stolen from victims is posted on ShinyHunters' leak site. The initial attack campaign ends.
Oracle releases a security alert about the vulnerability.
CISA adds CVE-2026-35273 to its KEV catalog.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.