ShinyHunters Exploits Oracle PeopleSoft to Breach Universities

ShinyHunters used an Oracle PeopleSoft exploit to compromise organizations in the education sector, with exposed attacker infrastructure showing staging materials, customized MeshCentral agents, and command history tied to the intrusions. Public reporting identified five sequential attacker-controlled IP addresses serving open Python SimpleHTTP directories on port 8888, while the operators deployed Windows MeshCentral agents disguised as Microsoft Azure services and configured them to beacon to wss://azurenetfiles.net:443/agent.ashx, a domain crafted to resemble Azure NetApp Files branding.

Google Threat Intelligence Group said more than 100 exposed organizations were notified, and 68% of them were in higher education; some victims later had stolen data posted on the ShinyHunters data leak site. The recovered .bash_history indicated the attackers installed MeshCentral v1.1.59 on May 27, 2026, added the acme-client npm package to automate Let's Encrypt certificates, used meshctrl.js for reconnaissance on compromised systems, examined Oracle PeopleSoft and WebLogic configurations, and then connected outbound over SSH to 176.120.22.24, identified as the public clearnet mirror of the ShinyHunters leak site.