Loading story…
Google Threat Intelligence and Mandiant reported renewed mass exploitation of CVE-2026-35273, a critical CVSS 9.8 unauthenticated remote-code-execution flaw in Oracle PeopleSoft Environment Management Hub's PSEMHUB servlet. The UNC6240 cluster, linked to ShinyHunters, bypassed literal URL WAF and reverse-proxy rules by encoding the leading P in the affected path as /%50SEMHUB/; Oracle WebLogic decodes the path before routing it to the vulnerable Java-deserialization endpoint. Dozens of organizations worldwide, including entities in higher education, technology, IT services, healthcare, agriculture, transportation, and government, have been compromised.
Attackers deployed JSP web shells, the SIDEEYE backdoor, Neo-reGeorg tunneling tooling, and MeshAgent for persistence and remote access. Oracle released an emergency update for the vulnerability on June 10; defenders should apply it, disable PSEMHUB where operationally feasible, review web and application logs and files for compromise, and rotate potentially exposed credentials. Google warned that UNC6240's history of data theft and extortion creates a risk of follow-on extortion and public data leaks. ShinyHunters separately claimed an FBIJobs.gov breach involving another alleged PeopleSoft zero-day and 2–3 TB of data, but no evidence links that claim to CVE-2026-35273.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Oracle issued an emergency security update for the critical PeopleSoft Environment Management Hub flaw CVE-2026-35273.
UNC6240, an activity cluster linked to ShinyHunters, exploited the Oracle PeopleSoft PSEMHUB vulnerability later assigned CVE-2026-35273 as a zero-day. The activity ran from May 27 through June 9 and included attacks on academic institutions and other organizations.
ShinyHunters stated that it had previously operated as GnosticPlayers before rebranding.
ShinyHunters claimed it compromised the FBIJobs.gov portal using a different Oracle PeopleSoft zero-day and stole roughly 2–3 TB of data. The claim was not independently verified, and the sources found no evidence linking it to CVE-2026-35273 exploitation.
UNC6240 renewed mass exploitation of CVE-2026-35273, requesting /%50SEMHUB/ to bypass literal-path WAF and reverse-proxy rules before WebLogic decoded and routed requests to the vulnerable servlet. The campaign affected dozens of organizations across multiple sectors and deployed JSP web shells, SIDEEYE, Neo-reGeorg, and MeshAgent.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters used an Oracle PeopleSoft exploit to compromise organizations in the education sector, with exposed attacker infrastructure showing staging materials, customized MeshCentral agents, and command history tied to the intrusions. Public reporting identified five sequential attacker-controlled IP addresses serving open Python SimpleHTTP directories on port `8888`, while the operators deployed Windows MeshCentral agents disguised as Microsoft Azure services and configured them to beacon to `wss://azurenetfiles.net:443/agent.ashx`, a domain crafted to resemble Azure NetApp Files branding. Google Threat Intelligence Group said more than 100 exposed organizations were notified, and **68%** of them were in higher education; some victims later had stolen data posted on the ShinyHunters data leak site. The recovered `.bash_history` indicated the attackers installed MeshCentral `v1.1.59` on May 27, 2026, added the `acme-client` npm package to automate Let's Encrypt certificates, used `meshctrl.js` for reconnaissance on compromised systems, examined Oracle PeopleSoft and WebLogic configurations, and then connected outbound over SSH to `176.120.22.24`, identified as the public clearnet mirror of the ShinyHunters leak site.
Jul 15, 2026
ShinyHunters reportedly exploited a critical zero-day vulnerability in Oracle PeopleSoft during May and early June 2026, compromising about 300 PeopleSoft instances at roughly 100 organizations worldwide. The Council of Europe was among the alleged victims; attackers targeted ERP management and configuration layers to steal employee and student personal data, payroll, tax, financial, health, immigration, and passport records. The Council reportedly declined to negotiate or pay. Reported extortion demands ranged from **$400,000 to $2.3 million** per victim. The incident highlights the exposure created by cloud and SaaS supply-chain dependencies and the need for rapid risk-based remediation, Zero Trust and identity controls, dependency mapping, isolated immutable backups, and regularly tested cyber-recovery plans.
Sep 12, 2026
ShinyHunters has claimed a broad intrusion campaign against Oracle PeopleSoft servers, saying it compromised roughly 300 instances across more than 100 organizations, with universities and other education-sector entities appearing to be the primary victims. The group told reporters it exfiltrated sensitive student and administrative records, including applicant, financial aid, immigration, health, and contact data, and identified Nottingham University as one victim; the university acknowledged a cybersecurity incident. One member of the group also said an attempted breach of an FBI PeopleSoft server was intended to post a denial of the gang’s involvement in recent swatting incidents, but that effort allegedly failed. Reporting indicates the attacks are tied to data theft and extortion activity and may involve a gadget chain using older flaws alongside a possible zero-day, with impact varying by PeopleSoft configuration. Independent research found exposed directories containing tooling linked to the campaign, including MeshCentral agents, a defacement script, a credential-spraying tool, and infrastructure associated through TLS certificates with `azurenetfiles[.]net`. Investigators also observed a shell script that parsed `/etc/hosts`, attempted SSH access with common PeopleSoft and Oracle administrative accounts, and dropped a ransom note named `README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT` on compromised internal PeopleSoft servers, while Oracle had not publicly commented on the allegations at the time of reporting.
Jul 3, 2026