ShinyHunters Exploits Oracle PeopleSoft Zero-Day, Breaches 100+ Organizations

Mandiant and Google's Threat Intelligence Group (GTIG) have linked an extortion campaign running from May 27 to June 9, 2026 to the threat actor tracked as UNC6240, publicly known as ShinyHunters. The group exploited CVE-2026-35273, a CVSS 9.8 remote code execution flaw in the Environment Management component of Oracle PeopleSoft PeopleTools, before Oracle published its security advisory on June 10 — confirming the vulnerability was used as a zero-day.

Oracle has since acknowledged that PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are affected and has released emergency mitigations while a full patch is in preparation. The flaw requires no authentication to exploit and can yield complete remote code execution on vulnerable instances.

GTIG researchers identified five sequential staging IPs (142.11.200.186–.190) running Python SimpleHTTP servers on port 8888, which inadvertently exposed attacker tooling, command histories, and prebuilt agent binaries. Those binaries were MeshCentral remote management agents compiled for Windows and disguised as Microsoft Azure services — the executables carried names like meshagent64-azure-ops.exe and were hardcoded to call back to a command-and-control domain, azurenetfiles.net, chosen to mimic legitimate Azure NetApp Files infrastructure. A Let's Encrypt certificate for that domain was provisioned automatically via the acme-client npm package within minutes of the staging server being stood up.

The exposed .bash_history files, identical across all five hosts, gave investigators a detailed timeline of attacker operations. After establishing the C2 environment, the group used MeshCentral's CLI tool to run reconnaissance commands on victim hosts — querying PeopleSoft process scheduler configurations, WebLogic XML files, and internal network mounts. Lateral movement was carried out by a custom shell script, named with a victim-specific abbreviation followed by _fanout.sh, which parsed internal hostnames, attempted SSH credential spraying using hardcoded username-password pairs, and deposited a ransom-note file (README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT) into WebLogic and Process Scheduler directories. Exfiltrated data was compressed with zstd before the staging host connected outbound to 176.120.22.24, the server hosting the public ShinyHunters data leak site.

Data from compromised organizations appeared on that leak site on June 9, 2026 — the same day open attacker directories were publicly flagged by researcher @nahamike01 on X, prompting GTIG's detailed triage.

ShinyHunters confirmed to BleepingComputer that they are responsible, describing the attack chain as a combination of older vulnerabilities and the new zero-day. The group has previously been connected to large-scale breaches of Snowflake-hosted data and Salesforce environments, as well as a recent intrusion at Instructure Canvas that reportedly led to a ransom payment.

Google SecOps customers will receive detection rules covering PeopleSoft configuration inspection, suspicious JSP writes to PSEMHUB, sshpass-based file deployment, zstd compression activity, and MeshCentral command execution via meshctrl.

Oracle has not publicly confirmed active exploitation in its advisory, but both Mandiant's telemetry and ShinyHunters' own statements corroborate ongoing attacks. Organizations on versions 8.61 or 8.62 should treat mitigation as urgent pending the forthcoming patch.