ShinyHunters Exploited Oracle PeopleSoft Zero-Day in Campaign Targeting Education Organizations
Summary
Mandiant and Google say ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft from May 27 to June 9, 2026, using MeshCentral agents for reconnaissance and lateral movement before data was published on the group’s leak site.
Key points
- The campaign exploited CVE-2026-35273, a critical unauthenticated remote-code-execution flaw in PeopleSoft’s Environment Management component, before Oracle’s June 10 advisory.
- Mandiant and Google notified more than 100 organizations with potentially exposed endpoints; 68% were in higher education.
- Attackers used customized MeshCentral agents disguised as Azure services and connected them to azurenetfiles.net.
- Command histories show reconnaissance of PeopleSoft and WebLogic configurations, followed by a script that used SSH credential spraying to spread a defacement and extortion marker across internal hosts.
- The researchers linked the activity to stolen data published on the ShinyHunters Data Leak Site on June 9.
- Oracle PeopleSoft operators are advised to disable or remove PSEMHUB where possible, otherwise restrict external access to sensitive endpoints, and investigate logs, filesystems, and outbound SMB traffic.
Article Details
- Attack Vectors
- Exploitation of CVE-2026-35273 in Oracle PeopleSoft Environment Management Hub endpoints to achieve remote code execution; the article reports the activity preceded Oracle's advisory and was therefore zero-day exploitation.
- Deployment of customized MeshCentral agents configured to communicate with attacker C2 infrastructure.
- Reconnaissance of compromised internal systems and Oracle PeopleSoft configurations using MeshCentral command execution.
- SSH credential spraying against internal hosts using lists of administrative and application-specific usernames and passwords, followed by copying a defacement and extortion marker.
- Compression of stolen data into archives and publication of the data on the ShinyHunters Data Leak Site.
- Defensive Notes
- Disable the Environment Management Hub service in multi-server configurations or remove the PSEMHUB application in single-server configurations.
- If the service cannot be disabled, block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the network perimeter.
- Review PIA WebLogic access logs for external POST requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector.
- Inspect PeopleSoft web-tier filesystems for unexpected JSP files, unauthorized files or directories under PSEMHUB staging paths, and recently created or modified XML files in the environment data directory.
- Monitor outbound SMB traffic from PeopleSoft hosts to untrusted external destinations, and audit for unexpected outbound SSH activity.
- Apply Oracle security updates and keep systems on actively supported versions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | azurenetfiles[.]net | Attacker C2 domain used by customized MeshCentral agents and chosen to mimic Azure NetApp Files endpoints. |
| IPV4 | 142[.]11[.]200[.]186 | Attacker staging host exposing staging materials, customized agents, and command histories. |
| IPV4 | 142[.]11[.]200[.]187 | Attacker staging host exposing staging materials, customized agents, and command histories. |
| IPV4 | 142[.]11[.]200[.]188 | Attacker staging host exposing staging materials, customized agents, and command histories. |
| IPV4 | 142[.]11[.]200[.]189 | Attacker staging host exposing staging materials, customized agents, and command histories. |
| IPV4 | 142[.]11[.]200[.]190 | Attacker staging host exposing staging materials, customized agents, and command histories. |
| IPV4 | 176[.]120[.]22[.]24 | IP hosting the public clearnet mirror of the ShinyHunters Data Leak Site; the attackers connected to it from a staging host. |
| SHA256 | 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35 | SHA-256 hash of the attacker command-history file .bash_history. |
| SHA256 | 68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309 | SHA-256 hash of the unconfigured Linux MeshCentral agent staged by the attackers. |
| SHA256 | c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f | SHA-256 hash of the pre-configured Windows agent meshagent32-azure-ops.exe. |
| SHA256 | d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f | SHA-256 hash of the pre-configured Windows agent meshagent64-v2.exe. |
| SHA256 | f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc | SHA-256 hash of the pre-configured Windows agent meshagent64-azure-ops.exe. |
MITRE ATT&CK
T1021.004 · SSHThe propagation script attempted SSH connections to internal hosts and copied the marker file after successful authentication.T1059.004 · Unix ShellThe attackers used Bash commands and a Bash propagation script to conduct reconnaissance and spread the defacement marker.T1110.003 · Password SprayingThe propagation script tried lists of common usernames and passwords against internal hosts over SSH.T1190 · Exploit Public-Facing ApplicationThe campaign exploited the externally exposed Oracle PeopleSoft Environment Management Hub vulnerability for remote code execution.T1219 · Remote Access ToolsThe attackers deployed customized MeshCentral agents for remote management and command execution on compromised endpoints.T1560.001 · Archive via UtilityThe attackers compressed directories containing stolen data into archives using zstd.
CVE
People
Threat Actors
ShinyHuntersThe article identifies ShinyHunters parenthetically with UNC6240; the campaign involved extortion and data publication on its Data Leak Site.UNC6240Mandiant and GTIG attributed the compromise and extortion campaign to UNC6240; the article identifies ShinyHunters parenthetically with this name.
Vendors
Products
Oracle PeopleSoftMandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure.WebLogicCheck the PIA WebLogic access log for POST /PSEMHUB/hub and POST /PSIGW/HttpListeningConnector originating from external source IPs.
Tools
MeshCentralThe attacker staging environments hosted customized MeshCentral agents masquerading as legitimate cloud endpoints, which they used to run administrative command queries and deploy a custom lateral movement andmeshctrl.jsThe attackers interacted with compromised systems using the MeshCentral command-line interface utility meshctrl.js.sshpasssshpass -p "$p" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=6 -o BatchMode=no $u@$h "hostname" >/dev/null 2>&1 && {zstdCompressed exfiltrated directories containing stolen data using zstd: