[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3DQSMgqD24qN3ZTmmvFqLREZQ8_ljIPravWykiKA7fY":3,"$fFn9cVA2JFeQxDN-gmgeelG7bECGYViW4VQ248Ge6zeM":44},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":41,"created_at":42,"updated_at":43,"published_at":33},"shinyhunters-exploits-oracle-peoplesoft-zero-day-to-breach-university-of-notting","ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach University of Nottingham and Disrupt Mackay Sugar","The critical unauthenticated RCE flaw, CVE-2026-35273, was actively exploited in the wild before patches were released.","Threat actor ShinyHunters leveraged a zero-day vulnerability in Oracle PeopleSoft to compromise high-profile targets including the University of Nottingham and Mackay Sugar, enabling data theft and operational disruption.",[10,11,12,13,14],"Oracle PeopleSoft","CVE-2026-35273","ShinyHunters","Zero-Day Exploitation","Education Sector","# ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach University of Nottingham and Disrupt Mackay Sugar\n\n*The critical unauthenticated RCE flaw, CVE-2026-35273, was actively exploited in the wild before patches were released.*\n\n**Tags:** `Oracle PeopleSoft` `CVE-2026-35273` `ShinyHunters` `Zero-Day Exploitation` `Education Sector`\n\n> Threat actor ShinyHunters leveraged a zero-day vulnerability in Oracle PeopleSoft to compromise high-profile targets including the University of Nottingham and Mackay Sugar, enabling data theft and operational disruption.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-35273 | 9.8 | 95.5% | ✅ listed | available | 89.59 (Critical) |\n\n## Zero-Day Exploited in Active Extortion Campaign\n\nShinyHunters, tracked as UNC6240, actively exploited CVE-2026-35273 in a zero-day campaign targeting Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. The critical flaw resides in the Updates Environment Management component, specifically within PSEMHUB, allowing unauthenticated attackers with network access via HTTP to execute arbitrary code on vulnerable servers. This vulnerability carries a CVSS score of 9.8 and an EPSS probability of 95.5%, reflecting its high exploitability and risk profile.\n\nThe attack activity was observed between May 27 and June 9, 2026, preceding Oracle’s release of the advisory and patches on June 10, 2026. Attackers leveraged the remote code execution capability to deploy disguised MeshCentral agents for persistent remote access and lateral movement. The campaign primarily targeted higher education institutions, with approximately 68% of identified victims belonging to that sector. Following initial compromise, threat actors conducted reconnaissance of enterprise infrastructure and stole data to facilitate extortion operations.\n\n## Victims: University of Nottingham and Mackay Sugar\n\nThe University of Nottingham was among the institutions breached by ShinyHunters during their exploitation of CVE-2026-35273. The group leveraged the critical flaw in Oracle PeopleSoft to gain unauthorized access, consistent with a broader pattern where approximately 68% of identified victims were drawn from the higher education sector.\n\nBeyond academic targets, the campaign extended into industrial operations, disrupting Mackay Sugar as part of the threat actors' extortion activities. Following initial compromise at these sites, attackers conducted reconnaissance and exfiltrated data to support their ransom demands.\n\n## How the Attackers Gained Access\n\nThe intrusion began with unauthenticated remote code execution against the PSEMHUB interface within Oracle PeopleSoft’s Updates Environment Management component. Because the vulnerability required no prior credentials, threat actors were able to breach internet-facing deployments directly over HTTP. Once initial footholds were secured on vulnerable servers running versions 8.61 or 8.62, the group moved quickly to entrench their presence.\n\nTo maintain persistent access and facilitate lateral movement, attackers deployed disguised MeshCentral agents alongside legitimate administration tools. These implants allowed them to operate within compromised networks without triggering standard security alerts. Following this initial compromise, the threat actors conducted extensive reconnaissance of enterprise infrastructure and configurations, mapping internal assets to identify high-value targets for data exfiltration and subsequent extortion.\n\n## Timeline and Detection Indicators\n\nActive exploitation of CVE-2026-35273 was documented between May 27 and June 9, 2026. This period predates Oracle’s public disclosure and patch release on June 10, confirming the vulnerability was exploited as a zero-day during this window. Security teams should prioritize reviewing network and system logs from these specific dates to identify indicators of compromise that may have been missed by automated defenses.\n\nHunting efforts must focus on detecting unauthorized remote management tools installed on PeopleSoft servers. Specifically, analysts should search for MeshCentral agents or similar administration utilities that were not part of the original deployment configuration. The presence of such tools on internet-facing systems running PeopleTools versions 8.61 or 8.62 is a strong indicator of persistent access established by threat actors.\n\n## Mitigation Steps for Exposed Systems\n\nOrganizations running Oracle PeopleSoft must immediately deploy the security patches released by Oracle to remediate CVE-2026-35273. Because the vulnerability permits unauthenticated remote code execution over HTTP, any internet-facing deployment of PeopleTools versions 8.61 or 8.62 should be treated as potentially compromised until a thorough review is completed. To reduce the attack surface while patching is underway, administrators should restrict external network access to the PeopleSoft Environment Management services, ensuring that only authorized internal traffic can reach these components.\n\n## Key points\n\n- CVE-2026-35273 is a critical remote code execution vulnerability in the PeopleSoft Enterprise PeopleTools Updates Environment Management component, affecting versions 8.61 and 8.62.\n- The flaw allows unauthenticated attackers with network access via HTTP to execute arbitrary code on vulnerable servers without prior credentials.\n- ShinyHunters (UNC6240) conducted an active compromise and extortion campaign from May 27 to June 9, 2026, primarily targeting higher education institutions.\n- Attackers deployed disguised MeshCentral agents for persistent remote access and lateral movement within compromised environments.\n- Oracle disclosed the vulnerability on June 10, 2026, after active exploitation had already occurred in the wild.\n\n## Further reading & sources\n\n- [Threat Signal Report | FortiGuard Labs](https:\u002F\u002Ffortiguard.fortinet.com\u002Fthreat-signal-report\u002F6468)\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-15-jun-2026-4f2342fc18bd)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-exploits-oracle-peoplesoft-zero-day-to-breach-university-of-notting.png?v=4f9613455f",{"cves":18,"actors":27,"malware":34,"technologies":37},[19],{"id":11,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},true,"\u002Fvulnerabilities\u002FCVE-2026-35273",9.8,0.9668,"Critical",89.71,"3.1",[28],{"url":29,"name":30,"slug":30,"type":31,"origin":32,"motivation":33},"\u002Fthreat-groups\u002Fshinyhunters","shinyhunters","ransomware","Russia",null,[35],{"name":36},"MeshCentral",[38],{"vendor":39,"product":40},"Oracle","PeopleSoft Environment Management","campaign","2026-08-25T17:23:03.808596+00:00","2026-10-16T12:29:22.391224+00:00",{"articles":45},[46,59,71,83],{"slug":47,"title":48,"summary":49,"tags":50,"hero_image_url":56,"story_type":57,"created_at":58},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","ShinyHunters Bypasses MFA With Salesforce OAuth Playbook","Cato Networks publishes a 2026 threat-actor profile for ShinyHunters, detailing its MFA-bypass playbook (help-desk vishing + malicious Salesforce connected app + OAuth token) and the UNC6040 campaign that targets Salesforce, Salesloft Drift, and Gainsight integrations.",[12,51,52,53,54,55],"Salesforce","MFA bypass","OAuth","Cato Networks","UNC6040","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee","threat_actor_activity","2026-09-05T07:16:15.004025+00:00",{"slug":60,"title":61,"summary":62,"tags":63,"hero_image_url":68,"story_type":69,"created_at":70},"trezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers","Trezor Confirms Data Breach at ShipMonk Affecting 14,000 Customers","Trezor has confirmed that its third-party shipping partner, ShipMonk, suffered a data breach impacting 14,000 customers after attackers leveraged a SQL injection flaw in the Metabase platform.",[64,12,65,66,67],"Data Breach","Trezor","ShipMonk","Metabase","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers.png?v=f8ae5b52ce","breach","2026-08-18T17:57:49.084977+00:00",{"slug":72,"title":73,"summary":74,"tags":75,"hero_image_url":81,"story_type":41,"created_at":82},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[76,77,78,79,80],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","2026-09-30T07:09:51.117027+00:00",{"slug":84,"title":85,"summary":86,"tags":87,"hero_image_url":94,"story_type":41,"created_at":95},"clearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum","ClearFake Drops Amatera Stealer via WordlistLoader and SynkLoader on Ethereum","ClearFake's new WordlistLoader and SynkLoader loaders deliver Amatera stealer to Windows targets through ClickFix-style social engineering, with C2 traffic routed through EtherHiding on Ethereum smart contracts.",[88,89,90,91,92,93],"ClearFake","WordlistLoader","SynkLoader","Amatera","EtherHiding","ClickFix","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fclearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum.png?v=9ddcd54bf4","2026-09-25T07:08:58.057093+00:00"]