Cyber — 2026-06-15

ShinyHunters Exploit Oracle PeopleSoft Zero-Day to Breach Over 100 Organizations Including Dozens of Universities

BLUFOracle's two-week advisory gap and ShinyHunters' automated exploitation pipeline make it likely the confirmed victim count exceeds 200 organizations by mid-September, with universities bearing the heaviest exposure.

Mandiant and Google's Threat Intelligence Group document a compromise and extortion campaign by UNC6240 (ShinyHunters) exploiting CVE-2026-35273, a CVSS 9.8 unauthenticated RCE flaw in Oracle PeopleSoft's Environment Management Hub, from May 27 through June 9; Oracle issued no advisory until June 10 12. Mandiant notified over 100 organizations with exposed endpoints, 68 percent of them universities and colleges primarily in the United States; ShinyHunters self-reported compromising approximately 300 PeopleSoft instances across those organizations 12. Attackers deployed MeshCentral agents connecting to C2 infrastructure at azurenetfiles.net, a domain crafted to impersonate Azure NetApp Files, propagated via a credential-spraying shell script across internal PeopleSoft nodes, and exfiltrated data to the ShinyHunters leak site, with victim posts appearing on June 9 12. Have I Been Pwned has indexed 454,600 email addresses from the University of Nottingham breach specifically, with records including passport numbers and disability data 2.

Analysis
The confirmed breach count will likely exceed 200 organizations by September 15, 2026, as ShinyHunters continues working through a target list compiled before Mandiant's notifications took effect. Moderate confidence rests on Mandiant's direct infrastructure access and 454,600 email addresses indexed from one breach, though victim count claims lack independent corroboration and the pace of further disclosures depends on patch uptake before June 9. Oracle's two-week advisory gap foreclosed patch-before-breach for every organization hit during that window, and institutions holding passport numbers and disability data face mandatory notification obligations regardless of remediation decisions. Rapid remediation enabled by the June 10 patch and Mandiant's active notification campaign may instead cap confirmed victims well below 200. Whether it does determines whether higher-education CISOs treat PeopleSoft exposure as an active ongoing threat requiring network isolation or maintain a patch-and-monitor posture.
4 sources
  1. ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit - Google Cloud (Mandiant)
  2. Oracle PeopleSoft RCE Flaw Used as Zero-Day in Ongoing ShinyHunters Campaign - Security Affairs
  3. ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day - The Register
  4. Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters - SecurityWeek

View in full brief →

UNCLASSIFIED // OPEN SOURCE