Shiny Hunters Renewed Mass Exploitation Campaign Targeting Oracle People Soft
Introduction As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit , Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. In June, the threat actor exploited this vulnerability as a zero-day predominantly against academic institutions. This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub
Read the original at Google Threat Intelligence ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-35273
- Related
- CVE-2026-35273: Oracle People Soft Enterprise People Tools Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Jun 12, 2026University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026