Threat actor
UNC6240
Tracked by CyberSIXT since 13 Sep 2025 · last activity 13 Jun
- articles · all time
- 4+0 this week
- outlets
- 4
- week of 8 Jun · busiest week
- 4
- CVEs exploited · attributed
- 1
4 articles from 4 outlets since 11 Jun; the latest 135 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Sat 13 Jun · 09:51 UTC | Security Affairs | CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273 |
| Fri 12 Jun · 16:31 UTC | DataBreaches | ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data Worldwide |
| Thu 11 Jun · 21:20 UTC | The Hacker News | ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities |
| Thu 11 Jun · 20:47 UTC | Google Cloud | ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flaw |
Who reported 4 outlets, last 12 months
- Google Cloud1
- The Hacker News1
- DataBreaches1
- Security Affairs1
CVEs exploited
1 CVE an article attributes to UNC6240CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability · attributed by Google's Mandiant, Mandiant and Google Threat Intelligence Group (GTIG), 13 JunCVSS9.8CriticalExploited97%EPSS28articles
- CISA warns of Oracle PeopleSoft zero day exploit CVE-2026-35273Security Affairs
- ShinyHunters Exploits Oracle PeopleSoft Flaw Leaks Data WorldwideDataBreaches
- ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach UniversitiesThe Hacker News
- ShinyHunters hits Oracle PeopleSoft via CVE-2026-35273 flawGoogle Cloud · first in our coverage