Mandiant (Google)Published
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
By Mandiant
Excerpt
Introduction
Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273, a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component. The exploitation of this vulnerability directly aligns with the observed targeting of Environment Ma…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Mandiant (Google) on cloud.google.com.
Mentioned in the excerpt
More from Mandiant (Google)32
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
- ARMORY CASTLE Exploits BeyondTrustMandiant (Google) · Published 15 Oct
- Mandiant Cybersecurity ConsultingMandiant (Google) · Added 18 Oct
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and NotorietyMandiant (Google) · Published 14 Sep 2023
On the same topics
- Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeGroup-IB · Published 21 Oct
- Resources - SecurityScorecardSecurityScorecard · Added 25 Oct
- skanthak.homepage.t-online.de/sentinel.htmlskanthak.homepage.t-online.de · Added 18 Oct
- rapid7.com/db/modules/exploit/linux/local/service_persistenceRapid7 · Added 18 Oct
