Mandiant (Google)Published
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
By Mandiant
Excerpt
Introduction
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. In June, the threat actor exploited this vulnerability as a zero-day predominantly against academic institutions. This new wave of activity stems from UNC6240 modifying its exploit to bypas…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Mandiant (Google) on cloud.google.com.
Mentioned in the excerpt
More from Mandiant (Google)32
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
- ARMORY CASTLE Exploits BeyondTrustMandiant (Google) · Published 15 Oct
- Mandiant Cybersecurity ConsultingMandiant (Google) · Added 18 Oct
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and NotorietyMandiant (Google) · Published 14 Sep 2023
On the same topics
- TA488 Targets Zimbra Mailservers with Half-Click ExploitsProofpoint · Published 15 Jul
- Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukrainebluecyber.hashnode.dev · Published 22 Jul
- DragonBreath: Dragon in the Kernelransom-isac.com · Published 22 Apr
- Iranian APT group ‘MuddyWater’ Adds Exploits to Their ArsenalClearSky · Published 6 Jun 2019
