{"type":"bundle","id":"bundle--6af5c04b-e085-5594-9b2e-914c8e5fbb3d","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--74593694-b609-5b1a-bf64-aa732f06d50c","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","name":"CVE-2026-35273","description":"Unauthenticated remote code execution vulnerability in Oracle PeopleSoft EMHub service.","external_references":[{"source_name":"cve","external_id":"CVE-2026-35273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35273"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","name":"Exploit Public-Facing Application","external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190/"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ddb7d121-af38-53f6-9898-5b26520f37b4","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","name":"SSH","external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004/"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","name":"Data Encrypted for Impact","external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--116ef19d-504f-556e-8ad4-dfd3ef4e9fc3","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","name":"IPV4: 142.11.200.186","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.11.200.186']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-09-11T22:24:36.857829Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--59a63817-05af-5171-b340-84d314751ee1","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","name":"DOMAIN: azurenetfiles.net","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'azurenetfiles.net']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-09-11T22:24:36.857829Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--6e967197-7342-51ab-8837-89830caac29c","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","name":"SHA256: 68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-09-11T22:24:36.857829Z","confidence":95},{"type":"relationship","spec_version":"2.1","id":"relationship--0476eed9-17bc-573d-a7e7-333e7133372d","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--116ef19d-504f-556e-8ad4-dfd3ef4e9fc3","target_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09"},{"type":"relationship","spec_version":"2.1","id":"relationship--e3add8ae-c51a-5911-9239-163f4ce113c2","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--116ef19d-504f-556e-8ad4-dfd3ef4e9fc3","target_ref":"attack-pattern--ddb7d121-af38-53f6-9898-5b26520f37b4"},{"type":"relationship","spec_version":"2.1","id":"relationship--2835a145-8b6e-57d0-a5d9-73e74bc964fb","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--116ef19d-504f-556e-8ad4-dfd3ef4e9fc3","target_ref":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e"},{"type":"relationship","spec_version":"2.1","id":"relationship--2b831685-e6fd-5140-92f2-3723fed88593","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--59a63817-05af-5171-b340-84d314751ee1","target_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09"},{"type":"relationship","spec_version":"2.1","id":"relationship--f8139435-b4ac-511d-9f99-30e2fbd4ce23","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--59a63817-05af-5171-b340-84d314751ee1","target_ref":"attack-pattern--ddb7d121-af38-53f6-9898-5b26520f37b4"},{"type":"relationship","spec_version":"2.1","id":"relationship--780ef024-dbb4-53da-987c-452efe286252","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--59a63817-05af-5171-b340-84d314751ee1","target_ref":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e"},{"type":"relationship","spec_version":"2.1","id":"relationship--f5e91ffa-eb4e-5ec9-9801-4755887be298","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--6e967197-7342-51ab-8837-89830caac29c","target_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09"},{"type":"relationship","spec_version":"2.1","id":"relationship--06a1f590-a88d-5fbf-bad6-939cb4cbe484","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--6e967197-7342-51ab-8837-89830caac29c","target_ref":"attack-pattern--ddb7d121-af38-53f6-9898-5b26520f37b4"},{"type":"relationship","spec_version":"2.1","id":"relationship--bf39a4cb-6c31-5a39-a68c-f66160c0bb2f","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"indicates","source_ref":"indicator--6e967197-7342-51ab-8837-89830caac29c","target_ref":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e"},{"type":"relationship","spec_version":"2.1","id":"relationship--9a3c6fb9-0404-5322-aee1-1b9bcf5f360c","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"targets","source_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","target_ref":"vulnerability--74593694-b609-5b1a-bf64-aa732f06d50c"},{"type":"relationship","spec_version":"2.1","id":"relationship--792b7829-ebda-5194-bfd6-c0a559a32fd7","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"targets","source_ref":"attack-pattern--ddb7d121-af38-53f6-9898-5b26520f37b4","target_ref":"vulnerability--74593694-b609-5b1a-bf64-aa732f06d50c"},{"type":"relationship","spec_version":"2.1","id":"relationship--aaae3712-bb95-5ccd-85fc-bd65512c1675","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-09-11T22:24:36.857829Z","relationship_type":"targets","source_ref":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e","target_ref":"vulnerability--74593694-b609-5b1a-bf64-aa732f06d50c"},{"type":"report","spec_version":"2.1","id":"report--eeb63a3b-fac1-5f6f-9353-5188407b468d","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:36.857829Z","modified":"2026-10-30T14:11:53.015490Z","name":"ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit","description":"Mandiant and Google Threat Intelligence Group (GTIG) identified an active compromise and extortion campaign attributed to threat cluster UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure in the education sector. The actors exploited CVE-2026-35273 in the Environment Management Hub (EMHub) service to execute unauthenticated remote code, deployed MeshCentral remote access agents, automated SSH lateral movement, and exfiltrated sensitive archives to public leak infrastructure.","published":"2026-09-11T22:24:36.857829Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","vulnerability--74593694-b609-5b1a-bf64-aa732f06d50c","attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","attack-pattern--ddb7d121-af38-53f6-9898-5b26520f37b4","attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e","indicator--116ef19d-504f-556e-8ad4-dfd3ef4e9fc3","indicator--59a63817-05af-5171-b340-84d314751ee1","indicator--6e967197-7342-51ab-8837-89830caac29c","relationship--0476eed9-17bc-573d-a7e7-333e7133372d","relationship--e3add8ae-c51a-5911-9239-163f4ce113c2","relationship--2835a145-8b6e-57d0-a5d9-73e74bc964fb","relationship--2b831685-e6fd-5140-92f2-3723fed88593","relationship--f8139435-b4ac-511d-9f99-30e2fbd4ce23","relationship--780ef024-dbb4-53da-987c-452efe286252","relationship--f5e91ffa-eb4e-5ec9-9801-4755887be298","relationship--06a1f590-a88d-5fbf-bad6-939cb4cbe484","relationship--bf39a4cb-6c31-5a39-a68c-f66160c0bb2f","relationship--9a3c6fb9-0404-5322-aee1-1b9bcf5f360c","relationship--792b7829-ebda-5194-bfd6-c0a559a32fd7","relationship--aaae3712-bb95-5ccd-85fc-bd65512c1675"],"confidence":95}]}