ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Executive summary
Mandiant and Google Threat Intelligence Group (GTIG) identified an active compromise and extortion campaign attributed to threat cluster UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure in the education sector. The actors exploited CVE-2026-35273 in the Environment Management Hub (EMHub) service to execute unauthenticated remote code, deployed MeshCentral remote access agents, automated SSH lateral movement, and exfiltrated sensitive archives to public leak infrastructure.
Technical analysis
The intrusion lifecycle begins with unauthenticated HTTP POST requests directed at /PSEMHUB/hub or /PSIGW/HttpListeningConnector on public-facing Oracle PeopleSoft web tiers. Exploitation of CVE-2026-35273 allows arbitrary code execution within the WebLogic server process context. Post-exploitation staging involved writing compiled MeshCentral agents (meshagent, meshagent64-azure-ops.exe) into temporary directories and using the node meshctrl.js utility for remote management. The threat actors then deployed automated bash scripts utilizing sshpass to execute credential spraying against internal hosts identified from /etc/hosts. Data exfiltration was conducted using zstd compression before concluding with outbound connections to ShinyHunters leak site mirror 176.120.22.24.
IOCs
CVEs and affected products
Unauthenticated remote code execution vulnerability in Oracle PeopleSoft EMHub service.
ATT&CK mapping
Exploit Public-Facing Application
Tactic: Initial Access
SSH
Tactic: Lateral Movement
Data Encrypted for Impact
Tactic: Impact
Detection content
Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.
Threat hunting
Hypothesis-driven hunt procedures and telemetry checklist.
Remediation
Containment actions, patching notes, and credential steps.
Historical relationships
No published historical relationship is available.
Timeline and change history
Confidence and caveats
0.95
⚠️ This report is synthesized from public threat intelligence and vendor advisories.
⚠️ No internal systems or private subscriber environments are assessed.
📄
Intelligence Sources & Advisory Feeds
DFIR investigations, vendor research, advisory feeds & verified claims
3 references
▼
Evidence is sourced from original threat research published by Mandiant and Google Threat Intelligence Group, incorporating confirmed forensic artifacts, .bash_history logs, propagation scripts, and external network telemetry.
Mandiant and Google Threat Intelligence Group reported that ShinyHunters targets education sector organizations through an Oracle PeopleSoft exploit compromising application infrastructure.
The campaign exploits CVE-2026-35273 in the Oracle PeopleSoft EMHub service, deploying MeshCentral agent binaries meshagent64-azure-ops.exe and propagation scripts to lateral spray credentials.
Public staging and command-and-control network infrastructure identified includes 142.11.200.186, azurenetfiles.net, and extortion defacement marker README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.