root@markcardiff:~/reports$ ./render threat-intel shinyhunters --public-safe

ShinyHunters Oracle PeopleSoft Campaign

Public threat intelligence report on ShinyHunters / UNC6240 activity exploiting Oracle PeopleSoft PeopleTools CVE-2026-35273, with public IOCs, TTPs, and SOC detection ideas for Microsoft Sentinel and QRadar.

Published 2026-06-14 14:40 UTC

Focus threat intelligence

Actor ShinyHunters / UNC6240

Primary Sector higher education

9.8CVSS critical RCE

100+orgs notified

68%higher education

27 Mayobserved start

Executive summary

ShinyHunters, tracked in this campaign as UNC6240, has been linked by Google/Mandiant to exploitation of CVE-2026-35273, a critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools Environment Management / EMHub.

The campaign was observed between 27 May and 9 June 2026 and disproportionately affected higher education. ShinyHunters claimed compromise of more than 300 PeopleSoft instances across more than 100 organizations; victim counts remain actor-claimed unless independently confirmed.

The practical defender message is direct: exposed /PSEMHUB/* and /PSIGW/HttpListeningConnector paths should be treated as high-risk internet-facing ERP attack surface, and hits against those paths from untrusted sources deserve urgent review.

Conceptual intrusion chain based on public Google/Mandiant reporting. It is intentionally defensive and does not include exploit instructions.

Timeline TTPs IOCs Detection ideas Defensive actions Sources

Campaign details

Actor: ShinyHunters / UNC6240.
Vulnerability: CVE-2026-35273.
Product: Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62.
Component: Environment Management / EMHub / PSEMHUB.
Impact: unauthenticated remote code execution, data theft, extortion.
Targeting: broad exposure-based targeting, with heavy higher education concentration.

Publicly reported victim-notification demographics; not a verified final victim count.

Timeline

2026-05-27: Observed exploitation/staging begins. MeshCentral v1.1.59 and certificate automation for azurenetfiles.net are installed on attacker infrastructure.

2026-05-29: Attackers check for Authenticode-related npm tooling, suggesting interest in signing or inspecting Windows binaries.

2026-05-27 to 2026-06-09: Exploitation and post-exploitation activity observed against PeopleSoft environments.

2026-06-09: Public reports identify exposed attacker directories; stolen data appears on the ShinyHunters data leak site.

2026-06-10: Oracle publishes the CVE-2026-35273 security alert.

2026-06-11 onward: Google/Mandiant and public reporting confirm ShinyHunters / UNC6240 exploitation activity.

Observed and linked TTPs

Phase	Observed behavior	ATT&CK mapping	Defensive watchpoint
Initial access	Exploit internet-facing PeopleSoft EMHub/PSEMHUB component via CVE-2026-35273.	T1190 Exploit Public-Facing Application	External POSTs to `/PSEMHUB/hub` or `/PSIGW/HttpListeningConnector`.
Remote access	Deploy MeshCentral/MeshAgent binaries masquerading as Azure services.	T1219 Remote Access Software; T1036 Masquerading	MeshAgent binaries, `agent.ashx`, `azurenetfiles.net`.
Discovery	Inspect PeopleSoft, WebLogic, NFS, hosts, and process scheduler configuration.	T1082 System Information Discovery; T1083 File and Directory Discovery	Reads of `psappsrv.cfg`, `config.xml`, and PeopleSoft paths from unusual processes.
Lateral movement	SSH fan-out using hardcoded account/password combinations and `sshpass`.	T1021.004 Remote Services: SSH; T1110.003 Password Spraying	`sshpass`, repeated SSH attempts, `StrictHostKeyChecking=no`.
Credential exposure	Outbound SMB/TCP 445 coercion may capture NetNTLM material.	T1187 Forced Authentication	Any outbound SMB from PeopleSoft servers to internet destinations.
Collection / staging	Compress stolen data with `zstd`; create extortion marker files.	T1560 Archive Collected Data; T1491 Defacement	`zstd`, `exfil.tar.zst`, marker file creation.

Public IOCs

Network

Indicator	Type	Context
142.11.200.186 142.11.200.187 142.11.200.188 142.11.200.189 142.11.200.190	IPv4	Sequential staging hosts reported by Google/Mandiant; Python SimpleHTTP on TCP/8888 exposed materials.
108.174.202.99 176.120.22.24	IPv4	Additional public reporting; 176.120.22.24 reported as hosting a clearnet mirror of the ShinyHunters DLS.
azurenetfiles.net	Domain	MeshCentral C2 domain masquerading as Microsoft Azure NetApp Files.
wss://azurenetfiles.net:443/agent.ashx	URI	Hardcoded MeshAgent C2 endpoint.

Files and hashes

File	SHA-256 / value	Context
.bash_history	2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35	Attacker command history.
meshagent64-azure-ops.exe	f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc	Preconfigured Windows MeshCentral agent.
meshagent64-v2.exe	d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f	Preconfigured Windows MeshCentral agent.
meshagent32-azure-ops.exe	c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f	Preconfigured Windows MeshCentral agent.
meshagent	68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309	Unconfigured Linux MeshCentral agent.
README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT	N/A	Defacement / extortion marker filename.
*_fanout.sh	N/A	Victim-specific propagation script naming pattern.

Sentinel detection ideas

Alert on traffic to or from campaign IPs and azurenetfiles.net, especially from PeopleSoft servers.
Hunt web/WAF logs for POST /PSEMHUB/hub and POST /PSIGW/HttpListeningConnector from untrusted sources.
Alert on outbound SMB/TCP 445 from PeopleSoft servers to public IP addresses.
Use Defender tables for MeshAgent hashes, Azure-masquerading filenames, meshctrl.js, and agent.ashx.
Hunt Linux syslog/audit for sshpass, StrictHostKeyChecking=no, zstd, exfil.tar.zst, and the extortion marker filename.
File integrity watch: unexpected .jsp files under PSEMHUB.war and modified XML under envmetadata/data/environment.

QRadar detection ideas

Create reference sets for campaign IPs, domains, PeopleSoft assets, and approved PeopleSoft admin sources.
Build an offense rule for external /PSEMHUB/* or /PSIGW/HttpListeningConnector access against PeopleSoft assets.
Correlate PeopleSoft web exploitation with endpoint events: MeshAgent creation, suspicious JSP write, or outbound C2.
High severity: PeopleSoft server outbound SMB to internet or connection to azurenetfiles.net.
High severity: EDR/syslog payloads containing sshpass, *_fanout.sh, README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT, or exfil.tar.zst.
Tune only after validating legitimate EMHub/PSIGW integrations and admin ranges.

Defensive actions

Identify all PeopleSoft PeopleTools 8.61/8.62 deployments and confirm patch/mitigation status for CVE-2026-35273.
Disable EMHub where possible. If not possible, restrict /PSEMHUB/* and /PSIGW/HttpListeningConnector to trusted administrative networks only.
Block outbound SMB/TCP 445 from PeopleSoft servers to internet destinations.
Review WebLogic access logs from at least 27 May 2026 onward.
Audit PeopleSoft web-tier filesystems for unexpected JSPs, staging folders, new XML files, MeshAgent binaries, and extortion marker files.
Rotate PeopleSoft/WebLogic/application credentials if compromise indicators are present; preserve logs and forensic evidence before rebuild/remediation.

Source base and limitations

This report is a public-source synthesis. It intentionally avoids exploit procedure and customer-specific detail. Victim counts and scale claims should be treated cautiously where sourced from threat actor statements rather than independent confirmation.