{"id":10039,"date":"2026-10-19T07:59:22","date_gmt":"2026-10-19T07:59:22","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10039"},"modified":"2026-10-19T07:59:22","modified_gmt":"2026-10-19T07:59:22","slug":"shinyhunters-exploits-oracle-peoplesoft-to-steal-sensitive-data","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10039","title":{"rendered":"ShinyHunters Exploits Oracle PeopleSoft to Steal Sensitive Data"},"content":{"rendered":"
\n
\n
\n
\n
\n

Imagine finding out that someone has been accessing your organization\u2019s systems, stealing data, and moving between servers without anyone noticing. That\u2019s the kind of situation organizations faced when ShinyHunters exploited a critical vulnerability in Oracle PeopleSoft.<\/p>\n

The attacks took place from May 27 to June 9, 2026, before Oracle issued its security alert. Universities were among the hardest hit, with some organizations suffering data breaches.<\/p>\n

How did the attackers get in, what should Oracle PeopleSoft users check, and what are the signs of compromise to look for?<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n <\/div>\n<\/div>\n
\n
\n

Who Are ShinyHunters?<\/h2>\n<\/div>\n
\n

ShinyHunters is a cybercrime group that steals sensitive data and threatens to leak it unless victims pay. Instead of locking files with ransomware, it uses stolen data to pressure victims.<\/p>\n

ShinyHunters exploited a flaw to access PeopleSoft systems without logging in.<\/p>\n

Google Threat Intelligence Group (GTIG) and Mandiant linked the activity to UNC6240[1]<\/a>, which they track as ShinyHunters. According to Mandiant, the attacks began in late May 2026 and continued into June.<\/p>\n

The timing matters here. Oracle published its security alert on June 10[2]<\/a>, after the reported exploitation period. That means organizations could have been exposed before they had an official alert to act on.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n

How Did the Attack on Oracle PeopleSoft Happen?<\/h2>\n<\/div>\n<\/div>\n
\n
\n

CVE-2026-35273<\/a> affects Oracle PeopleTools 8.61 and 8.62 and has a critical CVSS score of 9.8.<\/p>\n

The problem lies in the Updates Environment Management component, which is associated with the Environment Management Hub and the PSEMHUB application.<\/p>\n

To put it simply, the vulnerable component fails to appropriately verify that an individual is authorized to access it. Without logging in, an attacker may be able to execute commands on the compromised system if they can connect to the endpoint via HTTP.<\/p>\n

Attackers can exploit the exposed endpoint remotely without stolen passwords or user interaction.<\/p>\n

On June 10, 2026, Oracle issued an alert, and on June 12, CISA added the vulnerability to its KEV Catalog[3]<\/a>.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Getting In Was Only the Beginning<\/h2>\n<\/div>\n<\/div>\n
\n
\n

What happened after the initial access is just as important as the vulnerability itself.<\/p>\n

Mandiant\u2019s investigation uncovered tools and scripts that showed how the attackers tried to maintain access, reach other systems, and steal information.<\/p>\n

Here\u2019s what they found.<\/p>\n<\/div>\n<\/div>\n

\n
\n

1. Remote access tools disguised as legitimate software<\/h3>\n<\/div>\n<\/div>\n
\n
\n

The attackers deployed customized MeshCentral agents disguised as Microsoft Azure-related software. This gave them a way to access compromised systems remotely without relying on the original vulnerability every time.<\/p>\n<\/div>\n<\/div>\n

\n
\n

2. Attempts to move across internal systems<\/h3>\n<\/div>\n<\/div>\n
\n
\n

Investigators found a script designed to connect to other hosts over SSH using a hardcoded list of usernames and passwords. This is called lateral movement. Once attackers get into one system, they look for ways to reach other systems connected to it.<\/p>\n<\/div>\n<\/div>\n

\n
\n

3. Data collection and theft<\/h3>\n<\/div>\n<\/div>\n
\n
\n

Attackers sent stolen data to servers connected to ShinyHunters after compressing it.<\/p>\n<\/div>\n<\/div>\n

\n
\n

4. Extortion using stolen information<\/h3>\n<\/div>\n<\/div>\n
\n
\n

Data associated with the campaign later appeared on the group\u2019s leak site. For affected organizations, that meant the incident wasn\u2019t just about fixing a vulnerable server. Their sensitive information could also be exposed.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Universities were hit particularly hard. Mandiant reported[4]<\/a> notifying more than 100 organizations whose IP addresses matched potentially vulnerable endpoints. Around 68% were in higher education, most of them in the United States. Some organizations blocked the activity, while others were compromised.<\/p>\n

The University of Nottingham confirmed a cyberattack[5]<\/a>. The exposed data could affect current and former students, with consequences beyond the university\u2019s IT systems.<\/p>\n<\/div>\n<\/div>\n

\n
\n

How Can You Tell If ShinyHunters Have Been in Your Environment?<\/h2>\n<\/div>\n<\/div>\n
\n
\n

Patching the vulnerability is important, but there\u2019s another thing organizations need to check: did attackers get in before the fix was applied?<\/strong><\/em><\/p>\n

That\u2019s why security teams should look for signs of compromise rather than assuming the problem is solved once the vulnerable component is secured.<\/p>\n

Here are some things worth investigating:<\/p>\n<\/div>\n<\/div>\n

\n
\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tSuspicious requests:
Check PeopleSoft and WebLogic logs for unexpected POST requests to \/PSEMHUB\/hub and \/PSIGW\/HttpListeningConnector.<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tUnfamiliar JSP files:
Look for unexpected files such as x.jsp, u.jsp, tunnel.jsp, and tunnel.jspx in the PSEMHUB.war directory.<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tUnknown remote access tools:
Investigate unfamiliar MeshCentral agents and executables disguised as legitimate software.<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tUnusual SSH activity:
Check for unexpected connections from PeopleSoft servers to other internal systems.<\/span><\/p>\n

\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>
\n\t\t\t\t\t\t\t\t\t\tSuspicious outbound traffic:
Look for unusual data transfers and connections that could indicate data staging or exfiltration<\/a>.<\/span><\/p><\/div>\n<\/div>\n

\n
\n

There\u2019s another detail to keep in mind. Attackers may use different URLs to bypass security tools.<\/p>\n

In September 2026, attackers used encoded paths like \/%50SEMHUB\/hub to bypass some WAF rules and reach the vulnerable endpoint.<\/p>\n

So, blocking the standard URL alone may not be enough. Security teams should also review how their WAF rules handle encoded paths.<\/p>\n<\/div>\n<\/div>\n

\n
\n

What Should You Do If You Use Oracle PeopleSoft?<\/h2>\n<\/div>\n<\/div>\n
\n
\n

If you use PeopleSoft, check your PeopleTools version and whether the Environment Management Hub is exposed.<\/p>\n

Oracle recommends applying the appropriate security fixes. Its guidance also includes disabling the Environment Management Hub in multi-server configurations or removing the PSEMHUB application in single-server configurations, as applicable.<\/p>\n

If you can\u2019t disable or remove the component immediately, restrict external access to \/PSEMHUB\/* and \/PSIGW\/HttpListeningConnector.<\/p>\n<\/div>\n<\/div>\n

\n
\n

\t\t\t\t\t\t\t\t\t\tYou can find the official instructions in Oracle’s security alert for CVE-2026-35273<\/a>.<\/span><\/p><\/div>\n<\/div>\n

\n
\n

And don\u2019t forget to check for signs of an earlier compromise. Check logs, suspicious files, and unusual connections. If you find anything, investigate whether attackers accessed other systems or stole data.<\/p>\n

The important thing is to address both problems:<\/strong> the vulnerability itself and any attacker who may already have used it.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Why Visibility Matters After an Attack<\/h2>\n<\/div>\n<\/div>\n
\n
\n

The ShinyHunters attack shows how attackers can gain access, spread to other systems, and steal data.<\/p>\n

That\u2019s why security teams need to see more than the initial alert. They need to connect activity across networks, endpoints, and cloud environments to understand what happened and where an attacker may have gone next.<\/p>\n

Fidelis Elevate<\/a>\u00ae helps security teams correlate suspicious activity and investigate potential post-breach attacks. It brings together network security, deception, and Active Directory protection to support proactive cyber defense.<\/p>\n

Download the Fidelis Elevate\u00ae data sheet<\/a> to learn more about its threat detection and investigation capabilities.<\/p>\n<\/div>\n<\/div>\n

\n
\n

Final Thoughts<\/h2>\n<\/div>\n<\/div>\n
\n
\n

One exposed vulnerability can result in a much larger incident, as seen in the ShinyHunters attack on Oracle PeopleSoft. The reported activity included lateral movement<\/a>, data theft, and remote access tools after the group took advantage of a vulnerability that permitted remote access without authentication.<\/p>\n

Apply Oracle\u2019s suggested fixes and look for indications of compromise if you are using an impacted version of PeopleSoft.<\/p>\n

Because getting the vulnerability fixed is important. But making sure nobody is still inside your systems is just as important.<\/p>\n<\/div>\n<\/div>\n

\n
\n
\n

Our customers detect<\/span> post-breach attacks over<\/span> 9x Faster<\/span> <\/p>\n

Detect Advanced Threats Before Damage Escalates TrustedCybersecurity Leader for 20+ YearsSee why security teams choose us over other solutionsSee Fidelis Elevate in Action<\/a>\t<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n

Citations:<\/p>\n<\/div>\n<\/div>\n

\n
\n\t\t\t\t\t\t\t\t\t^<\/a>UNC6240<\/a>^<\/a>https:\/\/www.oracle.com\/security-alerts\/alert-cve-2026-35273.html<\/a>^<\/a>https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/06\/12\/cisa-adds-one-known-exploited-vulnerability-catalog<\/a>^<\/a>https:\/\/www.nottingham.ac.uk\/currentstudents\/news\/student-and-alumni-data-has-been-compromised-in-a-data-security-incident<\/a>\t\t\t\t\t\t\t\t<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

The post ShinyHunters Exploits Oracle PeopleSoft to Steal Sensitive Data<\/a> appeared first on Fidelis Security<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Imagine finding out that someone has been accessing your organization\u2019s systems, stealing data, and moving between servers without anyone noticing. That\u2019s the kind of situation organizations faced when ShinyHunters exploited a critical vulnerability in Oracle PeopleSoft. The attacks took place from May 27 to June 9, 2026, before Oracle issued its security alert. Universities were […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-10039","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10039"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10039"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10039\/revisions"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}