Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
ShinyHunters launches mass-exploitation campaign targeting Oracle PeopleSoft CVE-2026-35273 with modified WAF-bypass
Mandiant and Google Threat Intelligence Group warned that ShinyHunters (tracked as UNC6240) has launched a fresh campaign exploiting Oracle PeopleSoft vulnerability CVE-2026-35273 to target over 100 organizations across multiple sectors. The group modified its exploit to bypass web application firewall rules by using URL encoding ('%50' for 'P') to reach the vulnerable Environment Management Hub endpoint. After compromising systems, attackers deploy web shells, the SideEye backdoor, Neo-reGeorg tunneling toolkit, and MeshCentral for persistence, data theft, and lateral movement.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Oracle?
Get an email when a new story names Oracle, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ShinyHunters group (UNC6240) successfully exploited CVE-2026-35273 in Oracle PeopleSoft by using URL encoding to bypass web application firewall rules, demonstrating that WAFs alone are not a reliable substitute for timely patching. Once inside, attackers established deep persistence through web shells, custom backdoors, and tunneling tools, making remediation significantly more complex and costly. This campaign highlights the critical danger of leaving internet-facing enterprise applications unpatched, particularly when threat actors are actively researching WAF bypass techniques to circumvent compensating controls. Over 100 organizations across multiple sectors were affected, underscoring that widely deployed enterprise software like PeopleSoft represents a high-value, high-impact target for financially motivated threat groups.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-35273
- malware — SideEye
- malware — Neo-reGeorg
- malware — MeshCentral
- mitre_attack — T1505.004