[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDVFUtJ8gSm2TvD5CaNenoEe76FUVe3wFXiwFuWQnjVA":3},{"article":4,"iocs":58,"watch_terms":76,"solutions":77,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"56f5dca8-b026-48f1-8fbf-9dc09bac7d30","Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign","google-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign-3ba40d","The extortion group has modified its exploit in new attacks targeting the PeopleSoft vulnerability CVE-2026-35273. The post Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign appeared first on SecurityWeek.","Mandiant and Google Threat Intelligence Group warned that ShinyHunters (tracked as UNC6240) has launched a fresh campaign exploiting Oracle PeopleSoft vulnerability CVE-2026-35273 to target over 100 organizations across multiple sectors. The group modified its exploit to bypass web application firewall rules by using URL encoding ('%50' for 'P') to reach the vulnerable Environment Management Hub endpoint. After compromising systems, attackers deploy web shells, the SideEye backdoor, Neo-reGeorg tunneling toolkit, and MeshCentral for persistence, data theft, and lateral movement.","ShinyHunters launches mass-exploitation campaign targeting Oracle PeopleSoft CVE-2026-35273 with modified WAF-bypass","https:\u002F\u002Fwww.securityweek.com\u002Fgoogle-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FOracle-PeopleSoft.jpeg","2026-09-28T10:56:46+00:00","2026-09-28T18:00:13.619777+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"UNC6240",{"name":23,"type":24},"Oracle","vendor",{"name":26,"type":27},"Oracle PeopleSoft","product",{"name":29,"type":24},"Google",{"name":31,"type":24},"Mandiant","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":32,"icon":34,"name":35,"slug":36},null,"Zero-day","zero-day",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[59,63,66,69,72],{"type":60,"value":61,"context":62},"cve","CVE-2026-35273","Oracle PeopleSoft zero-day vulnerability in Environment Management Hub (PSEMHUB) allowing remote code execution without authentication",{"type":52,"value":64,"context":65},"SideEye","Backdoor deployed on Windows servers to steal credentials from browsers and applications, manage files and processes, and establish reverse shells",{"type":52,"value":67,"context":68},"Neo-reGeorg","Open source tunneling toolkit abused for internal discovery and lateral movement",{"type":52,"value":70,"context":71},"MeshCentral","Open source remote management platform deployed for command execution and control",{"type":73,"value":74,"context":75},"mitre_attack","T1505.004","Web shell deployment for persistence and command execution",[23,29,31],{"controls":78,"vendors":166},[79,108,137],{"slug":80,"name":81,"problem":82,"products":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":138,"name":139,"problem":140,"products":141},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[142,150,158],{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":162,"product_name":163,"url":164,"description":165},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",[167,172],{"slug":168,"name":29,"logo_path":169,"roles":170},"google","\u002Fvendor-logos\u002Fgoogle.png",[171],"reported_by",{"slug":173,"name":23,"logo_path":174,"roles":175},"oracle","\u002Fvendor-logos\u002Foracle.png",[176],"affected",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":194},"shinyhunters-exploits-unpatched-oracle-peoplesoft-to-breach-100-organizations","ShinyHunters Exploits Unpatched Oracle PeopleSoft to Breach 100+ Organizations","The ShinyHunters group (UNC6240) successfully exploited CVE-2026-35273 in Oracle PeopleSoft by using URL encoding to bypass web application firewall rules, demonstrating that WAFs alone are not a reliable substitute for timely patching. Once inside, attackers established deep persistence through web shells, custom backdoors, and tunneling tools, making remediation significantly more complex and costly. This campaign highlights the critical danger of leaving internet-facing enterprise applications unpatched, particularly when threat actors are actively researching WAF bypass techniques to circumvent compensating controls. Over 100 organizations across multiple sectors were affected, underscoring that widely deployed enterprise software like PeopleSoft represents a high-value, high-impact target for financially motivated threat groups.",[182,183,184,185,186,187,188,189,190,191,192,193],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1505.003: Web Shell","MITRE ATT&CK T1572: Protocol Tunneling","OWASP Top 10 A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (for EU-based affected organizations)",{}]