Actor Profile

ShinyHunters is a financially motivated cybercrime group (tracked by Mandiant as UNC6240) with an established pattern of data theft extortion. The group originated as GnosticPlayers before rebranding to ShinyHunters in 2020. They steal sensitive data and threaten public exposure via data leak sites unless victims pay ransoms. The actor demonstrates advanced technical capabilities including zero-day exploitation, WAF evasion, and multi-platform post-exploitation techniques. Recent activity includes breaching the FBI's FBIJobs.gov portal using a separate PeopleSoft zero-day, though they claim this action was not financially motivated but rather to contest FBI allegations.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages CVE-2026-35273, a critical Oracle PeopleSoft vulnerability (CVSS 9.8) enabling unauthenticated remote code execution via Java deserialization in the PSEMHUB servlet. Key TTPs include: WAF bypass through URL encoding (/%50SEMHUB/ instead of /PSEMHUB/), web shell deployment (x.jsp for command execution, u.jsp for file uploads), deployment of SIDEEYE C++ backdoor via trojanized signed installer (Ple64.exe), credential theft from browsers and applications, use of Neo-reGeorg tunneling toolkit for network pivoting, MeshAgent RMM tool for persistence on Linux, lateral movement over SSH using compromised credentials, privilege escalation to root/NT Authority\SYSTEM, and data exfiltration targeting HR, payroll, and student records. Post-exploitation commands executed under elevated privileges or service accounts.

Targets & Patterns

The campaign targets multiple sectors globally with concentration in the United States. Affected industries include higher education, technology, IT services, healthcare, agriculture, transportation, and government. Mandiant initially notified over 100 organizations with vulnerable endpoints. The targeting pattern suggests opportunistic exploitation of internet-facing PeopleSoft installations across diverse verticals rather than sector-specific focus. Academic institutions were among the first victims during zero-day exploitation phase. The broad targeting aligns with ShinyHunters' data theft extortion business model, seeking organizations with valuable sensitive data (HR records, payroll, student information) that can be leveraged for ransom demands or public exposure threats.

Historical Context

ShinyHunters evolved from the GnosticPlayers threat group, rebranding in 2020. CVE-2026-35273 was initially exploited as a zero-day against academic institutions before public disclosure. The current campaign represents a second wave of exploitation by UNC6240 (ShinyHunters), distinguished by the addition of WAF bypass techniques after organizations implemented string-based WAF rules blocking the /PSEMHUB/ endpoint. This demonstrates the group's ability to adapt their exploits in response to defensive measures. In May 2026, the FBI issued an alert regarding ShinyHunters. Subsequently, the group breached the FBI's FBIJobs.gov portal using a different PeopleSoft zero-day, claiming the action was to contest FBI allegations rather than for financial gain. This incident demonstrates the group's access to multiple PeopleSoft vulnerabilities and willingness to conduct high-profile attacks.

Defensive Recommendations

  • Apply Oracle patches for CVE-2026-35273 immediately; disable or remove the Environment Management Hub (PSEMHUB) service if not operationally required
  • Update WAF rules to detect percent-encoded variants of /PSEMHUB/ paths; ensure URL decoding occurs before pattern matching to prevent bypass via encoded characters
  • Search WebLogic access logs for POST requests to /PSEMHUB/ and encoded variants (e.g., /%50SEMHUB/); inspect PSEMHUB.war directory for JSP web shells (x.jsp, u.jsp) and malicious artifacts
  • Monitor for SIDEEYE backdoor indicators including trojanized signed executables (Ple64.exe), C2 communication to 162.219.30[.]165 over TCP, and Neo-reGeorg tunneling toolkit deployment
  • Rotate credentials accessible by PeopleSoft and WebLogic service accounts; review database audit logs for bulk queries against HR, payroll, and student records tables; monitor outbound traffic from PeopleSoft hosts for data exfiltration

---

# Geopolitical Context

Geopolitical Context

The renewed mass exploitation of CVE-2026-35273 by actors linked to ShinyHunters represents a significant escalation in cybercriminal targeting of enterprise infrastructure across critical sectors. The campaign's global reach—spanning higher education, healthcare, government, and technology sectors—demonstrates sophisticated technical capabilities including WAF bypass techniques and the deployment of custom backdoors like SIDEEYE. The group's concurrent breach of the FBI's FBIJobs.gov portal, which they claim involved a separate PeopleSoft zero-day, appears designed to challenge U.S. law enforcement narratives and assert operational legitimacy. This dual-track activity—combining financially motivated data theft extortion with what the group frames as reputational defense—blurs traditional distinctions between cybercrime and hacktivism. The targeting of over 100 organizations, predominantly in the United States, and the theft of 2-3 TB from a federal law enforcement portal, underscores both the group's technical proficiency and their willingness to directly confront state institutions.

State Actor Alignment

ShinyHunters operates as a financially motivated cybercriminal entity with no confirmed state sponsorship, though their operational security and technical sophistication warrant continued monitoring. The group's May 2026 inclusion in an FBI alert and their subsequent retaliatory breach of FBIJobs.gov indicates active U.S. law enforcement attention. Their stated motivation for the FBI breach—"to set the record straight and protect the image of our organisation" rather than financial gain—represents an unusual posture for a ransomware-adjacent group. The campaign's global targeting pattern does not appear to align with specific state interests, though the compromise of government sector entities and theft of HR, payroll, and student records could provide intelligence value to state actors if such data were to be acquired or shared. Organizations should anticipate that stolen data may be leveraged for extortion or publicly released on data leak sites consistent with the group's established operational pattern.

Business Impacty pro region

The campaign's primary impact appears concentrated in the United States, where Mandiant notified over 100 organizations with vulnerable PeopleSoft endpoints. However, the multi-sector targeting across higher education, healthcare, government, agriculture, transportation, and IT services suggests potential cascading effects across allied nations that rely on Oracle enterprise software. European institutions running PeopleSoft deployments face similar exposure, particularly in the education and healthcare sectors where budget constraints may delay patching cycles. The compromise of government sector entities raises concerns about potential exposure of citizen data and administrative systems. The FBI portal breach, while primarily a U.S. domestic incident, may complicate international law enforcement cooperation if sensitive personnel or applicant data involving foreign nationals was compromised. The group's demonstrated ability to identify and weaponize zero-day vulnerabilities in widely deployed enterprise software—claiming a second PeopleSoft zero-day beyond CVE-2026-35273—suggests that organizations globally should prioritize Oracle security updates and implement defense-in-depth measures including WAF rule updates that account for URL-encoding bypass techniques.

Forecast

If Oracle does not rapidly identify and patch the second alleged PeopleSoft zero-day referenced by ShinyHunters, additional high-profile breaches targeting government and enterprise systems are likely in the near term. Organizations that have applied patches for CVE-2026-35273 but have not disabled or removed the Environment Management Hub service may remain vulnerable to exploitation via encoded path variants that bypass legacy WAF rules. If ShinyHunters follows their established extortion pattern, affected organizations should anticipate ransom demands and potential public data leaks within weeks of compromise. The group's willingness to directly target U.S. federal infrastructure in response to law enforcement pressure may embolden other cybercriminal actors to adopt similar confrontational postures, potentially complicating attribution and response efforts. If the FBI breach involved a genuine zero-day as claimed, other federal agencies running PeopleSoft for HR and recruitment functions may face imminent risk until Oracle issues guidance. Organizations in the higher education and healthcare sectors—which often operate with limited security resources—are likely to experience disproportionate impact if they cannot rapidly implement the multi-step mitigation guidance provided by Mandiant.