# Threat Intel Brief — September 27, 2026

TL;DR

  • Critical Oracle PeopleSoft vulnerability (CVE-2026-35273) under mass exploitation by ShinyHunters gang using WAF bypass techniques; over 100 organizations compromised globally.
  • North Korean actors suspected in $351.6M Bitget cryptocurrency exchange breach via backend infrastructure compromise.
  • CISA adds four actively exploited flaws to KEV catalog: WSO2 authentication bypass (CVE-2026-5430), SharePoint RCE (CVE-2026-65660), Roundcube SQL injection (CVE-2026-48842), and Adobe Commerce session hijacking.
  • Supply chain risk persists as compromised GitHub Actions repositories re-enabled with Mini Shai-Hulud malware intact for over one week.
  • Kiteworks issues emergency shutdown directive following federal threat intelligence warning of imminent zero-day exploitation.

---

Critical Threats

Oracle PeopleSoft Mass Exploitation (CVE-2026-35273)

What happened:
Google Threat Intelligence and CISA warn of renewed mass exploitation of CVE-2026-35273, a critical unauthenticated remote code execution vulnerability (CVSS 9.8) in Oracle PeopleSoft. The ShinyHunters extortion gang is actively exploiting this flaw using URL-encoding techniques to bypass web application firewall protections. Attackers deploy JSP web shells and the SIDEEYE C++ backdoor to exfiltrate HR, payroll, and student records from compromised systems. Over 100 organizations globally have been identified as vulnerable, with confirmed intrusions across higher education, healthcare, government, and technology sectors.

Impact:
Successful exploitation grants unauthenticated attackers full remote code execution on PeopleSoft servers, enabling credential theft, database exfiltration, and persistent backdoor access. The WAF bypass technique renders string-based filtering ineffective, leaving organizations that deployed compensating controls without applying vendor patches still vulnerable. ShinyHunters' data extortion model means compromised organizations face public data leaks and ransom demands. The vulnerability affects critical HR and financial systems, creating operational disruption and regulatory compliance risks.

Recommendations:

  • Apply Oracle patches for CVE-2026-35273 immediately; disable Environment Management Hub (EMHub) in multi-server configurations or remove the PSEMHUB application entirely in single-server deployments.
  • Update WAF rules to detect percent-encoded variants of /PSEMHUB/ paths by implementing URL decoding before pattern matching.
  • Search WebLogic access logs for requests to /PSEMHUB/ and encoded variants like /%50SEMHUB/ since early September 2026.
  • Inspect PSEMHUB.war directories for JSP web shells (particularly x.jsp and u.jsp); monitor for large archive files in temporary directories indicating data staging.
  • Rotate all credentials accessible to PeopleSoft service accounts and review database audit logs for bulk queries against HR, payroll, and student records tables.

---

North Korean Cryptocurrency Theft ($351.6M Bitget Breach)

What happened:
Cryptocurrency exchange Bitget disclosed that suspected North Korean threat actors—likely the Lazarus Group's TraderTraitor cluster—compromised backend wallet infrastructure and stole $351.6 million from hot and warm wallets on September 24, 2026. Attackers spoofed transaction data and triggered authorization processes to move funds. Attribution is based on IP behavior patterns and on-chain analysis consistent with known DPRK operational patterns. Multiple blockchain foundations (Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base) are coordinating to freeze attacker-controlled addresses.

Impact:
This represents one of the largest single-exchange cryptocurrency thefts in 2026 and continues North Korea's systematic targeting of digital asset platforms to generate sanctions-evading revenue. The backend compromise methodology demonstrates advanced capabilities beyond typical phishing or social engineering attacks. Cold wallets and the majority of platform assets remained secure, but the incident underscores persistent vulnerabilities in hot wallet authorization systems across the cryptocurrency sector.

Recommendations:

  • Implement multi-party authorization controls for hot and warm wallet transactions with out-of-band verification to prevent spoofed transaction data from triggering fund movements.
  • Deploy behavioral analytics and anomaly detection on backend wallet infrastructure systems to identify unauthorized access patterns.
  • Segment critical wallet authorization systems from general backend infrastructure with strict network access controls.
  • Establish blockchain monitoring for suspicious outbound transactions and maintain relationships with chain foundations to enable rapid wallet address freezing.
  • Conduct third-party security assessments of wallet infrastructure focusing on authentication bypass, privilege escalation, and transaction validation logic.

---

CISA KEV: Four Actively Exploited Vulnerabilities

What happened:
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog based on confirmed active exploitation:

  • CVE-2026-5430 (WSO2 API Control Plane, CVSS 9.8): Path traversal enabling unrestricted file upload and remote code execution. Exploitation observed in honeypots since September 13, 2026.
  • CVE-2026-65660 (Microsoft SharePoint, CVSS 8.8): Code injection flaw enabling authenticated remote code execution. Microsoft confirms "reliable evidence of observed attacks."
  • CVE-2026-48842 (Roundcube Webmail, CVSS 8.1): Pre-authentication SQL injection in virtuser_query plugin. Canadian Centre for Cyber Security confirms active exploitation.
  • Adobe Commerce/Magento (CVE: see source, CVSS 9.1): Session hijacking enabling customer account switching without authentication. Exploitation attempts detected and blocked by Sansec in August 2026.

Impact:
These vulnerabilities affect widely deployed enterprise infrastructure across banking, government, telecommunications, logistics, and e-commerce sectors. WSO2 serves nearly 1,000 customers globally; SharePoint is extensively used across federal and commercial environments; Roundcube has over 523,000 internet-exposed instances; Adobe Commerce powers major e-commerce platforms. Exploitation enables initial access, credential theft, data exfiltration, and lateral movement. Federal agencies must remediate by September 27-28, 2026, per CISA Binding Operational Directive 22-01.

Recommendations:

  • Apply vendor patches for all four vulnerabilities immediately, prioritizing internet-facing instances.
  • For Roundcube: If immediate patching is not possible, disable the virtuser_query plugin until upgrade to version 1.6.16 or 1.7.1 is complete.
  • Review WSO2 API Control Plane, SharePoint, Roundcube, and Adobe Commerce logs for suspicious activity since mid-August 2026.
  • Audit exposed credentials and force password resets for accounts accessed via affected systems.
  • Implement network segmentation to restrict external access to management interfaces until patching is complete.

---

Kiteworks Zero-Day Threat and Emergency Shutdown

What happened:
Kiteworks (formerly Accellion) received credible threat intelligence from federal authorities indicating an imminent cyberattack targeting some of its systems. The company urged customers worldwide to shut down Kiteworks servers for a six-to-nine-hour window on Saturday to prevent potential exploitation of an undisclosed zero-day vulnerability. No CVE has been assigned, and technical details remain undisclosed. Kiteworks provides secure file sharing and managed file transfer solutions to enterprises, government agencies, and organizations handling sensitive data.

Impact:
Organizations using Kiteworks for secure file sharing face potential compromise of sensitive data in transit and at rest. The vendor-mandated shutdown window disrupts file-sharing operations, but the lack of technical details prevents independent risk assessment or deployment of compensating controls. The precautionary nature of the advisory suggests federal authorities identified specific targeting or reconnaissance activity against Kiteworks infrastructure.

Recommendations:

  • Comply with Kiteworks vendor directive: shut down all Kiteworks servers during the specified maintenance window.
  • Monitor Kiteworks support channels for emergency patch release and technical details.
  • Prepare alternative secure file transfer methods for the shutdown window (encrypted email, alternative SFTP).
  • After patching, review Kiteworks access logs and file transfer logs for suspicious activity preceding the shutdown.
  • Escalate to leadership: assess whether to keep systems offline beyond the window if patch details are insufficient.

---

Threat Actor Activity

ShinyHunters (UNC6240)

ShinyHunters continues aggressive exploitation of Oracle PeopleSoft infrastructure using CVE-2026-35273 with evolved WAF bypass techniques. The group also compromised the Clop ransomware gang's data leak site via an unauthenticated path traversal vulnerability in Grav CMS, forcing Clop to migrate to a new Tor address. In May 2026, ShinyHunters breached the FBI's FBIJobs.gov portal using a separate PeopleSoft zero-day (not CVE-2026-35273) and stole 2-3 TB of data, allegedly to contest FBI characterization of the group. This demonstrates sustained focus on Oracle products and willingness to target high-profile government entities.

Lazarus Group (TraderTraitor Cluster)

Suspected North Korean actors compromised Bitget's backend systems, stealing $351.6 million in cryptocurrency. This follows the $1.5 billion Bybit theft and $292 million KelpDAO LayerZero bridge compromise attributed to the TraderTraitor cluster. The group demonstrates advanced capabilities in compromising financial infrastructure, particularly targeting cryptocurrency exchanges and DeFi platforms to generate revenue for the North Korean regime amid international sanctions.

Mini Shai-Hulud

Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) previously compromised in May 2026 were re-enabled by their maintainer on September 16, 2026, and remained accessible for over one week while still containing malicious code. Any CI/CD workflows referencing these actions by version tags automatically downloaded and executed credential-harvesting payloads. The incident demonstrates persistent supply chain risk when compromised repositories are not properly sanitized before re-enablement.

Storm-3168 (JADEPUFFER)

Microsoft identified Storm-3168 conducting agentic-driven cloud attacks targeting Azure environments through compromised service principals. The actor demonstrates advanced cloud-focused capabilities, leveraging AI-orchestrated techniques to conduct extensive reconnaissance, bulk resource destruction, and credential harvesting operations. The group executed 150+ malicious operations within 35 minutes across compromised Azure environments, including deletion attempts targeting Storage Accounts, SQL databases, Key Vaults, Function Apps, Virtual Machines, and App Services.

Lunex MaaS Platform

Lunex, a Russian-speaking malware-as-a-service platform, distributes Psychedelic Stealer via compromised Ukrainian websites using ClickFix-style fake Cloudflare CAPTCHA pages. The four-stage attack chain exploits CVE-2023-20598 in AMD Radeon Software driver to disable security monitoring before stealing browser credentials and cryptocurrency wallets. The platform has expanded from six C2 panels in June 2026 to 28 panels across 13 countries, indicating rapid growth and adoption by multiple criminal groups.

---

Geopolitical Context

North Korean Sanctions Evasion

The Bitget breach continues North Korea's systematic exploitation of cryptocurrency infrastructure to circumvent international sanctions. The $351.6 million theft demonstrates Pyongyang's sustained investment in offensive cyber capabilities targeting decentralized finance platforms. Blockchain foundations are coordinating cross-chain efforts to freeze stolen assets, but successful laundering would likely sustain or expand DPRK cryptocurrency-focused operations.

Ukraine-Targeted Campaigns

The Lunex MaaS platform specifically targets Ukrainian-speaking users through compromised Ukrainian websites, including healthcare, retail, and automotive sectors. This occurs within the broader context of sustained cyber operations against Ukraine since 2022, though the financially-motivated nature suggests organized cybercrime rather than state-directed espionage. The compromise of legitimate Ukrainian business websites undermines trust in Ukraine's digital infrastructure during ongoing conflict and reconstruction efforts.

Western Balkans Cybercrime

The prosecution of Rydox marketplace operator Ardit Kutleshi reflects transatlantic law enforcement cooperation targeting cybercrime infrastructure in Kosovo. The case involved coordination between Kosovo law enforcement, Albania's Special Anti-Corruption Body, the FBI, and Malaysian authorities. Kosovo's cooperation in extraditing Kutleshi to the United States reflects its ongoing efforts to align with Western legal standards as part of its Euro-Atlantic integration agenda.

U.S. Insider Threat

A U.S. Army soldier with secret-level security clearance was sentenced to 70 months in federal prison for hacking telecommunications companies and stealing mobile call and text metadata for over 100 million AT&T customers. The perpetrator, operating under the alias "Kiberphant0m" while stationed in South Korea, engaged in extortion and claimed to possess sensitive national security materials. The case underscores vulnerabilities in insider threat monitoring for cleared personnel deployed overseas.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-35273 (Oracle PeopleSoft) on all instances; disable EMHub if patching is delayed.
  • Patch CVE-2026-5430 (WSO2), CVE-2026-65660 (SharePoint), CVE-2026-48842 (Roundcube) on all internet-facing systems.
  • Comply with Kiteworks shutdown directive during specified maintenance window.
  • Audit GitHub workflows for usage of actions-cool/issues-helper and actions-cool/maintain-one-comment; rotate all secrets accessible to affected workflows.
  • Update Elementor WordPress plugin to version 4.3.2 to address CSRF vulnerability enabling admin account creation.

Near-term (24-72 hours)

  • Review logs for WSO2, SharePoint, Roundcube, Adobe Commerce, and PeopleSoft systems for suspicious activity since mid-August 2026.
  • Rotate credentials for PeopleSoft service accounts, Azure service principals exposed in public repositories, and accounts accessed via affected Roundcube instances.
  • Implement WAF rule updates to detect percent-encoded PeopleSoft exploitation attempts.
  • Conduct incident response for any CI/CD pipelines that executed compromised GitHub Actions between September 16-25, 2026.
  • Review cryptocurrency exchange security posture if operating hot/warm wallet infrastructure; implement multi-party authorization controls.

This week

  • Implement GitHub Actions SHA pinning for all workflow dependencies to prevent automatic consumption of compromised updates.
  • Deploy behavioral analytics on Azure Resource Manager API activity to detect anomalous ListKeys operations, rapid resource enumeration, and parallel deletion attempts.
  • Establish blockchain monitoring for suspicious outbound transactions if operating cryptocurrency platforms.
  • Review WordPress user accounts for unauthorized administrator-level accounts created via Elementor CSRF exploitation.
  • Monitor for Lunex MaaS indicators including connections to 193.178.159[.]128 and exploitation of CVE-2023-20598 in AMD drivers.

---

Watch List

  • MikroTik RouterOS vulnerability (CVE-2026-67279): Chained with CVE-2026-86060 for full unauthenticated admin takeover of internet-exposed routers. CISA confirms active exploitation; update RouterOS 7.x immediately.
  • Microsoft KB5002907 update: Paused after reports of deactivated or removed perpetual Office 2016/2019 installations. Monitor Microsoft support channels before deploying.
  • OpenAI AI agents data exposure: AI agents accidentally uploaded user-provided images to third-party image-hosting services during research tasks, resulting in unintended data exposure.
  • Cloudflare Containers disk data exposure: Patched vulnerability allowed customers to read leftover disk data from other customers' containers. No customer action required; Cloudflare reports full remediation as of September 19, 2024.
  • Storm-3168 Azure targeting: Monitor for compromised service principals in Azure environments; review public GitHub repositories for exposed Azure credentials.

---

Sources

  • BleepingComputer: ShinyHunters WAF bypass, GitHub Actions re-enablement, Kiteworks shutdown, Clop leak site compromise, Elementor CSRF, CISA KEV updates, Rydox marketplace
  • The Hacker News: Oracle PeopleSoft exploitation, Lunex MaaS, Elementor CSRF, SharePoint/MikroTik KEV, Kiteworks threat, GitHub Actions compromise, Bitget breach, Roundcube SQL injection, Cloudflare Containers, WSO2/Adobe Commerce KEV
  • Krebs on Security: U.S. soldier AT&T/Verizon extortion case
  • Microsoft Security: Storm-3168 agentic cloud attacks
  • CISA Known Exploited Vulnerabilities Catalog
  • Canadian Centre for Cyber Security
  • Google Threat Intelligence (Mandiant)