# Threat Intel Brief — September 28, 2026

TL;DR

  • Citrix NetScaler zero-days: Two critical RCE vulnerabilities (CVE-2026-88771, CVE-2026-88772) actively exploited; immediate patching required for all internet-facing appliances.
  • Oracle PeopleSoft mass exploitation: ShinyHunters bypassing WAF protections to exploit CVE-2026-35273 (CVSS 9.8) across 100+ organizations globally; includes FBI portal breach.
  • CISA KEV additions: Microsoft SharePoint (CVE-2026-65660) and MikroTik RouterOS flaws under active exploitation; federal agencies must patch by September 28.
  • Supply chain risk: Compromised GitHub Actions re-enabled with malicious Mini Shai-Hulud payload active for 7+ days; CI/CD pipelines at risk.
  • Ukraine-targeted campaign: Lunex MaaS platform distributing Psychedelic Stealer via compromised Ukrainian websites using AMD driver exploit (CVE-2023-20598).

Critical Threats

Citrix NetScaler ADC/Gateway Zero-Day Exploitation

What happened: Citrix confirmed active exploitation of two critical unauthenticated remote code execution vulnerabilities in NetScaler ADC and Gateway appliances. CVE-2026-88771 (CVSS 9.5) affects all deployments including default configurations. CVE-2026-88772 (CVSS 9.5) affects appliances with DTLS enabled, which is default for VPN virtual servers. Patches were released September 27 after law enforcement and national CERTs issued pre-disclosure warnings to organizations worldwide. Six additional vulnerabilities (CVE-2026-88773 through CVE-2026-88778, CVSS 7.0-9.3) were also addressed in the same security bulletin.

Impact: NetScaler appliances sit at the network perimeter handling VPN, remote access, load balancing, and authentication. Successful exploitation grants attackers unauthenticated remote code execution, enabling full appliance compromise, credential theft, lateral movement into internal networks, and persistent access. CVE-2026-88771 requires no special configuration, making every unpatched deployment vulnerable. Citrix provided no workarounds or indicators of compromise. Organizations cannot determine whether prior compromise occurred through patching alone and may require forensic investigation and credential rotation across all services using NetScaler authentication.

Recommendations:

  • Immediately upgrade NetScaler ADC and Gateway to fixed versions: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 (FIPS/NDcPP) depending on deployment
  • Assume compromise and preserve forensic evidence before patching: take VPX snapshots, collect remote syslog and NetScaler Console logs, generate technical support bundles, and capture packet engine core dumps
  • After patching, rotate all service account passwords and secrets stored on NetScaler appliances, reset passwords for users who authenticated through them, and revoke certificates and private keys
  • Run Netherlands NCSC NetScaler compromise detection scripts on live appliances, core dumps, and full images to identify indicators of prior exploitation
  • Verify NetScaler management interfaces are not exposed to the public internet and isolate any compromised appliances from the network immediately

Oracle PeopleSoft Mass Exploitation with WAF Bypass

What happened: ShinyHunters (tracked by Mandiant as UNC6240) is conducting renewed mass exploitation of CVE-2026-35273, a critical Oracle PeopleSoft vulnerability (CVSS 9.8) enabling unauthenticated remote code execution via Java deserialization. The campaign targets over 100 organizations globally across higher education, healthcare, government, technology, and other sectors. Attackers are using URL-encoding techniques (/%50SEMHUB/ instead of /PSEMHUB/) to bypass web application firewall protections. Post-exploitation includes deployment of JSP web shells (x.jsp, u.jsp), SIDEEYE C++ backdoor, Neo-reGeorg tunneling toolkit, and MeshAgent RMM for persistence. The group also breached the FBI's FBIJobs.gov portal using a separate PeopleSoft zero-day, claiming the action was to contest FBI allegations rather than for financial gain.

Impact: PeopleSoft systems contain highly sensitive HR, payroll, and student records. The campaign enables data theft for extortion purposes, with ShinyHunters threatening public exposure via data leak sites unless victims pay ransoms. Organizations that implemented WAF rules blocking /PSEMHUB/ remain vulnerable to encoded path variants. The FBI breach reportedly involved exfiltration of 2-3 TB of data. The existence of a second alleged PeopleSoft zero-day suggests additional federal agencies and enterprises running PeopleSoft for HR and recruitment functions may face imminent risk.

Recommendations:

  • Apply Oracle patches for CVE-2026-35273 immediately; disable or remove the Environment Management Hub (PSEMHUB) service if not operationally required
  • Update WAF rules to detect percent-encoded variants of /PSEMHUB/ paths; ensure URL decoding occurs before pattern matching to prevent bypass via encoded characters
  • Search WebLogic access logs for POST requests to /PSEMHUB/ and encoded variants (e.g., /%50SEMHUB/); inspect PSEMHUB.war directory for JSP web shells (x.jsp, u.jsp) and malicious artifacts
  • Monitor for SIDEEYE backdoor indicators including trojanized signed executables (Ple64.exe), C2 communication to 162.219.30[.]165 over TCP, and Neo-reGeorg tunneling toolkit deployment
  • Rotate credentials accessible by PeopleSoft and WebLogic service accounts; review database audit logs for bulk queries against HR, payroll, and student records tables; monitor outbound traffic from PeopleSoft hosts for data exfiltration

SharePoint and MikroTik RouterOS Active Exploitation

What happened: CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-65660 is a code injection flaw in Microsoft Office SharePoint Server (CVSS 8.8) enabling authenticated remote code execution. Microsoft confirmed "reliable evidence of observed attacks" as of September 25, 2026. CVE-2026-67279 affects MikroTik RouterOS 7.x and is chained with CVE-2026-86060 to enable full unauthenticated administrative takeover of internet-exposed routers. Proof-of-concept code is publicly available and has been reproduced by Bishop Fox and CERT Polska.

Impact: SharePoint's prevalence in government and corporate environments makes authenticated RCE particularly consequential for data integrity and operational continuity. The MikroTik vulnerability chain enables attackers to gain full administrative control of exposed routers without credentials, providing footholds for lateral movement into operational technology networks, telecommunications infrastructure, or government systems. Federal agencies must remediate by September 28, 2026, under CISA's Binding Operational Directive 22-01. No attribution or scope of exploitation has been disclosed.

Recommendations:

  • Apply Microsoft security updates for CVE-2026-65660 immediately to all SharePoint Server instances; review Microsoft advisory for patch details
  • Update MikroTik RouterOS 7.x devices to patched versions addressing CVE-2026-67279 and CVE-2026-86060; prioritize internet-exposed routers
  • Audit SharePoint access logs for suspicious authenticated sessions and code execution attempts since mid-September 2026
  • Review MikroTik router logs for unauthorized administrative sessions or exec requests from unauthenticated clients; check for policy mask anomalies in login process
  • Restrict network exposure of SharePoint and MikroTik RouterOS management interfaces; enforce VPN or IP allowlisting where feasible

Threat Actor Activity

ShinyHunters (UNC6240) — Oracle PeopleSoft Campaign

ShinyHunters, a financially motivated extortion gang tracked by Mandiant as UNC6240, is conducting a sophisticated campaign exploiting CVE-2026-35273 with WAF bypass techniques. The group evolved from GnosticPlayers and rebranded in 2020. Their current operation targets multiple sectors globally with concentration in the United States, affecting higher education, technology, IT services, healthcare, agriculture, transportation, and government. The campaign demonstrates advanced technical capabilities including zero-day exploitation, multi-platform post-exploitation, and deployment of custom tooling (SIDEEYE backdoor, Neo-reGeorg tunneling). The group's breach of the FBI's FBIJobs.gov portal using a separate PeopleSoft zero-day represents a confrontational posture toward U.S. law enforcement, though they claim this action was not financially motivated. Organizations should anticipate ransom demands and potential public data leaks within weeks of compromise.

Lunex MaaS Platform — Ukraine-Targeted Credential Theft

Lunex is a malware-as-a-service platform attributed to Russian-speaking developers distributing Psychedelic Stealer (LunexStealer) to multiple criminal groups. The platform has rapidly expanded from 6 C2 panels in June 2026 to 28 panels across 13 countries by September 2026, including Russia, the U.S., the U.K., Netherlands, France, Germany, Turkey, and Bangladesh. The current campaign targets Ukrainian-speaking users via compromised Ukrainian websites (healthcare, retail, cultural institutions) using ClickFix-style fake CAPTCHA pages. The attack chain employs a sophisticated BYOVD (Bring Your Own Vulnerable Driver) technique exploiting CVE-2023-20598 in AMD Radeon Software driver (PDFWKRNL.sys) to escalate privileges and disable security monitoring. Post-exploitation includes credential theft from seven Chromium-based browsers, cryptocurrency wallet exfiltration, and deployment of a malicious Chrome extension for complete browser control. The deliberate focus on Ukrainian infrastructure and Ukrainian-language lures suggests geopolitical motivation, though the MaaS model complicates attribution.

Mini Shai-Hulud — GitHub Actions Supply Chain Compromise

Mini Shai-Hulud is a threat actor focused on software supply chain compromise targeting the GitHub Actions ecosystem. Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for over a week while still pointing to malicious code. The incident demonstrates persistent monitoring of previously compromised infrastructure and exploitation of incomplete remediation. Organizations using these compromised actions in CI/CD pipelines may have executed malicious code with workflow permissions, potentially exposing secrets, source code, or enabling lateral movement. Specific action names have not been publicly disclosed, limiting immediate remediation scope identification.

Geopolitical Context

Ukraine Cyber Operations

The Lunex campaign represents sustained cyber pressure on Ukraine's digital ecosystem, consistent with patterns observed since 2022. The compromise of civilian websites—including healthcare and retail sectors—demonstrates threat actors' willingness to weaponize trusted domestic infrastructure, eroding public confidence in digital services during wartime. The campaign's credential theft and persistent access capabilities pose spillover risks to European partners engaged with Ukrainian entities, particularly through supply chain exposure or compromised business communications. The hosting of C2 infrastructure across multiple EU member states (Finland, Germany, Netherlands, France) highlights gaps in collective cyber defense and continued abuse of European hosting providers by malicious actors.

U.S. Federal Infrastructure Targeting

ShinyHunters' breach of the FBI's FBIJobs.gov portal using an alleged separate PeopleSoft zero-day represents direct targeting of U.S. federal infrastructure. The group's stated motivation—"to set the record straight and protect the image of our organisation"—represents an unusual posture for a ransomware-adjacent group and may complicate international law enforcement cooperation if sensitive personnel or applicant data involving foreign nationals was compromised. The simultaneous exploitation of enterprise collaboration platforms (SharePoint) and network devices (MikroTik) affecting federal agencies reflects multi-vector campaigns seeking both internal access and network persistence.

Recommended Actions

Immediate (0-24 hours)

1. Citrix NetScaler: Patch all internet-facing NetScaler ADC and Gateway appliances to versions 14.1-73.37, 13.1-64.23, or corresponding FIPS builds; preserve forensic evidence before patching
2. Oracle PeopleSoft: Apply patches for CVE-2026-35273; update WAF rules to detect URL-encoded /PSEMHUB/ variants; search logs for exploitation indicators
3. SharePoint: Apply Microsoft security updates for CVE-2026-65660 to all SharePoint Server instances
4. MikroTik RouterOS: Update devices to patched versions addressing CVE-2026-67279 and CVE-2026-86060; prioritize internet-exposed routers
5. Elementor WordPress: Update Elementor Website Builder plugin to version 4.3.2 or later on all WordPress sites

Within 24-72 hours

1. Credential rotation: Rotate all service account passwords and secrets stored on NetScaler appliances; reset passwords for users who authenticated through compromised systems
2. Compromise assessment: Run Netherlands NCSC NetScaler detection scripts; review PeopleSoft WebLogic logs for web shell indicators; audit SharePoint access logs for suspicious activity
3. GitHub Actions audit: Review GitHub Actions workflows for third-party actions and cross-reference against Mini Shai-Hulud indicators; implement commit SHA pinning
4. AMD driver monitoring: Deploy detection for CVE-2023-20598 exploitation in AMD Radeon driver (PDFWKRNL.sys); block loading of vulnerable driver hashes

This week

1. Network segmentation: Restrict internet exposure of NetScaler, SharePoint, and MikroTik management interfaces; enforce VPN or IP allowlisting
2. Forensic investigation: Conduct compromise assessment on all internet-facing NetScaler appliances running affected versions; review for anomalous activity, unauthorized configuration changes, and suspicious network connections
3. WordPress security: Audit WordPress user accounts for unauthorized administrator accounts created between Elementor versions 4.3.0/4.3.1 installation and patching
4. Cloudflare Containers: If using Cloudflare Containers with Workers Paid plan, rotate credentials and secrets stored in containers deployed before September 19, 2026

Watch List

  • Oracle PeopleSoft second zero-day: ShinyHunters claims possession of a second PeopleSoft zero-day used in FBI breach; monitor Oracle security advisories for emergency patches
  • Citrix NetScaler IOCs: Monitor Citrix security bulletin CTX697096 for updated indicators of compromise or detection guidance
  • Kiteworks threat intelligence: Federal authorities warned Kiteworks of imminent attack; monitor for public disclosure of threat details or affected systems
  • Microsoft KB5002907: Microsoft paused rollout after reports of Office 2016/2019 license deactivation; monitor for resolution and safe deployment guidance
  • OpenAI data exposure: OpenAI's AI agents accidentally uploaded user-provided images to third-party image-hosting services; monitor for scope and remediation details

Sources

  • BleepingComputer: Citrix confirms two NetScaler RCE zero-days exploited in attacks
  • BleepingComputer: Cloudflare fixes Containers cross-tenant flaw exposing customer data
  • The Hacker News: Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
  • CERT-EU Advisories: 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
  • BleepingComputer: ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
  • BleepingComputer: GitHub Actions re-enabled with Mini Shai-Hulud payload still active
  • The Hacker News: Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
  • The Hacker News: Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
  • The Hacker News: Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
  • The Hacker News: SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
  • The Hacker News: Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack

---

*This threat intelligence brief synthesizes information from multiple trusted sources and provides actionable guidance for security operations teams. Organizations should prioritize immediate patching of actively exploited vulnerabilities and conduct compromise assessments on internet-facing systems.*