Between May 27 and June 9, the ShinyHunters crew exploited a zero-day remote code execution vulnerability in Oracle PeopleSoft (CVE-2026-35273) to breach enterprise systems, primarily targeting universities. Mandiant tracked the group as UNC6240. Oracle’s advisory dropped on June 10, meaning the bug had no patch during the entire attack window.
The vulnerability is a CVSS 9.8 RCE in PeopleTools 8.61 and 8.62, requiring no authentication and no user interaction. It lives in the Updates Environment Management component, reachable via HTTP if the Environment Management Hub (PSEMHUB) is exposed. The immediate engineering fix: disable PSEMHUB on multi-server setups, remove it on single-server, or block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the perimeter. Mandiant warns that WAF body-inspection rules alone are insufficient due to bypass techniques.
The attackers left their infrastructure exposed. Researcher @nahamike01 flagged open directories; Mandiant found five sequential IPs running Python’s SimpleHTTP server on port 8888. Staging files included a shared .bash_history, custom MeshCentral agents disguised as Azure binaries (calling home to azurenetfiles.net), and a lateral-movement script ([victim]_fanout.sh) that sprayed hardcoded credentials over SSH to internal hosts from /etc/hosts. Data was compressed with zstd and exfiltrated via outbound SSH to a server mirroring the ShinyHunters leak site.
Mandiant notified over 100 vulnerable organizations; 68% were in higher education. The University of Nottingham confirmed a breach exposing ~455,000 unique email addresses, along with names, passport numbers, and disability details. Oracle’s patch is behind a support login—availability remains unclear.
Post-incident hunting: check WebLogic access logs for external POSTs to /PSEMHUB/hub or /PSIGW/HttpListeningConnector; look for unexpected .jsp files under PSEMHUB.war, odd folders (logs, persistantstorage, scratchpad), or recently modified .xml files under envmetadata/data/environment (XMLDecoder persistence). Monitor outbound SMB on port 445 from PeopleSoft hosts for NetNTLM hash capture.
ShinyHunters has historically relied on vishing and token theft against SaaS platforms. This zero-day in on-prem ERP signals either a borrowed exploit or a strategic pivot. The open question remains: was this a one-off or the start of a new operational capability?
Source: The Hackers News