ShinyHunters Swamps Education Sector with Zero-Day Oracle PeopleSoft Exploit

Hold onto your lily pads, devs—there’s a new predator lurking in the swamp. Mandiant and Google Threat Intelligence Group (GTIG) have uncovered an active compromise and extortion campaign by the notorious ShinyHunters crew (tracked as UNC6240). They’ve been exploiting a critical zero-day vulnerability (CVE-2026-35273, CVSS 9.8) in Oracle PeopleSoft’s Environment Management component, and they’re going after the education sector like caimans after a slow capybara.

Between May 27 and June 9, 2026, these digital swamp creatures targeted over 100 organizations—68% of which are higher education institutions. They used a clever masquerade: custom MeshCentral agents disguised as Microsoft Azure services, communicating with a C2 server at wss://azurenetfiles.net:443/agent.ashx. Classic caiman trickery.

How the Swamp Got Muddy

The attackers set up staging servers on five IP addresses (142.11.200.186-190) hosting Python SimpleHTTP servers on port 8888. These servers exposed directories containing pre-configured Windows MeshCentral agent binaries named meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, and meshagent64-v2.exe. They also staged an unconfigured Linux agent, likely for dynamic deployment.

Once inside, they used the MeshCentral CLI (meshctrl.js) to run reconnaissance commands, map PeopleSoft configurations, and deploy a custom lateral movement script: [victim_abbreviation]_fanout.sh. This script performed SSH credential spraying against internal hosts, dropping a defacement file (README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT) into WebLogic and Process Scheduler directories. The stolen data then made its way to the ShinyHunters Data Leak Site (DLS) on June 9.

What This Means for Your Swamp

If you’re running Oracle PeopleSoft, it’s time to reinforce your banks. Here’s what you need to do:

Network Isolation & WAF Rules

• Block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector at the firewall. Don’t rely solely on WAF body-inspection rules—they can be bypassed.
• This is non-breaking for standard user operations; these endpoints are administrative.

Log & Endpoint Monitoring

• Audit PIA WebLogic access logs for HTTP POST requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector from external IPs.
• Check for SSRF attempts using loopback IPs (127.0.0.1, localhost) in request headers.

Network Telemetry

• Monitor outbound SMB traffic (TCP 445) from PeopleSoft hosts to untrusted destinations—attackers may try to capture NetNTLM hashes.

Host-Level Auditing

• Scan for unexpected .jsp files in PSEMHUB.war.
• Check .../PSEMHUB.war/envmetadata/transactions/ for unauthorized folders or binaries.
• Look for directories named logs, persistantstorage, or scratchpad under PSEMHUB.
• Inspect <docroot>/envmetadata/data/environment/ for recently modified .xml files (XMLDecoder persistence).

For a deeper dive into securing your backend infrastructure, check out our reviews of Supabase, Firebase, and Neon Database—all solid alternatives to keep your data safe from swamp predators.

Indicators of Compromise (IOCs)

Here are the breadcrumbs to follow if you suspect you’ve been visited by ShinyHunters:

Stay safe out there, capybaras. Patch your PeopleSoft, lock down those endpoints, and keep an eye on the water for caiman fins.

Original announcement published on Google Cloud.