Google Threat Intelligence Group and Mandiant report that UNC6240, associated with ShinyHunters, exploited Oracle PeopleSoft infrastructure in an active compromise and extortion campaign that hit organizations before Oracle’s June 10 advisory for CVE-2026-35273. The targeting heavily overlapped with higher education, but the lesson is broader: enterprise resource planning systems are not just business applications. Their administrative endpoints, integration listeners, and remote-management pathways are part of the external attack surface.
Source: Google Cloud / Mandiant: ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
What happened
GTIG says the activity was observed from May 27 through June 9, 2026 and aligned with exploitation of CVE-2026-35273, a critical unauthenticated remote code execution issue in Oracle PeopleSoft’s Environment Management component. The campaign focused on Environment Management Hub endpoints and was active before Oracle publicly issued its advisory, making the exploitation window especially dangerous for organizations that expose PeopleSoft administration paths to the internet.
The reported intrusion chain is classic modern extortion tradecraft: exploit an exposed enterprise application, deploy remote management tooling, map internal PeopleSoft and WebLogic infrastructure, move laterally, stage data, and connect the activity to leak-site pressure. The attackers reportedly used customized MeshCentral agents disguised as cloud-related services and infrastructure that mimicked legitimate Microsoft Azure naming.
Why this matters for SMBs and government contractors
Most small and mid-sized organizations do not run PeopleSoft, but many rely on similar ERP, HR, finance, payroll, student information, or case-management platforms. Government contractors also inherit risk from universities, public-sector partners, and third-party service providers that manage identity, payroll, grant, contracting, or personnel data.
The key issue is not just one Oracle CVE. It is the pattern: internet-reachable administrative services plus weak segmentation plus permissive outbound access can turn one web-facing application into a path for remote control, credential abuse, lateral movement, and data theft.
Defensive takeaways
- Block unnecessary PeopleSoft admin endpoints from the internet. Prioritize restrictions around
/PSEMHUB/*,/PSEMHUB/hub, and/PSIGW/HttpListeningConnectorwhere applicable. These should not be broadly reachable from untrusted networks. - Patch CVE-2026-35273 immediately. Treat this as active exploitation, not routine monthly maintenance. Confirm PeopleSoft environments are on supported versions and apply Oracle’s security alert guidance.
- Review access logs for suspicious POST activity. Hunt for external or unusual requests hitting PeopleSoft Environment Management and Integration Broker endpoints, especially around late May and early June 2026.
- Look for SSRF-style behavior. Requests that reference loopback addresses, internal IP ranges, or internal hostnames through exposed listener endpoints deserve immediate review.
- Monitor outbound SMB and remote-management traffic. PeopleSoft hosts should not be freely initiating TCP/445 traffic to the internet or connecting to unknown remote-management infrastructure.
- Audit web-tier filesystems. Check for unexpected JSP files, suspicious directories, recent XML changes, staging files, defacement notes, and remote agent binaries under PeopleSoft and WebLogic paths.
- Segment ERP from the rest of the network. ERP servers should have tightly defined east-west access. If a web tier is compromised, it should not have easy SSH or administrative reach into every application node.
Bulwark Black assessment
This campaign is another reminder that extortion groups do not need exotic malware when business-critical applications already expose privileged pathways. PeopleSoft, WebLogic, ERP integrations, file shares, and remote management agents are often treated as “internal IT plumbing.” Attackers treat them as movement infrastructure.
For organizations with PeopleSoft exposure, the response should be immediate: patch, restrict access, preserve logs, review filesystem changes, and investigate for post-exploitation activity. For everyone else, use this as a tabletop scenario for your own high-value business applications. Ask which admin endpoints are internet-facing, which systems can initiate outbound traffic, and whether your logs would show lateral movement before the data appears on a leak site.
