Introduction As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. In June, the threat actor exploited this vulnerability as a zero-day predominantly against academic institutions.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
About this summary. This is a short, independently written summary of an article first published by Google Threat Intelligence Group. Cyber Security News did not report or verify the underlying story. Read the original: https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/
Source attribution: headline and facts are from Google Threat Intelligence Group (cloud.google.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
ShinyHunters claims FBI breach after alleged PeopleSoft zero-day attack
ShinyHunters claims FBI breach via PeopleSoft zero-day, steals staff data; FBI investigating, no confirmation yet. The popular cybercrime group ShinyHunters is claiming…
Clop gets a taste of its own medicine after ShinyHunters hijack leak site
Clop has discovered what life is like on the receiving end of an extortion demand after rival crew ShinyHunters hijacked its leak site and demanded an eight-figure…
Google Pixel owners urged to patch actively exploited modem flaw
Google has released its September 2026 Pixel Update Bulletin, fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.” The…
ShinyHunters tells The Reg: We hacked the FBI to 'protect our business'
ShinyHunters, the data theft and extortion crew that has stolen sensitive information belonging to millions of cancer patients, university and K-12 students, and…
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions
Nation-state operators rarely need a zero-day to get inside a carrier. Much of the telecom stack still runs protocols designed when every participant was a known…
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
Companies frequently ask SpecterOps some version of the same question: How are you using AI in offensive security, and how can we begin using it too? They want practical…