ShinyHunters Resumes Exploitation of Oracle PeopleSoft Zero-Day
The hacking group ShinyHunters has reactivated its campaign exploiting CVE-2026-35273, a vulnerability in Oracle PeopleSoft that was first disclosed in June 2024, according to a Mandiant blog published on Friday. The vulnerability affects widely used PeopleSoft modules deployed across government, education, and healthcare institutions for managing functions such as payroll, invoicing, project tracking, and staffing.
Mandiant initially reported in June that ShinyHunters had been exploiting this flaw as a zero-day between May 27 and June 9, 2024, primarily targeting academic institutions. Oracle released a patch for CVE-2026-35273 on June 10, 2024, and Mandiant issued guidance recommending either immediate patching or implementation of specific workarounds to mitigate risk.
Attackers Bypass Workarounds, Deploy Web Shells Globally
In its latest advisory, Mandiant warned that ShinyHunters has adapted to defensive measures by targeting organizations that implemented the recommended workarounds but did not apply the official patch. The threat actor has expanded its targeting beyond education to include technology, IT services, healthcare, agriculture, transportation, and government sectors worldwide.
Analysis of compromised systems shows the hackers successfully exploited CVE-2026-35273 to gain full control of operating systems or access sensitive PeopleSoft data, including configuration files, database connection strings, and application databases. Mandiant confirmed the deployment of web shells on dozens of systems globally as part of this renewed campaign.
Link to FBI Job Site Breach and Data Extortion Pattern
The resurgence of ShinyHunters activity coincides with the group’s recent claim of responsibility for breaching the FBI’s jobs website, which resulted in the defacement of the portal and alleged exfiltration of sensitive operational and personnel data. In a memo obtained by The New York Times, FBI senior officials acknowledged the breach and stated they are operating under the assumption that threat actors are exfiltrating personal information of all FBI employees.
ShinyHunters has publicly asserted that the FBI breach was carried out via a vulnerability in Oracle PeopleSoft, prompting speculation about whether they discovered a new flaw or were exploiting a previously known issue like CVE-2026-35273. Mandiant’s analysis supports the latter, indicating consistent use of the same vulnerability across multiple high-profile intrusions.
Oracle Users Urged to Monitor Logs and Prepare for Extortion
Oracle’s public customer list includes numerous U.S. and international government agencies, healthcare providers, and universities using PeopleSoft. Mandiant advises all organizations using the platform to review database logs for anomalous queries targeting human resources, payroll, and student records tables — common objectives in ShinyHunters’ data theft operations.
The group follows a well-established extortion model: stealing sensitive data and threatening to publish it on leak sites unless a ransom is paid. Mandiant urges potential victims to prepare for extortion communications and monitor for public disclosure of stolen information.
Recent Attacks and Law Enforcement Action
ShinyHunters has claimed responsibility for dozens of high-profile incidents in recent months, including attacks on Ticketmaster, AT&T, McGraw Hill, Carnival Cruise Line, and 7-Eleven. The group escalated its profile last week by releasing 5,000-person samples of stolen FBI data to outlets such as Reuters, 404 Media, and the BBC, which verified the authenticity of the data containing medical records, details on covert FBI units, and agent information.
On Monday, Dutch authorities arrested a 24-year-old suspect in Amsterdam believed to be a key member of ShinyHunters. Cybersecurity journalist Brian Krebs reported the individual was involved in an internal power struggle with a Jordan-based hacker for leadership of the criminal operation.
Source: The Record