Executive summary
Google Threat Intelligence Group (GTIG) and Mandiant reported on 11 June 2026 that an active Oracle PeopleSoft compromise and extortion campaign was attributable to their UNC6240 cluster, which they identify as ShinyHunters. The researchers observed activity between 27 May 2026 and 9 June 2026 consistent with exploitation of CVE-2026-35273 before Oracle's advisory on 10 June 2026. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 12 June 2026. We assess it is likely (B2) that exposed organisations need to investigate internal application infrastructure alongside closing the vulnerable entry point, because the reported activity includes remote management, configuration discovery and credential spraying beyond the initial server.
Context and affected systems
The Canadian Cyber Centre's updated advisory identifies PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. GTIG's investigation describes the affected Environment Management component and targeting of Environment Management Hub (EMHub) endpoints. It states that the vulnerability permits remote exploitation without authentication and can lead to remote code execution.
The historical KEV entry describes missing authentication for a critical function, records known ransomware-campaign use and gives a remediation deadline of 15 June 2026. That catalogue classification is not a claim that encryption occurred in each PeopleSoft intrusion. GTIG's specific report concerns compromise, stolen data and extortion.
GTIG notified more than 100 organisations whose addresses corresponded to potentially vulnerable endpoints; 68 per cent of that notification population were in higher education. Those figures describe exposed organisations notified by the researchers, not a verified victim count. The report says some recipients blocked activity or remediated, while others experienced compromise. We do not infer an education-sector compromise rate from the notification list.
Technical analysis
Administrative exposure formed the entry-point concern
GTIG connects the observed activity to the Environment Management Hub and recommends restricting the /PSEMHUB/ path and /PSIGW/HttpListeningConnector. Its guidance distinguishes disabling EMHub in a multi-server configuration from removing the PSEMHUB application in a single-server configuration. Where disabling the service is not possible, it recommends blocking external access at the network perimeter.
The researchers explicitly warn that relying only on web application firewall (WAF) body inspection is insufficient. They describe these interfaces as administrative or system-to-system components, separate from normal browser sessions. Our recommendation is to document each required integration, its permitted sources and the control that enforces that boundary, then verify the boundary from outside the trusted network.
Remote-management agents provided continuing control
GTIG examined five sequential staging addresses after public reporting exposed open directories on 9 June 2026. The directories contained customised MeshCentral agents, staging material and command history. MeshCentral is legitimate remote-management software; the reported misuse involved prepared agents connecting to attacker infrastructure and using cloud-themed filenames.
The Windows samples included meshagent32-azure-ops.exe, meshagent64-azure-ops.exe and meshagent64-v2.exe. GTIG says their communication endpoint used azurenetfiles[.]net, a domain chosen to resemble Azure NetApp Files infrastructure. It also found an unconfigured Linux agent staged alongside them. A Linux filename alone does not establish successful installation, but it is a reason to examine relevant Unix hosts as well as Windows systems.
The defensive question is whether the agent and its destination were approved in that environment. We recommend correlating file creation, service or process execution and outbound connections. Merely recognising a legitimate product name is not enough to distinguish authorised administration from this campaign's use of the same software.
Discovery led towards the internal application estate
The exposed command history showed inspection of PeopleSoft configuration, mount information, local host mappings and WebLogic server configuration. GTIG identifies psappsrv.cfg and config.xml among the files examined. These observations support looking beyond the public-facing web tier when reconstructing the attacker's view of the environment.
GTIG also describes a custom script named with a victim-specific abbreviation followed by _fanout.sh. It gathered internal hostnames and attempted Secure Shell (SSH) authentication with a list of administrative and application credentials. Successful sessions were used to place an extortion and defacement marker in relevant application directories. We do not reproduce the propagation script; its investigative significance is the combination of discovery, repeated authentication attempts and marker deployment.
Impact and evidential boundaries
GTIG correlates the staging and deployment activity with publication of stolen archives on the ShinyHunters data-publication website on 9 June 2026. The researchers' attribution applies to their UNC6240 investigation. It should not be extended automatically to every PeopleSoft scan, every use of MeshCentral or every organisation with an exposed endpoint.
For an affected operator, three questions require separate answers: whether the vulnerable component was reachable, whether attacker code or remote administration executed, and whether information was taken or internal systems were accessed. We recommend maintaining distinct findings for each. A successful containment change answers the present exposure question; it does not retrospectively establish what happened during the earlier window.
The report supports urgent investigation without naming organisations from criminal claims. Its notification denominator also shows why inventory work matters: a list of vulnerable internet addresses and a list of confirmed compromises serve different response purposes. Merge them only when organisation-specific evidence supports that conclusion.
Indicators and detection opportunities
The following examples come from GTIG's investigation. They are campaign leads and should be correlated with host and network context, rather than treated as a complete detection catalogue.
| Indicator or observation | What to examine | Interpretation limit |
|---|---|---|
142.11.200[.]186 through 142.11.200[.]190 |
Historical connections from PeopleSoft-related hosts | These were the staging systems examined by GTIG |
azurenetfiles[.]net |
Domain resolution, outbound sessions and agent configuration | The reported lookalike domain is distinct from legitimate Azure services |
The three named Windows meshagent files |
File hashes, execution history and associated remote-management activity | A product name alone is insufficient; use the researcher's full hashes where available |
README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT |
File creation across web and scheduler directories | This is the reported defacement and extortion marker |
Unexpected JavaServer Pages (.jsp) under the PSEMHUB application |
Compare files with the shipped application and deployment history | Establish whether additions were authorised before assigning malicious intent |
GTIG recommends reviewing web access logs for external POST requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector. It also highlights unexpected content in the application's envmetadata/transactions/ area and directories named logs, persistantstorage or scratchpad. Preserve the spelling of persistantstorage when searching; correcting it would change the indicator.
The researchers additionally recommend monitoring outbound Server Message Block (SMB) traffic on port 445 to untrusted destinations because the exploit chain may attempt to capture Windows machine-account NetNTLM authentication material. This is a detection precaution tied to a possible mechanism. It is not a statement that credential capture was observed in every investigated intrusion.
Immediate incident response
First, establish the affected version, configuration and external reachability. Follow the source's configuration-specific advice: disable the EMHub service for multi-server deployments or remove the PSEMHUB application for a single-server deployment. If disabling is not possible, restrict both named endpoint paths at the perimeter. Record when the change took effect and validate it independently of the administration interface.
Second, preserve evidence before destructive remediation: web access logs, application files, configuration history, remote-management artefacts, network records and authentication events. We recommend building a timeline from the first suspicious request through process execution and outbound control, rather than beginning and ending with the vulnerability scan result.
Third, inspect the internal application estate revealed by configuration and hostname records. Examine SSH authentication patterns and the reported marker across related systems. Treat any credentials accessible to a confirmed compromised host as requiring scoped review and rotation from a trusted environment. This is our response recommendation; the exact credential population should come from that host's permissions and evidence.
Fourth, review persistence and restart behaviour. GTIG specifically recommends checking recently created or modified XML files in the environment metadata area because those files may support later code execution through XMLDecoder. Removing one agent or closing one endpoint should not be the sole basis for declaring the application trustworthy.
ATT&CK context
Our mapping of the reported exploitation to Exploit Public-Facing Application, T1190 follows the targeted PeopleSoft endpoints and unauthenticated vulnerability. The reported MeshCentral control maps to Remote Access Tools, T1219. These mappings describe behaviour in the published investigation; they do not convert all remote administration or endpoint traffic into evidence of ShinyHunters activity.
For coverage planning, assign the first mapping to exposure management and web-to-host investigation. Assign the second to the inventory of approved remote-access agents, their destinations and their execution history. This keeps the response focused on observable transitions rather than accumulating technique labels without supporting telemetry.
Mitigation and recovery criteria
GTIG recommends supported PeopleSoft versions and prompt application of Oracle's security updates and alerts. The Canadian advisory directs administrators to review Oracle's guidance and perform the suggested mitigations. We recommend recording both the software state and the administrative-interface restriction; they answer related but distinct questions about the environment.
Recovery should have explicit evidence requirements. Confirm the required access restrictions, account for unexpected files, investigate remote-management execution and resolve suspicious internal authentication. Where compromise is established, review the trust of the affected application hosts before returning them to service. Where evidence is missing, record the visibility gap instead of translating an empty search into proof that exploitation did not occur.
History and outlook
The observed activity began on 27 May 2026, the report's window ended on 9 June 2026, Oracle's advisory followed on 10 June 2026 and CISA listed the flaw on 12 June 2026. This ordering is why GTIG describes the observed exploitation as a zero-day campaign. The dates also give investigators a starting window without implying that every organisation's first exposure began on the same day.
Our likely (B2) judgement is that internal investigation remains necessary after entry-point mitigation where exploitation is evidenced. Configuration discovery, remote-management control and the propagation script provide the basis. The unresolved questions are the scope of successful internal access and data loss in each environment, not whether a notification or a criminal listing alone can stand in for those findings.
