Oracle PeopleSoft PeopleTools PSEMHUB pre-auth RCE (CVSS 9.8), zero-day exploited by UNC6240/ShinyHunters

ShinyHunters has now given a partial answer of its own to the central open question, whether its claimed FBI-specific zero-day was real. Mandiant/GTIG's report on a separate, wider mass-exploitation wave against the already-known CVE-2026-35273 documents a URL-encoded WAF-bypass technique (requesting /%50SEMHUB/ in place of /PSEMHUB/), and BleepingComputer reports: "ShinyHunters has confirmed to BleepingComputer that they used this WAF bypass against FBI Jobs, but continue to claim that they also exploited "NEW unknown vulnerability in the same PSEMHUB component."" (BleepingComputer, 2026-09-26). By the group's own account, at least part of the FBI Jobs intrusion used a known technique against a known CVE rather than the wholly undisclosed zero-day it first claimed, though ShinyHunters still claims an additional, still-unconfirmed vulnerability was also involved. BleepingComputer's recap of the FBI's first response says the bureau confirmed it was investigating but did not confirm that its systems were breached or that data was stolen (BleepingComputer, 2026-09-26), and no party has confirmed or denied either technical claim.

The FBI has issued a further statement on the fbijobs.gov incident (FBI, 2026-09-23). CyberScoop reports: "The FBI hasn't confirmed the type or amount of data compromised or attributed the breach to ShinyHunters directly. The agency said it is 'actively and aggressively investigating' the incident, the root cause and its alleged impact to FBI employees' personally identifiable data in a statement Wednesday" (CyberScoop, 2026-09-28). Nextgov/FCW reports that Reuters found the circulated records included psychiatric and medical evaluations, and that the BBC separately reported seeing blood and urine test results: "Reuters reported Friday that records circulated by the hackers included psychiatric and medical evaluations. The BBC also reported seeing blood and urine test results" (Nextgov/FCW, 2026-09-28). The group separately provided Nextgov/FCW a roughly 5,000-entry sample of names, home addresses, phone numbers and relatives' information, and Nextgov/FCW's earlier reporting, citing two people familiar with the matter, says the exposed data covers intelligence analysts working on Russia, China, Hezbollah and cartel matters, plus personnel in the Bureau's Remote Operations Unit, which develops tools to target computers and networks (Nextgov/FCW, 2026-09-24). CyberScoop separately reports: "Limited samples of the stolen data contain FBI agents' personal contact information, details on family members, office and duty assignments and, in some cases, information on agency personnel specialties, multiple sources said" (CyberScoop, 2026-09-28). Security researchers Jon DiMaggio (Arkem Cyber) and Cynthia Kaiser (a former FBI official, now at Halcyon) warn the exposure creates counterintelligence and physical-safety risk for agents on sensitive cases, and that data already shared with journalists as proof samples is irretrievably disseminated regardless of any later takedown (CyberScoop, 2026-09-28). ShinyHunters told Nextgov/FCW it will not publish the stolen data: "Since the very beginning we had made our decision that we would never publish this data. We have never intended to nor have we ever planned to" (Nextgov/FCW, 2026-09-28). The group had earlier said the attack was retaliation for the FBI's May 2026 advisory on its operations (PSA260515), gave the FBI one week to correct or remove it while calling the demand neither financially motivated nor extortion, rejected claims that it is part of "The Com", and disputed the advisory's claims that it harasses victims and their relatives, conducts swatting attacks and falsely claims to hold compromising material (BleepingComputer, 2026-09-22). In its later statement to Nextgov/FCW, it called the confrontation "a marketing campaign to protect our business and actively combat disinformation", said "This was not a threat. It may have been worded like a threat", and claimed it had never expected compliance (Nextgov/FCW, 2026-09-28).

Dutch police separately confirmed, via a statement on X on 2026-09-28, the arrest of a 24-year-old suspect connected to the ShinyHunters investigation (Krebs on Security, 2026-09-28). Dutch police are separately asking the public to help identify a voice in a recorded February 2026 call in which a ShinyHunters member social-engineered access into Odido, the country's largest mobile carrier; Krebs states it remains unclear whether police have matched that voice to a confirmed identity, so the Odido case should not be read as resolved or connected to the September arrest. Krebs reports: "In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p" (Krebs on Security, 2026-09-28). Multiple sources cited by Krebs describe a teenage cybercriminal known as "Rey," who operates as part of a collective calling itself ScatteredLapsussHunters, as having taken effective control of ShinyHunters' operations and driven what they call "a major pivot away from the more measured tenor of the hacking gang's operations", toward high-risk targets including the FBI and Cl0p; sources say the FBI defacement reused artwork associated with the arrested suspect, possibly to pin the FBI intrusion on him rather than on the group's current operators. CyberScoop separately quotes DiMaggio's independent assessment that "ShinyHunters" today operates as a criminal brand used by a fluid network rather than a single fixed group, corroborating the brand-fragmentation picture without itself confirming the ScatteredLapsussHunters/Rey narrative (CyberScoop, 2026-09-28).

FBI cybersecurity chief Brett Leatherman gave Nextgov/FCW the bureau's clearest account of the cause so far: "the incident occurred as the result of a security failure of a platform managed by a third-party organization", because "a contractor failed to implement a security patch explicitly issued to secure the platform", and the FBI has removed the contractor (Nextgov/FCW, 2026-10-06). A person with knowledge of the matter told Nextgov/FCW that Accenture is responsible for software patch management and maintaining custom code at the FBI, and that Oracle, whose PeopleSoft platform ShinyHunters claimed as the initial access point, provided the security patches that were not integrated (Nextgov/FCW, 2026-10-06). SecurityWeek, citing Reuters' sources, says the system is Oracle's PeopleSoft human resources platform and the outside organization is Accenture; Accenture did not answer questions about the patching failure and said only that it is proud to support the mission of the FBI (SecurityWeek, 2026-10-06).

This replaces the FBI's statement of 2026-09-23 that the point of breach, a third party or its own enterprise, was undetermined: the failure is now placed at a third-party-managed platform. The FBI's statement names neither the product, the contractor nor a CVE, and Nextgov/FCW notes it does not say why the patch was missed (Nextgov/FCW, 2026-10-06). The link to CVE-2026-35273 stays ShinyHunters' account, given to BleepingComputer (BleepingComputer, 2026-09-26).

Nextgov/FCW relays Reuters' report of 2026-10-03 that a suspected ShinyHunters member had been detained in Jordan and was helping investigators (Nextgov/FCW, 2026-10-06). SecurityWeek says this is the member known as Rey (SecurityWeek, 2026-10-06). An FBI spokesperson told The Register on 2026-10-05 that the bureau has "already worked with partners to arrest multiple subjects" while declining to comment on specific arrests (The Register, 2026-10-05). SecurityWeek adds that a post urging organizations to pay has been removed from the group's site while its most recent victim post is dated 2026-09-22 (SecurityWeek, 2026-10-06).

The initial-access vector that was attacker-asserted yesterday now has a CVE: Oracle assigned CVE-2026-35273 (CVSS 9.8), an unauthenticated RCE in the PeopleTools Environment Management Hub (PSEMHUB, versions 8.61/8.62), and published an out-of-band Security Alert (Oracle, 2026-06-10), with a patch Rapid7 tells PeopleTools 8.61 and 8.62 customers to apply on an emergency basis (Rapid7, 2026-06-12).

Mandiant GTIG formally attributes the campaign to UNC6240 (ShinyHunters), dating exploitation 27 May – 9 June, a zero-day for the full window, and details the post-exploitation chain: customised MeshCentral remote-management agents masquerading as Microsoft Azure components for persistence and C2, and a per-victim _fanout.sh lateral-movement script spraying SSH credentials against internal hosts harvested from /etc/hosts (T1190, T1021.004). Mandiant notified more than 100 organisations with exposed PSEMHUB endpoints; 68 % are higher-education institutions (Mandiant GTIG, 2026-06-11).

At the University of Nottingham, ShinyHunters claims over 40 GB of student finance, billing and payment data, including data from the Malaysia and China campuses, and Have I Been Pwned's analysis of the partly published data counts about 455,000 unique email addresses with names, addresses, phone numbers, ethnicities, disabilities, passport numbers and fee-payment information; the university has reported the incident to Action Fraud and the Information Commissioner's Office (BleepingComputer, 2026-06-11; The Record, 2026-06-11; University of Nottingham, 2026-06-10). Action: patch out-of-band and compromise-assess; yesterday's hardening guidance (default SSH service accounts, PSEMHUB exposure) stands.

Mandiant and Google GTIG formally attribute the PeopleSoft Environment Management Hub exploitation campaign to UNC6240 (ShinyHunters) and confirm the activity ran from 27 May to 9 June 2026, predating Oracle's 10 June out-of-band advisory, establishing CVE-2026-35273 (CVSS 9.8) as a zero-day at time of exploitation (Mandiant/GTIG, 2026-06-11). The unauthenticated SSRF→RCE is reached via the /PSEMHUB/hub and /PSIGW/HttpListeningConnector endpoints in PeopleTools 8.61/8.62.

GTIG notified over 100 organisations whose endpoints correlated with exploitation; 68% are higher-education institutions. Post-exploitation, the actor deployed MeshCentral remote-management agents disguised as Azure binaries, used SSH fan-out scripts with PeopleSoft admin credentials for lateral movement, and exfiltrated to the ShinyHunters leak site (Rapid7, 2026-06-12). Have I Been Pwned's analysis of the leaked data puts the affected University of Nottingham students and alumni at 454,600, with passport numbers among the exposed fields (BleepingComputer, 2026-06-11); the university confirmed that data in its student-record system was accessed (University of Nottingham). CISA added the CVE to KEV on 12 June. Swiss and EU universities running Campus Solutions should treat it as a priority.

ShinyHunters listed the Council of Europe (the 46-member human-rights body), claiming 297 GB across ~429,000 files, and set a 16 June leak deadline (SecurityWeek, 2026-06-15); The Register reports the listing as part of ShinyHunters' PeopleSoft campaign (The Register, 2026-06-15). This brings a European intergovernmental institution into the 100+-organisation PeopleSoft campaign previously covered as an education-sector wave.

The claimed dataset spans payroll for 10,000+ current and former staff (2011–2026), 14,000+ CVs, and HR records with names, dates of birth, addresses, bank-account, tax/social-security and medical data. The Council of Europe confirmed it "is currently investigating the matter and assessing the situation" and has not confirmed exfiltration (The Register, 2026-06-15; BleepingComputer, 2026-06-15). The vector, unauthenticated HTTP to the /PSEMHUB/hub servlet (T1190), is unchanged; investigate any externally reachable PeopleSoft Environment Management Hub for compromise and block perimeter access to /PSEMHUB/*. Confidence on the victim claim is MEDIUM pending Council of Europe confirmation (extortion-site claim).

Mandiant and GTIG report that UNC6240 (ShinyHunters) has resumed mass exploitation of CVE-2026-35273, adapting to the defensive guidance published after the June wave. The actor now bypasses WAF rules that block the literal /PSEMHUB/ path by requesting the URL-encoded /%50SEMHUB/ instead: many WAFs and reverse proxies match the request path before decoding it, while the PeopleSoft application server decodes and routes the request normally. "This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure" (Mandiant/GTIG, 2026-09-25). Mandiant warns the actor may rotate to other percent-encoded, mixed-case or otherwise non-normalized path variants, so defenders should block on the normalized path rather than the literal string.

Before exploiting a target, the actor sends five to fifteen POST requests carrying a serialized Java object to quietly confirm exploitability without writing files or disrupting the service. Two complementary single-line JSP web shells are then dropped into the PSEMHUB.war directory: x.jsp executes hex-encoded commands cross-platform, and u.jsp/u2.jsp upload larger files in 150 KB Base64-encoded chunks, bypassing PeopleSoft's own file-size limits; a fileless variant returns command output directly in the HTTP response with nothing written to disk, defeating file-creation-based detection. On compromised Windows hosts, the actor uploads a trojanized installer, Ple64.exe, masquerading as a signed Light Alloy media-player installer and signed with a valid Extended Validation certificate Mandiant has asked the issuing certificate authority to revoke; it loads a VMProtect-3-packed multi-stage chain culminating in the SIDEEYE C++ backdoor, which steals browser and desktop credentials, manages processes and files, and provides an interactive reverse shell and reverse proxy over raw TCP. The actor also deploys the open-source Neo-reGeorg tunneling toolkit to route SOCKS5 proxy traffic over ordinary HTTP/S for internal lateral movement, and uses the legitimate MeshAgent/MeshCentral remote-management platform to maintain access on Linux hosts. "Across compromised instances, a quarter of the threat actor's commands executed as root or NT Authority\SYSTEM, granting full control of the operating system" (Mandiant/GTIG, 2026-09-25).

Targeting has expanded well beyond the original higher-education skew: "Google says the new wave of attacks has deployed web shells on dozens of systems worldwide within higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations" (BleepingComputer, 2026-09-26), and Mandiant's report names government among the sectors this wave has hit alongside the Council of Europe, which ShinyHunters listed in June and which said it was investigating. Mandiant's remediation guidance is unchanged in substance but sharper: apply the Oracle Security Alert and stay on a supported PeopleTools release rather than relying on a WAF at all; disable EMHub or remove PSEMHUB if not needed, since neither is required for standard PeopleSoft Internet Architecture user sessions; search WebLogic access logs for requests to /PSEMHUB/ and its encoded variants and for POST requests to /hub with external-source bodies; and, on any host where a web shell is found, treat it as compromised, preserve evidence, and rotate every credential reachable from the PeopleSoft tier, prioritising hosts where WebLogic runs as root or SYSTEM.

This wave also clarifies part of a separately-tracked claim: ShinyHunters told BleepingComputer it used this same WAF-bypass technique against the FBI's own recruitment site, alongside a further, still-unconfirmed vulnerability it says it also exploited there.

Nissan disclosed that current and former employees' data was exposed via CVE-2026-35273, the Oracle PeopleSoft PeopleTools pre-auth flaw exploited as a zero-day between 2026-05-27 and 2026-06-09 as part of the wider ShinyHunters campaign (SecurityWeek, 2026-06-30). The exposure spans current and former employees in the US, Canada, Mexico and Brazil, potentially including Social Security numbers, banking/direct-deposit information and tax records.

This is a materially different victim profile from the previously-covered NAIC breach (employee HR/payroll PII rather than regulatory data) showing the campaign spreading across both regulatory-body and corporate-HR PeopleSoft deployments. As mitigation, Nissan restricted pay-slip viewing and direct-deposit changes to company-network/VPN-authenticated sessions and is offering credit/dark-web monitoring (BleepingComputer, 2026-06-29). ShinyHunters' self-reported scale of "over 300 PeopleSoft instances across ~100 organizations" is an unverified actor claim, attribute the claim, not confirmed fact. No new technical detail beyond victim-count expansion; the operative guidance from the 2026-06-28 NAIC item stands (patch CVE-2026-35273; remove internet-exposed PeopleSoft PeopleTools from public reachability).