ShinyHunters - MeshCentral C2 Beaconing (UNC6240)
Detects DNS queries or outbound network connections to attacker-controlled MeshCentral remote-management command-and-control infrastructure used by the ShinyHunters threat actor during the Oracle PeopleSoft exploitation campaign reported by Mandiant in June 2026.
YARA-L
