Executive Summary
Since June 2026, the ShinyHunters extortion gang has been actively targeting Oracle PeopleSoft servers, claiming to have successfully breached over 300 instances across more than 100 organizations. The campaign primarily impacts the education sector, including confirmed victims such as Nottingham University. The threat actor leverages a combination of legacy vulnerabilities and a critical zero-day (CVE-2026-35273) to achieve remote code execution and initial access.
Technically, the actor utilizes a "gadget chain" for exploitation followed by credential spraying and the deployment of MeshCentral agents for persistence. Once inside, they use automated shell scripts to identify internal PeopleSoft systems via /etc/hosts and drop ransom notes. This campaign presents a significant risk to enterprise operations, as PeopleSoft manages sensitive HR, financial, and student data; organizations are urged to patch immediately and review logs for specific indicators of compromise.