Executive Summary
Between May 27 and June 9, 2026, the threat actor UNC6240 (ShinyHunters) conducted a global campaign targeting Oracle PeopleSoft environments. The group exploited CVE-2026-35273, a critical remote code execution vulnerability in the Environment Management component, as a zero-day. Over 100 organizations were identified as potential targets, with 68% residing in the higher education sector.
The attackers utilized staging infrastructure hosting customized MeshCentral agents masquerading as legitimate Microsoft Azure services to maintain persistence and execute administrative commands. This activity resulted in data breaches and subsequent extortion attempts, with stolen data being published on the ShinyHunters Data Leak Site (DLS).
Organizations running Oracle PeopleSoft are urged to apply the June 10, 2026 security updates immediately. The impact is significant for academic institutions, where large-scale data exfiltration and defacement have already been confirmed.