Overview
- Security teams at Mandiant and Google Threat Intelligence Group linked active compromises to the ShinyHunters extortion group and notified more than 100 organizations about potentially vulnerable PeopleSoft endpoints.
- Researchers dated the campaign between May 27 and June 9 and say attackers exploited CVE-2026-35273 as a zero-day to gain remote code execution against PeopleTools versions 8.61 and 8.62.
- Investigators recovered attacker staging infrastructure that included customized MeshCentral agents, a credential‑spray and propagation script that planted a ransom marker file, and IOCs such as several exposed IPs and the azurenetfiles.net domain.
- Oracle issued an out‑of‑band security advisory and emergency mitigations for CVE-2026-35273 but full patches were not widely available at the time of reporting and organizations are urged to immediately block or disable PSEMHUB and related endpoints.
- At least one major victim, the University of Nottingham, confirmed a breach and researchers indexed roughly 455,000 exposed email addresses, raising risks of identity fraud, regulatory fallout, and further extortion for affected students and staff.