Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionageThreat Actor
Active Threat
UNC6240
22
IOCs Tracked
4
Intel Reports
Associated IOCs22 total
IP3
162.219.30.165
2026-10-09High104.219.234.1382026-10-09Medium5.199.162.157
2026-10-09MediumDomain6
azurenetfiles.net2026-10-09Highjava.io2026-10-09High
enroll.azuredevice.cloud2026-10-09High
entra.net2026-10-09High
winmanage-me.network2026-10-09High
os.name2026-10-09High
SHA25612
ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e072026-10-09High
3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c32026-10-09High
419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c862026-10-09High
c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f
2026-10-09High48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe4942026-10-09High
2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d72026-10-09High
d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f2026-10-09High50ac0ffbc9ecf4559949faa026a412c9bb57e81d3ae0714a4dcd25b4fec351052026-10-09Medium
23dd0be8f55d6ab7e425806a1a02847a8898bdfe0b7e9c1745e558240147532b2026-10-09Medium
68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc3092026-10-09Medium
2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a352026-10-09Medium
f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc2026-10-09Medium
CVE1
CVE-2026-352732026-10-09High
Related Reports4 total
Shinyhunters Renewed Mass Exploitation Campaign Targeting Oracle Peoplesoft
ORKL Threat Library
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Google Threat Intelligence (GTIG / Mandiant)Jun 11, 2026
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Google Threat Intelligence (GTIG / Mandiant)Sep 25, 2026
ShinyHunters Exploits Oracle PeopleSoft Vulnerability CVE-2026-35273 in New Attack Wave
Cyber PressSep 28, 2026
Threat Profile
Motivationespionage
Last seenOct 2026
IOCs tracked22