Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Threat Actors
Excerpt
Introduction As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit , Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. In June, the threat actor exploited this vulnerability as a zero-day predominantly against academic institutions. This new wave of activity stems from UNC6240…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3 | High | Score 86/100 | First seen |
| SHA256 | 48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494 | High | Score 65/100 | First seen |
| SHA256 | 419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86 | High | Score 86/100 | First seen |
| CVE | CVE-2026-35273 | High | Score 81/100 | First seen |
| SHA256 | 23dd0be8f55d6ab7e425806a1a02847a8898bdfe0b7e9c1745e558240147532b | Medium | Score 53/100 | First seen |
| SHA256 | 2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7 | High | Score 65/100 | First seen |
| SHA256 | ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07 | High | Score 86/100 | First seen |
| IP | 162.219.30.165 | High | Score 74/100 | First seen |
IOC Relationship Graph
Building graph…