Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Threat Actors
Excerpt
Introduction Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and June 9, 2026 and is consistent with the exploitation of CVE-2026-35273 , a critical remote code execution vulnerability (CVSS 9.8) in the Environment Management component. The exploitation of this…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc | Medium | Score 43/100 | First seen |
| SHA256 | c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f | High | Score 74/100 | First seen |
| SHA256 | 2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35 | Medium | Score 43/100 | First seen |
| CVE | CVE-2026-35273 | High | Score 80/100 | First seen |
| SHA256 | d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f | High | Score 63/100 | First seen |
| SHA256 | 68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309 | Medium | Score 43/100 | First seen |
| SHA256 | 50ac0ffbc9ecf4559949faa026a412c9bb57e81d3ae0714a4dcd25b4fec35105 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…