ShinyHunters Rode a PeopleSoft Zero-Day Into University Networks

The attack window opened May 27. Oracle's advisory landed June 10. That thirteen-day gap is the whole story.

Google Cloud's threat intelligence group (GTIG) tracked a campaign it attributes to UNC6240 — a cluster linked to ShinyHunters — that exploited CVE-2026-35273 against internet-facing PeopleSoft deployments before Oracle had said a word publicly. The flaw lives in PeopleSoft's Environment Management component, scores 9.8 on the CVSS scale, and allows unauthenticated remote code execution. No authentication required. Just a reachable host.

Higher education bore most of the damage. Of the more than 100 organizations Google notified as potentially exposed, 68 percent were universities or other educational institutions. Some blocked the activity in time. Others didn't, and stolen data — ShinyHunters claimed over 40 GB including billing records, payment card details, and student finance exports — started appearing on the group's data leak site on June 9, one day before Oracle went public.

For persistence, UNC6240 deployed a customized build of MeshCentral, an open-source remote monitoring and management tool, dressed up to look like a legitimate Microsoft Azure service. The hardcoded command-and-control endpoint was wss://azurenetfiles.net:443/agent.ashx. Once that agent landed, operators had full remote command execution across Windows, Linux, and macOS hosts alike. Standard post-exploitation playbook, competently executed.

What made the investigation easier was the attackers' sloppiness with their own infrastructure. A researcher posting as @nahamike01 spotted exposed attacker directories revealing staging materials, MeshCentral agent builds, defacement scripts, and credential-spray tooling. Those directories sat across five sequential IP addresses — 142.11.200[.]186 through .190 — which became the campaign's primary indicators of compromise. Leaving your ops directory world-readable is the kind of mistake that turns a tight investigation into an afternoon.

Oracle's patch covers PeopleTools versions 8.61 and 8.62. Older versions get no mitigation; Oracle's advice is to upgrade first, then patch. GTIG's recommendations are the standard post-incident checklist: apply the fix, audit privileged access, enable comprehensive logging, and look hard for unauthorized MeshCentral installations.

One vendor executive called this a preview of "the new agentic world" for ERP attacks. That framing is more marketing than insight. CVE-2026-35273 is a pre-auth RCE against a decades-old enterprise platform — closer in spirit to a classic unpatched application server vulnerability than anything novel about AI agents. The real lesson is the same one it always is: internet-exposed legacy ERP systems with a multi-week patch lag are a target, regardless of what you call the era.