Google’s security researchers say attackers bypassed firewall protections and compromised dozens of systems across multiple industries.
The ShinyHunters hacking group has renewed a mass-exploitation campaign against unpatched Oracle PeopleSoft systems, according to Google’s Mandiant and Threat Intelligence Group.
In a September 25 report, researchers said the attackers deployed web shells on dozens of systems worldwide. The affected sectors included higher education, healthcare, technology, IT services, agriculture, transportation and government. Web shells can give attackers continuing access to compromised servers.
The campaign exploits CVE-2026-35273, a vulnerability in PeopleSoft’s Environment Management Hub. Researchers attributed the activity to UNC6240, the threat group they identify as ShinyHunters.
The vulnerability had already featured in an earlier compromise and extortion campaign. Mandiant’s June investigation documented attacks between May 27 and June 9, initially concentrated on academic institutions. At that stage, attackers were exploiting a zero-day vulnerability—a flaw for which a patch was not yet available.
The renewed campaign demonstrates how attackers can adapt after defenders introduce temporary protections. According to Mandiant, ShinyHunters modified requests to evade certain web application firewall rules, reaching vulnerable systems whose operators had implemented filtering without installing Oracle’s patch.
The report describes a bypass of those protective rules, rather than a defeat of the underlying software fix.
That distinction is important for organizations responding to newly disclosed vulnerabilities. A firewall can screen incoming traffic, but it does not remove a flaw inside an application. Its effectiveness depends on recognizing and blocking the relevant requests.
Patching and investigating a possible intrusion also serve different purposes. Installing an update addresses the vulnerable entry point; it does not establish whether an attacker previously entered or left behind another means of access.
Mandiant urges affected organizations to apply Oracle’s security patch, follow guidance on disabling or removing the vulnerable service, inspect systems for compromise and rotate potentially exposed credentials.
The broader lesson is operational: emergency protections need an owner, a review process and a deadline for permanent remediation. Otherwise, a measure introduced to buy time can become a lasting dependency.
For PeopleSoft operators, the immediate question is whether the underlying vulnerability has actually been fixed. The campaign shows the consequences of treating temporary filtering as the end of the response.
Sources:
