The notorious threat group ShinyHunters has escalated its campaign of high-impact data theft by exploiting a zero-day vulnerability in Oracle PeopleSoft, successfully breaching hundreds of organizations and exfiltrating gigabytes of sensitive data. According to incident response firm Mandiant, the attackers leveraged a previously unknown flaw, tracked as CVE-2026-35273, to gain initial access to PeopleSoft environments. While some targeted organizations managed to block the activity or remediate the vulnerabilities, many others suffered full compromise, resulting in stolen data being published on the ShinyHunters data leak site (DLS).
Anatomy of the PeopleSoft Zero-Day Attack
Mandiant’s forensic analysis of a bash script left behind in a compromised staging environment reveals a methodical and highly targeted operation. After exploiting the zero-day to gain a foothold, the attackers conducted extensive reconnaissance. This included mapping PeopleSoft configurations, reviewing process scheduler settings, and examining WebLogic server XML configurations. The threat actors then established an outbound SSH connection to the IP address 176.120.22.24, which hosts the ShinyHunters DLS. Before exfiltration, stolen data was compressed using the zstd tool to maximize the volume of information that could be transferred. In one confirmed instance, the DLS claimed to have recovered 48GB of data from a single victim.
ShinyHunters: A Persistent and Versatile Threat
Active since at least 2019, ShinyHunters has established itself as one of the most prolific data extortion groups operating today. The group’s victimology reads like a who’s who of global enterprise, including Ticketmaster (via a breach of Snowflake), Spain’s largest bank Santander, and Salesforce—which in turn led to data exposure for Google and numerous other companies. ShinyHunters employs a diverse arsenal of initial access techniques, including exploiting cloud misconfigurations, software vulnerabilities, stealing OAuth tokens, supply chain attacks, and voice phishing. The exploitation of CVE-2026-35273 represents a significant addition to their capabilities, targeting a widely deployed enterprise resource planning system.
What Is CVE-2026-35273 and Who Is Affected?
CVE-2026-35273 is a zero-day vulnerability in Oracle PeopleSoft, a popular suite of enterprise software used by large organizations for human resources, finance, and supply chain management. The flaw allows an unauthenticated attacker to remotely compromise a vulnerable PeopleSoft server. Any organization running an unpatched version of PeopleSoft is potentially at risk. Given the critical nature of the data typically managed by these systems—including employee records, payroll information, and financial data—the impact of a successful breach can be severe.
Immediate Guidance for PeopleSoft Customers
Mandiant and security firm Rapid7 have released detailed indicators of compromise (IOCs) and are actively advising PeopleSoft customers on urgent remediation steps. Given ShinyHunters’ demonstrated success rate, all organizations running PeopleSoft should treat this threat with the highest priority. The primary recommendation is to immediately apply the security patch provided by Oracle for CVE-2026-35273. In addition, organizations should audit all outbound SSH connections from their PeopleSoft environments, review WebLogic and process scheduler configurations for unauthorized changes, and monitor for the use of the zstd compression tool on application servers.
What Affected Organizations Should Do Now
For any organization using Oracle PeopleSoft, the window for proactive defense is closing. The first and most critical step is to patch the CVE-2026-35273 vulnerability without delay. Beyond patching, security teams should conduct a thorough forensic review of their PeopleSoft environments for signs of the specific reconnaissance activities described by Mandiant. This includes checking for unusual outbound SSH connections to unknown IP addresses and scanning for the presence of unexpected bash scripts or the zstd binary. For organizations that suspect they may have been compromised, engaging a reputable incident response firm is essential to contain the breach, assess the scope of data exfiltration, and begin notification procedures. Implementing a multi-layered endpoint protection solution and enforcing strict network segmentation for critical enterprise applications can help mitigate the risk of similar attacks in the future.
