UNC6240

Search everything

Mentions · 7d0
Mentions · 30d2
All mentions8
First seenSep 25, 2026
Last mentioned14d ago

Timeline

8 articles · newest first

ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273

Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.

The Hacker NewsOct 28, 06:04 UTC · 14d agoExploit / PoCExploitedCVE-2026-352731

Flare says Scattered Spider, LAPSUS$ and ShinyHunters are separate clusters

Shared branding does not prove one gang; Flare treats original LAPSUS$ as defunct after September 2022.

GBHackersOct 21, 08:21 UTC · 21d agoThreat actor2

ShinyHunters Bypasses WAF Protections to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

ShinyHunters resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273, bypassing WAFs via percent-encoded paths and deploying web shells and the SIDEEYE backdoor.

Cyber Security Newsupdated Sep 28, 13:56 UTC · Sep 28, 2026first Sep 28, 13:46 UTC · Sep 28, 2026Exploit / PoCExploited2 sourcesCVE-2026-352731 · 1 read

Oracle PeopleSoft Servers Targeted Again as ShinyHunters Expands Extortion Operations

ShinyHunters-linked UNC6240 is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF path filters for extortion.

GBHackersSep 28, 11:36 UTC · Sep 28, 2026Threat actorExploitedCVE-2026-352732 · 1 read

Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign

ShinyHunters (UNC6240) resumed mass-exploiting Oracle PeopleSoft via a WAF-bypassing variant of CVE-2026-35273, deploying web shells and SideEye to extort victims.

SecurityWeekSep 28, 10:56 UTC · Sep 28, 2026Threat actorExploitedCVE-2026-352734 · 1 read

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

ShinyHunters bypasses WAF rules blocking PeopleSoft CVE-2026-35273 via percent-encoding, resuming RCE attacks deploying web shells and SIDEEYE backdoors.

BleepingComputerSep 26, 19:03 UTC · Sep 26, 2026Exploit / PoCExploitedCVE-2026-352734 · 2 reads

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

UNC6240 bypasses WAFs to mass-exploit Oracle PeopleSoft CVE-2026-35273 and deploy web shells and SIDEEYE.

The Hacker NewsSep 26, 11:46 UTC · Sep 26, 2026Exploit / PoCExploitedCVE-2026-352735 · 2 reads

ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF rules to plant web shells.

Google Threat IntelligenceSep 25, 14:00 UTC · Sep 25, 2026Threat actorExploitedCVE-2026-352733

Related CVEs

by mentions

CVE-2026-3527397%9.8
Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
published Jun 11, 2026Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management component)KEVRansomwarePoC

Appears with

ShinyHuntersthreat actor · 8
Mandiantorganization · 6
Oracleorganization · 4
Oraclevendor · 4
Googleorganization · 3
Google Threat Intelligence Grouporganization · 3
PeopleSoftproduct · 2
SIDEEYEmalware · 2
CISAorganization · 2
Neo-reGeorgmalware · 2
FBIorganization · 2
Environment Management Hubproduct · 2
WebLogicproduct · 2
Scattered Spiderthreat actor · 1
Integration Gatewayproduct · 1
PeopleToolsproduct · 1

Entities are extracted by the model from each article. First seen Sep 25, 2026, last mentioned 14d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.