ShinyHunters Resumes PeopleSoft Exploitation Amid Dutch Arrest

ShinyHunters is again exploiting Oracle PeopleSoft CVE-2026-35273, including a claimed FBI jobs-site breach, as Dutch police hold a suspect.

Google Cloud and Mandiant say ShinyHunters, also tracked as UNC6240, has resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273, used as a zero-day from May 27 to June 9 before Oracle’s June 10 patch. Attackers URL-encode the PSEMHUB path to bypass web-application firewalls, including at organizations that used published workarounds but not the patch, and have placed web shells on dozens of systems across higher education, technology, healthcare, government, agriculture, transport and other sectors. Follow-on tools are described differently: one report names the SIDEEYE credential-stealing backdoor and Neo-reGeorg tunneling, while another names the MeshAgent remote-management tool and fileless execution. ShinyHunters claimed a breach of FBI job site apply.fbijobs.gov that left applicant portals offline; sources disagree on scale, citing more than 5,000 staff with Social Security numbers and medical files, tens of thousands of personnel and medical records, or terabytes of data, and the group sought retraction of an FBI advisory rather than a ransom. Dutch police arrested an Amsterdam man reporters identify as Pepijn van der Stap, alias Umbreon, previously convicted in 2023; outlets disagree on whether he is 23 or 24 and whether the arrest was September 15 or 16, with a Rotterdam District Court date of September 29, 2026. Separate reporting links the group to an Odido breach of 6.2 million people and to extortion of Cl0p.