CTI · reviewed · 2026-09-27

Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) — Mitigations Released, Mandiant/GTIG Confirm ShinyHunters Targeting 100+ Organizations, Primarily Higher Education

Full story & timeline

Actors

ShinyHunters

Malware / tools

—

Campaigns

ShinyHunters PeopleSoft exploitation

CVEs

CVE-2026-35273

Victim sectors

higher education

Geography

United States

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1505 Server Software Component Persistence
T1059 Command and Scripting Interpreter Execution
T1048 Exfiltration Over Alternative Protocol Exfiltration
T1078 Valid Accounts Stealth

Indicators

Observables tied to this case, from the curated feed. raw sidecar

cybersecurefox.com domain · active · corroborated

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: ShinyHunters PeopleSoft Extortion Note Dropped in WebLogic Directory
id: d00a5a7b-d803-4f51-b9fb-37f22d41c7f3
status: experimental
description: Detects creation of the README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT extortion note that ShinyHunters drops in WebLogic and PeopleSoft directories after exploiting CVE-2026-35273 and exfiltrating data.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/
  - https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/
  - https://www.oracle.com/security-alerts/alert-cve-2026-35273.html
author: Tia N. List
date: 2026/09/27
tags:
  - attack.t1190
  - attack.t1505
  - attack.initial-access
  - attack.persistence
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|contains: 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT'
  condition: selection
falsepositives:
  - Red team or exercise tooling that drops the same note filename
level: high