The hacking group ShinyHunters has resumed large-scale attacks against organizations running Oracle PeopleSoft software. According to Google’s cybersecurity unit, Mandiant, the group has developed a new method to bypass security measures that were implemented after an earlier wave of intrusions.
Attackers Change Tactics to Slip Past Defenses
Mandiant reports that ShinyHunters is again exploiting a vulnerability in PeopleSoft’s Environment Management feature, tracked as CVE-2026-35273. The initial attacks occurred between May 27 and June 9, primarily targeting universities. Oracle issued a security alert on June 10 after the activity came to light.
Since then, the attackers have changed their approach. Many organizations had deployed firewall rules to block direct access to the vulnerable path, known as PSEMHUB. To bypass these rules, ShinyHunters uses an encoding trick to obscure part of the request, allowing them to reach the same weak point on systems that had firewall protection but had not yet applied Oracle’s patch.
This latest campaign is no longer limited to educational institutions. Mandiant observed attacks against organizations in technology, healthcare, agriculture, transport, government, and IT services.
Web Shells Used to Maintain Access
In the renewed attacks, ShinyHunters installed web shells on compromised systems. These tools allow attackers to retain control and move laterally within a network. Mandiant also noted signs that the group attempted to remain undetected while exploring affected environments.
Mitigation Steps for Organizations
Google is urging all companies running PeopleSoft to apply Oracle’s official patch rather than relying solely on firewall rules. Mandiant also recommends the following actions:
- Disable the Environment Management Hub when it is not in use.
- Review WebLogic access logs for suspicious activity.
- Scan PeopleSoft servers for unusual files or unexpected web shells.
- Audit existing security controls and close any gaps in patching.
Investigation and Impact
PeopleSoft is widely used for human resources and other core business operations, making any vulnerability a serious risk because it can expose sensitive employee and company data. ShinyHunters has claimed it accessed data linked to the FBI through this same flaw. Reuters reported that the FBI is investigating the claim but has not confirmed it.
Security teams managing PeopleSoft systems are advised to act quickly: apply the patch, review existing defenses, and check for signs that attackers may already be inside their networks.