By Dharmesh Prajapati

A coordinated cyber-espionage and data extortion campaign has been uncovered targeting Oracle’s PeopleSoft enterprise resource planning (ERP) software. Jointly investigated by Alphabet’s cybersecurity unit, Mandiant, and the Google Threat Intelligence Group (TAG), the campaign actively weaponized a zero-day vulnerability between May 27 and June 9, 2026.

The threat actors behind the intrusion have been identified as ShinyHunters, a well-known financially motivated cybercriminal syndicate with a history of high-profile data theft and corporate extortion.

Technical Analysis of the Attack Vector

The primary target of the campaign, Oracle PeopleSoft, is a critical enterprise suite utilized by organizations to manage human resources (HRMS), financial management, and supply-chain operations. Because these deployments house massive repositories of Personally Identifiable Information (PII) and financial records, they represent high-value targets for extortion.

[Attacker: ShinyHunters] ────► [Exploits PeopleSoft Zero-Day]
                                       │
                                       ▼
[Establishes Persistence] ◄──── [Deploys Masked MeshCentral Agent]
         │
         ▼
[Executes Privileged Commands & Exfiltrates Data]

Exploitation Timeline and Zero-Day Status

The attackers identified and exploited the underlying vulnerability prior to public disclosure or patch availability, classifying the flaw as a zero-day.

• May 27 – June 9, 2026: Active exploitation window observed by Google TAG and Mandiant.
• June 10, 2026: Oracle officially issued an emergency security advisory and accompanying patch.

Because the initial access vector bypassed standard signature-based intrusion detection systems (IDS), the threat actors maintained unhindered lateral movement capabilities across affected subnets for nearly two weeks.

Persistence Mechanism: Masked MeshCentral Agents

Once initial access to the PeopleSoft environment was achieved, researchers found that ShinyHunters established persistent command-and-control (C2) infrastructure using customized MeshCentral agents.

MeshCentral is an open-source, remote computer management web app. The attackers deliberately modified these agents to mimic legitimate, authorized cloud endpoints within the enterprise network topology. By blending into standard administrative traffic, the attackers successfully executed privileged administrative command queries, mapped internal database schemas, and prepared data payloads for exfiltration while evading traditional Endpoint Detection and Response (EDR) anomalies.

Sector Impaction and Demographics

Upon detecting the active scanning and exploitation telemetry, Google notified over 100 organizations displaying vulnerable public-facing endpoints. Threat intelligence metrics indicate a highly specific targeting profile:

Target Sector Distribution (Mandiant/Google TAG Data)
======================================================
Higher Education Sector   [████████████████] 68%
Other Enterprise/Gov      [███████] 32%

The majority of the compromised or targeted infrastructure was localized within the United States. The heavy concentration on higher education institutions aligns with ShinyHunters’ recent operational shift; the group recently finalized an extortion agreement with Instructure (the parent company of the Canvas learning management system) following a separate breach involving student and institutional data assets.

Mitigation and Incident Response Protocol

With Oracle having released a security advisory on June 10, 2026, immediate remediation is required for all network administrators managing PeopleSoft deployments:

1. Patch Deployment: Immediately apply the security updates outlined in the June 10 Oracle Advisory to close the zero-day exploit path.
2. Audit Remote Management Tools: Scan network environments for unauthorized instances of MeshCentral or related remote administrative binaries, paying close attention to outbound connections mimicking legitimate cloud services.
3. Log Analysis: Review PeopleSoft application logs from May 27, 2026, onward for anomalous administrative command execution or unusual database query volumes.

Connect with Dharmesh Prajapati

+91 7359585035 Call / WhatsApp

Website: ambeinfotech.com

Read more on newsforyou.live