kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

unc6240

also tracked as shinyhunters 2

2 stories · 2 in the wild · September 26, 2026 – September 27, 2026

evidence: 2 observed

sectors

  • government 2 · Sep 27
  • education 1 · Sep 27
  • healthcare 1 · Sep 27
  • technology 1 · Sep 27
  • transport 1 · Sep 27

techniques

  • rce 1 · Sep 27
  • waf bypass 1 · Sep 27
  • auth bypass 1 · Sep 26

attack phases seen

  • Initial access 2 · Sep 27
  • Execution 1 · Sep 27

what we reported, newest first, grouped by story

Aug 27 – September 27, 2026 · 2 reports

  • ShinyHunters (UNC6240) resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273 with a one-character WAF bypass: requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAF and reverse-proxy rules match the literal path before URL decoding while the PeopleSoft app server decodes and routes to the vulnerable servlet — meaning operators who believed their WAF rules mitigated exposure are still reachable. Mandiant/GTIG report web shells on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation and government, and stress WAF rules are not a substitute for the June out-of-band patch. Hunt for percent-encoded variants in PIA WebLogic access logs and inspect PSEMHUB.war/ for x.jsp, u.jsp, tunnel.jsp, tunnel.jspx and Ple64.exe — the last signed with a valid EV certificate via Sectigo (Google Cloud, BleepingComputer). (earlier coverage) · Sep 27 · observed · as shinyhunters · Threat Activity
  • ShinyHunters (UNC6240) has resumed mass exploitation of CVE-2026-35273, the unauthenticated RCE in Oracle PeopleSoft PeopleTools (CVSS 9.8, emergency patch 10 June), with a summary of Mandiant/Google Threat Intelligence findings saying the new wave specifically targets organisations that deployed WAF rules as mitigation but never installed the patch — and bypasses those rules trivially (@DarkWebInformer). The group separately told The Register it hacked the FBI to "protect our business" (The Register). · Sep 26 · observed · as shinyhunters · Emergency Advisories & Active Exploitation