🏴☠️ ShinyHunters¶
Threat-actor battle card · maintained from public sources · last updated 2026-06-24 · also known as UNC6240, "Scattered Lapsus$ Hunters" (claimed collective branding)
Overview¶
ShinyHunters (tracked by Mandiant/Google Threat Intelligence as UNC6240) is a long-running, financially motivated data-theft extortion brand active since 2020, historically known for selling and leaking large databases on cybercrime forums (BreachForums lineage). In 2025-26 it shifted from forum sales to named, deadline-driven extortion via its own data-leak site, and into operator-grade intrusion — most notably exploiting an Oracle PeopleSoft zero-day at scale. It is one of the brands marketed under the "Scattered Lapsus$ Hunters" collective banner alongside Scattered Spider and Lapsus$-adjacent actors, though the exact membership overlap is unconfirmed.
Tradecraft¶
- Mass zero-day exploitation (2026): Exploited CVE-2026-35273 (CVSS 9.8, unauthenticated RCE in Oracle PeopleSoft Enterprise PeopleTools Environment Management) as a zero-day between May 27 and June 9, 2026 — predating Oracle's June 10 out-of-band advisory. Targeted
/PSEMHUB/huband/PSIGW/HttpListeningConnectorendpoints. - C2 / RAT: Deployed MeshCentral agents masquerading as Microsoft Azure NetApp Files (
azurenetfiles.net, WebSocket Secure over 443); custom-signedmeshagent*-azure-opsbinaries. - Lateral movement: Custom
[victim]_fanout.shSSH credential-spraying script reading/etc/hosts, trying hardcoded admin/app credentials, and dropping aREADME-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXTdefacement marker into WebLogic/Process Scheduler directories. - Exfiltration:
zstdcompression of staged data, then publication on the ShinyHunters DLS. - Social-engineering / CRM theft: Separately associated with the 2025-26 wave of Salesforce / OAuth data-theft extortion (voice-phishing, malicious connected-apps, third-party integration abuse) hitting dozens of enterprises.
Notable victims¶
- Oracle PeopleSoft campaign (2026) — Mandiant notified 100+ organisations with vulnerable endpoints; 68% higher education, mostly US. University of Nottingham is the first confirmed victim; data published on the ShinyHunters DLS from June 9, 2026. Google Threat Intelligence · SecurityWeek
- Carnival Corporation — 5,995,277 individuals (Holland America Mariner Society loyalty programme); names, DOB, address, passport and driver's-license numbers; social-engineering of a Carnival employee April 14, 2026; notifications dated May 27, 2026. BleepingComputer
- University of Nottingham — 40GB+ billing/payment-card/student-finance data claimed; university confirmed the incident June 11, 2026. The Record
Assessment¶
ShinyHunters has matured from a data broker into a capable intrusion operator: the PeopleSoft campaign shows it can find, weaponise, and scale a high-value enterprise zero-day faster than the vendor can patch — the same opportunistic mass-extortion model practised by Cl0p, now applied to ERP/HR platforms. Its concentration on higher education reflects the sector's large attack surface of internet-exposed PeopleSoft HR/finance systems and constrained patch cadence. The brand's overlap with the Scattered Spider / Lapsus$ "Com" ecosystem makes attribution fluid and capability-sharing likely. Structural mitigation: remove internet exposure of PeopleSoft PSEMHUB/integration gateways, patch CVE-2026-35273 on emergency timelines, and treat any unpatched, exposed PeopleSoft instance as presumed-compromised. For Salesforce/CRM exposure, enforce phishing-resistant MFA and audit third-party connected-app OAuth scopes.
Sources¶
- Google Threat Intelligence — ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
- SecurityWeek — Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters
- The Hacker News — ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273)
- Rapid7 — Active Exploitation of Oracle PeopleSoft Zero-Day CVE-2026-35273
- BleepingComputer — Carnival Cruise Confirms Data Breach Affecting Nearly 6 Million People
🗂️ Attacks & victims¶
All disclosed victims attributed to this actor, newest first.
June 2026
May 2026