Sol Threat Intelligence

June 2026
Higher Education
Regional Sector Brief

1 Jun to 30 Jun 20263 regions4 pages per regionPrepared by Kaartheeswaran Ravichandran

A futuristic university knowledge citadel under a digital breach

Americas

Executive Summary

Higher education was the primary victim concentration in the PeopleSoft campaign

Americas higher education had the strongest sector-region evidence in the source set. More than 100 organizations were targeted through CVE-2026-35273 and 68 percent were reported as U.S. higher education institutions. The campaign operated as a zero-day from 27 May through 9 June, with victim data published on 9 June and Oracle issuing its advisory on 10 June. This was a systematic mass-exploitation event against a shared university ERP platform, not an isolated breach.

Key Insights

About 68 percent of more than 100 targets were U.S. higher education institutions, making American universities the principal victim concentration.

PeopleSoft Campus Solutions, HCM and Financials created a common attack surface across universities and colleges.

ShinyHunters used a custom fan-out script to spray SSH credentials and move across internal PeopleSoft nodes.

Canvas, Okta, Microsoft 365 and Salesforce formed parallel supply chain and identity attack surfaces.

AI vishing targeted helpdesk processes and real-time MFA interception through malicious connected-app approvals.

The United States also carried the highest ransomware victim share globally across June, increasing the secondary opportunistic threat to universities.

Top threat entities and June trend shifts

ShinyHunters, UNC6240Primary actor

Mass exploitation of PeopleSoft, cloud data theft, AI vishing and insider recruitment against university environments.

Oracle PeopleSoft campaignMass exploitation

Approximately 68 U.S. university targets, MeshCentral C2, SSH fan-out, zstd staging and extortion.

Canvas LMS compromiseSupply chain

Risk to the dominant LMS ecosystem across U.S. and Canadian institutions.

Securotrop, Qilin affiliateRansomware

GPO-based Chrome credential theft and domain-wide ransomware techniques relevant to university AD environments.

3AM ransomwareHelpdesk social engineering

Email bombing, Quick Assist abuse, QEMU EDR bypass and long dwell time, all applicable to university support environments.

Trend shifts versus May 2026

Mass zero-day exploitation produced the first large confirmed university victim cluster in the tracked dataset.

Shared ERP infrastructure became the force multiplier, allowing one vulnerability to affect dozens of institutions.

AI vishing became an operational identity attack method rather than an emerging concept.

Canvas compromise broadened risk from on-premises ERP to SaaS learning platforms.

Attack chains, vulnerabilities and indicators

CVE	Product	CVSS	June context
CVE-2026-35273	Oracle PeopleSoft PeopleTools 8.61 and 8.62	9.8	Zero-day; about 68 percent of targets were U.S. higher education
CVE-2026-20253	Splunk Enterprise	9.8	Risk to university SIEM infrastructure
CVE-2026-48907	Joomla Widget Factory	9.8	Risk to university web portals
CVE-2021-44228	Apache Log4j	10.0	Actively exploited by DragonForce in June reporting
CVE-2024-57726, 57727, 57728	SimpleHelp RMM	High	Relevant to outsourced university IT and MSP access

Attack Chain 1: PeopleSoft zero-day to extortion

Attack PathELEZAR

Internet scanning for /PSEMHUB/hub and /PSIGW/HttpListeningConnector

T1595

Crafted unauthenticated HTTP POST exploiting CVE-2026-35273

T1190

JSP webshell or XMLDecoder persistence

T1505.003

MeshCentral agent deployment

T1219

Internal discovery and SSH credential spraying

T1082 · T1018 · T1110.001

zstd data compression

T1560.001

Outbound SSH exfiltration to 176[.]120[.]22[.]24

T1048

Data publication and extortion

T1657

Source reports: ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit; Oracle PeopleSoft zero-day analyses

Attack Chain 2: AI vishing to cloud data theft

Attack PathELEZAR

AI-assisted inbound helpdesk call

T1566

Caller ID spoofing and account verification pretext

Victim directed to cloned SSO page

Malicious connected app approved or MFA code captured

T1111

Okta, Microsoft 365, Salesforce or Canvas access

T1213

Bulk SharePoint, OneDrive or CRM collection

T1119

Mail and security alert deletion

T1070

Extortion or resale of stolen data

T1657

Source report: The ShinyHunters Domino Effect: One Breach, Hundreds of Victims

Selected high-value indicators

Type	Indicator	Association
IP	142[.]11[.]200[.]186 through 142[.]11[.]200[.]190	ShinyHunters staging infrastructure
IP	176[.]120[.]22[.]24	Data leak site mirror and exfiltration destination
Domain	azurenetfiles[.]net	MeshCentral C2 masquerading as Azure infrastructure
URL	wss://azurenetfiles[.]net:443/agent.ashx	MeshCentral WebSocket C2
Domain	bless-invite[.]com	SSO and invitation phishing lure
File	meshagent64-azure-ops.exe, meshagent32-azure-ops.exe, meshagent64-v2.exe	Customized MeshCentral agents
Path	/PSEMHUB/hub and /PSIGW/HttpListeningConnector	PeopleSoft exploitation endpoints
File	README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT	Extortion marker
SHA256	2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35	MeshCentral agent sample

Prioritized defensive guidance

Scoped to the typical higher education environment: PeopleSoft, Canvas or other LMS platforms, federated SSO, Microsoft 365, open research networks, decentralized IT and high staff and student turnover.

Immediate: act within 72 hours

1. Assume possible PeopleSoft compromise until cleared

Check every externally exposed PeopleTools 8.61 or 8.62 environment used between 27 May and 9 June. Preserve evidence and hunt for the documented persistence, C2 and exfiltration artifacts.

2. Remove PSEMHUB and PSIGW from the internet

Place management endpoints behind VPN or internal network controls.

3. Patch and deploy the full IOC set

Apply Oracle's fix after evidence preservation and push domain, IP and hash indicators to EDR, SIEM, proxy and firewall tooling.

Urgent: act within 1 to 2 weeks

4. Harden helpdesk and account-recovery workflows

Require callback verification and never approve connected apps or MFA changes from unsolicited calls.

5. Rotate Canvas, Salesforce and SSO integrations

Revoke dormant grants, verify vendor scope and isolate CI or administrative credentials from SaaS compromise paths.

6. Enforce phishing-resistant MFA

Prioritize FIDO2 or WebAuthn for PeopleSoft, registrar, finance, HR and research administrators.

7. Address insider recruitment

Deploy UBA for bulk downloads, automate offboarding and monitor high-risk changes involving VPN, Git and SSO.

Investigate and tune detections

8. Build a FERPA-focused breach playbook

Pre-approve evidence preservation, legal review, regulator coordination and affected-person communication for student data exposure.

9. Detect QEMU-based EDR evasion

Alert on qemu-system executables, ACOW2 or QCOW2 files in ProgramData and the WindowsSensor15 scheduled task.

10. Add PeopleSoft, SaaS and helpdesk correlation rules

Correlate inbound support calls, connected-app approvals, bulk cloud downloads and new authentication methods within short time windows.

June source reports: ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit · ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach Universities · Oracle PeopleSoft 0-Day RCE Flaw Under Active Exploitation by ShinyHunters · The ShinyHunters Domino Effect: One Breach, Hundreds of Victims · June 2026 weekly threat intelligence reports

EMEA

Executive Summary

A named university breach confirms direct sector impact

EMEA higher education experienced the clearest named victim evidence in the source set. The University of Nottingham was compromised through ShinyHunters exploitation of CVE-2026-35273 in Oracle PeopleSoft, with about 455,000 unique email addresses and personal records, including passport data, published on 9 June 2026. The global campaign affected more than 100 organizations and 68 percent were higher education institutions. This confirms that PeopleSoft exposure was not theoretical for European universities.

Key Insights

The University of Nottingham was the only named EMEA higher education victim in the source reports.

Data publication preceded Oracle's advisory by one day, leaving affected institutions without official patch guidance before disclosure.

CVE-2026-35273 required no credentials or user interaction and targeted PeopleTools 8.61 and 8.62.

ShinyHunters' SaaS domino-effect model also affected Canvas-related ecosystems and cloud integrations used across universities.

AI vishing and insider recruitment created identity risk across Okta, Microsoft SSO, Citrix VPN and Git environments.

GDPR pressure increased extortion risk, both for confirmed data theft and for opportunistic ransomware operators active across EMEA.

Top threat entities and June trend shifts

ShinyHunters, UNC6240Confirmed actor

Confirmed University of Nottingham breach and broader higher education targeting through PeopleSoft, SaaS compromise and identity attacks.

Oracle PeopleSoft campaignZero-day campaign

Unauthenticated RCE, persistence, MeshCentral deployment, SSH fan-out and data publication.

Brain CipherRansomware

Opportunistic EMEA ransomware using exposed remote access, credential theft and GDPR notification pressure.

AiLockRansomware

RaaS with aggressive data-protection notification threats and post-quantum key encapsulation.

Canvas LMS compromiseSupply chain

A shared-platform risk for European, Middle Eastern and African universities using Canvas.

Trend shifts versus May 2026

A named European university victim was confirmed, moving sector risk from inferred to directly evidenced.

University ERP systems became a zero-day target class, replacing the prior month's more routine credential and phishing activity.

AI vishing broadened beyond email security controls, especially in multilingual helpdesk environments.

GDPR notification pressure became part of the threat model for both data theft and ransomware extortion.

Attack chains, vulnerabilities and indicators

CVE	Product	CVSS	June context
CVE-2026-35273	Oracle PeopleSoft PeopleTools 8.61 and 8.62	9.8	Actively exploited; University of Nottingham confirmed victim
CVE-2026-20253	Splunk Enterprise	9.8	Risk to university SIEM and logging systems
CVE-2026-48907	Joomla Widget Factory	9.8	Risk to public-facing university sites
CVE-2023-28252	Windows CLFS driver	7.8	Actively used by Brain Cipher
CVE-2026-0257	Palo Alto PAN-OS	9.1	Network perimeter authentication bypass risk

Attack Chain 1: PeopleSoft zero-day to extortion

Attack PathELEZAR

Internet scanning for /PSEMHUB/hub and /PSIGW/HttpListeningConnector

T1595

Crafted unauthenticated HTTP POST exploiting CVE-2026-35273

T1190

JSP webshell or XMLDecoder persistence

T1505.003

MeshCentral agent deployment

T1219

Internal discovery and SSH credential spraying

T1082 · T1018 · T1110.001

zstd data compression

T1560.001

Outbound SSH exfiltration to 176[.]120[.]22[.]24

T1048

Data publication and extortion

T1657

Source reports: ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit; Oracle PeopleSoft zero-day analyses

Attack Chain 2: AI vishing to cloud data theft

Attack PathELEZAR

AI-assisted inbound helpdesk call

T1566

Caller ID spoofing and account verification pretext

Victim directed to cloned SSO page

Malicious connected app approved or MFA code captured

T1111

Okta, Microsoft 365, Salesforce or Canvas access

T1213

Bulk SharePoint, OneDrive or CRM collection

T1119

Mail and security alert deletion

T1070

Extortion or resale of stolen data

T1657

Source report: The ShinyHunters Domino Effect: One Breach, Hundreds of Victims

Selected high-value indicators

Type	Indicator	Association
IP	142[.]11[.]200[.]186 through 142[.]11[.]200[.]190	ShinyHunters staging infrastructure
IP	176[.]120[.]22[.]24	Data leak site mirror and exfiltration destination
Domain	azurenetfiles[.]net	MeshCentral C2 masquerading as Azure infrastructure
URL	wss://azurenetfiles[.]net:443/agent.ashx	MeshCentral WebSocket C2
Domain	bless-invite[.]com	SSO and invitation phishing lure
File	meshagent64-azure-ops.exe, meshagent32-azure-ops.exe, meshagent64-v2.exe	Customized MeshCentral agents
Path	/PSEMHUB/hub and /PSIGW/HttpListeningConnector	PeopleSoft exploitation endpoints
File	README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT	Extortion marker
SHA256	2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35	MeshCentral agent sample

Prioritized defensive guidance

Immediate: act within 72 hours

1. Investigate and patch PeopleSoft immediately

Preserve evidence while checking for JSP webshells, XMLDecoder persistence, MeshCentral agents, zstd staging, sshpass and outbound SSH. Patch without delaying containment.

2. Restrict PSEMHUB and PSIGW to internal access

Remove public exposure and require VPN or management-network access.

3. Block known infrastructure and review historic logs

Hunt for azurenetfiles[.]net, the five staging IPs and 176[.]120[.]22[.]24 across the prior 60 to 90 days.

Urgent: act within 1 to 2 weeks

4. Rework helpdesk identity verification

Do not approve connected apps, MFA resets or account recovery from inbound calls without callback and ticket verification.

5. Rotate Canvas and OAuth credentials

Verify breach scope, rotate Canvas API tokens and remove dormant SaaS grants.

6. Enforce phishing-resistant MFA

Use FIDO2 or WebAuthn for administrative, registry, HR, finance and research-data roles.

7. Prepare GDPR and UK GDPR response playbooks

Pre-approve supervisory authority and affected-person notification workflows for PeopleSoft data exposure.

Investigate and tune detections

8. Add PeopleSoft-specific SIEM rules

Alert on external PSEMHUB access, WebLogic child shells, JSP creation, sshpass and unusual zstd operations.

9. Prepare for GDPR-aware ransomware extortion

Create a pre-approved response for threats to notify regulators inside the 72-hour reporting window.

10. Improve offboarding and insider-risk visibility

Revoke all SSO, API and VPN credentials at departure and alert on bulk downloads by users with changing roles.

APAC

Executive Summary

PeopleSoft zero-day exposure defines the June threat picture

APAC higher education faced a defining June 2026 threat through ShinyHunters exploitation of CVE-2026-35273 in Oracle PeopleSoft PeopleTools. The campaign operated from 27 May to 9 June before Oracle published its advisory on 10 June. More than 100 organizations were notified globally and 68 percent were higher education institutions. The only named university victim in the source set was the University of Nottingham, so APAC risk is assessed from the campaign's global scanning model, ShinyHunters' documented targeting history in Australia, Japan and India, and the broad use of PeopleSoft across the region.

Key Insights

CVE-2026-35273, CVSS 9.8, enabled unauthenticated remote code execution against PeopleTools 8.61 and 8.62 through exposed PSEMHUB and PSIGW endpoints.

ShinyHunters, tracked as UNC6240, used MeshCentral agents, SSH credential spraying, zstd compression and outbound SSH exfiltration after exploitation.

Sixty-eight percent of more than 100 targeted organizations were higher education institutions, making this the most consequential sector campaign in the source set.

Canvas LMS compromise and OAuth abuse reinforced a SaaS domino-effect model in which one upstream breach can affect many universities.

AI-powered vishing using Bland AI and Vapi targeted helpdesk workflows, Okta or Microsoft SSO approvals and real-time MFA interception.

No named APAC university ransomware victim was confirmed in the source reports for June, so ransomware is treated as a secondary opportunistic risk rather than a confirmed regional incident trend.

Top threat entities and June trend shifts

ShinyHunters, UNC6240Criminal extortion

PeopleSoft zero-day exploitation, Canvas-related supply chain activity, cloud data theft, AI vishing and insider recruitment.

Oracle PeopleSoft campaignCampaign

Global scanning and exploitation of PSEMHUB and PSIGW endpoints, followed by MeshCentral deployment, SSH fan-out and data publication.

Canvas LMS compromiseSupply chain

A vendor-level breach pattern with potential downstream exposure for institutions relying on Canvas for course delivery and student data.

MeshCentralRemote access tool

Customized agents named to resemble Azure operations software and beaconing to azurenetfiles[.]net over WebSocket TLS.

CryptoBanditsUSB malware

USB and LNK-based propagation relevant to shared computer labs and library workstations, with clipboard hijacking and cryptocurrency theft.

Trend shifts versus May 2026

Zero-day exploitation replaced routine phishing as the defining sector event, with direct targeting of university ERP infrastructure.

AI voice social engineering entered the operational playbook, creating a gap in standard phishing-awareness programs.

SaaS concentration became a structural risk multiplier across PeopleSoft, Canvas, Salesforce, Okta and Microsoft 365.

June report volume increased from 164 to 455, indicating a materially more active intelligence environment than May.

Attack chains, vulnerabilities and indicators

CVE	Product	CVSS	June context
CVE-2026-35273	Oracle PeopleSoft PeopleTools 8.61 and 8.62	9.8	Zero-day RCE actively exploited against higher education
CVE-2026-20253	Splunk Enterprise	9.8	Risk to university SIEM infrastructure
CVE-2026-48907	Joomla Widget Factory	9.8	Risk to public-facing university web portals
CVE-2024-6387	OpenSSH RegreSSHion	Critical	Relevant to university Linux and SSH infrastructure

Attack Chain 1: PeopleSoft zero-day to extortion

Attack PathELEZAR

Internet scanning for /PSEMHUB/hub and /PSIGW/HttpListeningConnector

T1595

Crafted unauthenticated HTTP POST exploiting CVE-2026-35273

T1190

JSP webshell or XMLDecoder persistence

T1505.003

MeshCentral agent deployment

T1219

Internal discovery and SSH credential spraying

T1082 · T1018 · T1110.001

zstd data compression

T1560.001

Outbound SSH exfiltration to 176[.]120[.]22[.]24

T1048

Data publication and extortion

T1657

Source reports: ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit; Oracle PeopleSoft zero-day analyses

Attack Chain 2: AI vishing to cloud data theft

Attack PathELEZAR

AI-assisted inbound helpdesk call

T1566

Caller ID spoofing and account verification pretext

Victim directed to cloned SSO page

Malicious connected app approved or MFA code captured

T1111

Okta, Microsoft 365, Salesforce or Canvas access

T1213

Bulk SharePoint, OneDrive or CRM collection

T1119

Mail and security alert deletion

T1070

Extortion or resale of stolen data

T1657

Source report: The ShinyHunters Domino Effect: One Breach, Hundreds of Victims

Selected high-value indicators

Type	Indicator	Association
IP	142[.]11[.]200[.]186 through 142[.]11[.]200[.]190	ShinyHunters staging infrastructure
IP	176[.]120[.]22[.]24	Data leak site mirror and exfiltration destination
Domain	azurenetfiles[.]net	MeshCentral C2 masquerading as Azure infrastructure
URL	wss://azurenetfiles[.]net:443/agent.ashx	MeshCentral WebSocket C2
Domain	bless-invite[.]com	SSO and invitation phishing lure
File	meshagent64-azure-ops.exe, meshagent32-azure-ops.exe, meshagent64-v2.exe	Customized MeshCentral agents
Path	/PSEMHUB/hub and /PSIGW/HttpListeningConnector	PeopleSoft exploitation endpoints
File	README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT	Extortion marker
SHA256	2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35	MeshCentral agent sample

Prioritized defensive guidance

Immediate: act within 72 hours

1. Forensically assess all PeopleTools 8.61 and 8.62 systems

Treat any externally exposed PSEMHUB or PSIGW deployment present between 27 May and 9 June as potentially compromised. Hunt for unexpected JSP files, modified XML under envmetadata/data/environment, MeshCentral agents, sshpass use, zstd staging and outbound SSH.

2. Remove PSEMHUB and PSIGW from public exposure

Restrict /PSEMHUB/hub and /PSIGW/HttpListeningConnector to trusted internal ranges or VPN access only.

3. Block and retrospectively hunt ShinyHunters infrastructure

Block azurenetfiles[.]net, 142[.]11[.]200[.]186 through 142[.]11[.]200[.]190 and 176[.]120[.]22[.]24. Review at least 60 days of proxy, firewall and endpoint telemetry.

Urgent: act within 1 to 2 weeks

4. Harden university helpdesks against AI vishing

Require callback verification and ticket-bound out-of-band codes for MFA resets, connected-app approvals and account recovery.

5. Audit OAuth and SaaS integrations

Revoke dormant or unexplained tokens across Canvas, Okta, Microsoft 365 and Salesforce. Verify vendor breach scope and rotate exposed API credentials.

6. Move privileged users to phishing-resistant MFA

Prioritize FIDO2, WebAuthn or passkeys for PeopleSoft administrators, finance, HR, registry and research data custodians.

7. Address insider recruitment risk

Use UBA for bulk downloads, tighten offboarding and monitor high-risk access changes involving SSO, VPN and Git platforms.

Investigate and tune detections

8. Deploy PeopleSoft-specific detections

Alert on external POSTs to PSEMHUB, WebLogic spawning shell tools, JSP creation in application directories, sshpass on application hosts and outbound SSH to unapproved destinations.

9. Reduce USB malware exposure

Disable or tightly control USB storage on shared lab systems and detect LNK execution from removable media.

10. Establish vendor breach notification SLAs

Require rapid disclosure, OAuth rotation support and annual token hygiene reviews from core SaaS vendors.

June 2026Higher EducationRegional Sector Brief

Trend shifts versus May 2026

Selected high-value indicators

Trend shifts versus May 2026

Selected high-value indicators

Trend shifts versus May 2026

Selected high-value indicators

June 2026
Higher Education
Regional Sector Brief