SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSunday, September 27, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY ShinyHunters Bypasses WAFs to Exploit Oracle PeopleSoft | CRITICAL |
|
5 C2 IPs | 43 OTX IOCs | 14 ARTICLES |
|
■ ANALYST TLDR Threat actors, including the ShinyHunters extortion group, are actively bypassing web application firewalls using URL-encoding techniques to exploit Oracle PeopleSoft (CVE-2026-35273) and deploy web shells. Concurrently, CISA has added critical SharePoint RCE and MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog, while Kiteworks has issued an unprecedented emergency shutdown warning due to an imminent cyber threat. Additionally, the emergence of the Lunex Stealer utilizing BYOVD techniques and the x47.c botnet leveraging AI APIs highlights a highly sophisticated threat landscape targeting enterprise infrastructure and software supply chains. |
|
■ CRITICAL STORIES ShinyHunters Exploits Oracle PeopleSoft via WAF Bypass Threat actors are utilizing URL-encoding tricks to bypass WAF rules mitigating CVE-2026-35273, enabling widespread exploitation and web shell deployment on Oracle PeopleSoft servers. |
Kiteworks Urges Emergency 9-Hour Shutdown Over Imminent Attack Kiteworks has issued an urgent directive advising customers to shut down their secure file transfer systems for nine hours over the weekend following credible threat intelligence of an imminent cyber attack. |
CISA Adds SharePoint RCE and MikroTik RouterOS Flaws to KEV Catalog CISA has added actively exploited Microsoft SharePoint and MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling immediate exploitation risks. |
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring Distributed via compromised Ukrainian sites using ClickFix lures, the Lunex MaaS platform employs a Bring Your Own Vulnerable Driver (BYOVD) attack using an AMD driver to terminate security tools. |
|
■ CVEs IDENTIFIED CVE-2026-35273 Oracle PeopleSoft — Remote Code Execution via WAF bypass and web shell deployment |
[CVE-TBD] Elementor Website Builder (WordPress Plugin) — Cross-Site Request Forgery (CSRF) leading to rogue admin account creation and site takeover |
[CVE-TBD] Microsoft SharePoint — Remote Code Execution (RCE) actively exploited in the wild |
[CVE-TBD] MikroTik RouterOS — RouterOS vulnerability actively exploited in the wild |
|
■ THREAT ACTORS ShinyHunters | Cybercrime/Extortion |
Exploiting CVE-2026-35273 in Oracle PeopleSoft using WAF bypass tricks to deploy web shells |
Lunex MaaS Operators | Cybercrime |
Distributing Lunex Stealer (Psychedelic Stealer) via compromised Ukrainian websites using ClickFix-style lures |
|
|
|
■ ATT&CK TTPs | T1505.003 | | Server Software Component: Web Shell | Deploying web shells on compromised Oracle PeopleSoft servers |
| T1036 | | Masquerading | ClickFix-style Cloudflare verification checks used to deliver Lunex Stealer |
| T1068 | | Exploitation for Privilege Escalation | BYOVD technique abusing AMD driver to disable security monitoring |
| T1195.002 | | Compromise Software Supply Chain | Third-party GitHub Actions compromised with Mini Shai-Hulud payload re-enabled |
| T1204.001 | | User Execution: Malicious Link | Elementor CSRF attack requiring admin to click a crafted link |
| T1110 | | Brute Force | AI API draining and botnet persistence via xAI Grok |
|
■ PATCH PRIORITY CRITICAL — Oracle PeopleSoft — Active exploitation and WAF bypass by ShinyHunters (CVE-2026-35273) — BC / THN |
CRITICAL — Microsoft SharePoint — Active RCE exploitation added to KEV ([CVE-TBD]) — THN |
HIGH — MikroTik RouterOS — Active exploitation added to KEV ([CVE-TBD]) — THN |
HIGH — Elementor Website Builder — High-severity CSRF allowing site takeover ([CVE-TBD]) — THN |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Deploy updated WAF rules and apply vendor patches for Oracle PeopleSoft CVE-2026-35273 to prevent ShinyHunters URL-encoding bypasses. |
| 2 | [P1] Immediately shut down Kiteworks systems as advised by the vendor to mitigate imminent cyber attack risks. |
| 3 | [P1] Identify and patch actively exploited Microsoft SharePoint and MikroTik RouterOS vulnerabilities listed in the CISA KEV. |
| 4 | [P2] Audit and restrict third-party GitHub Actions in CI/CD pipelines, specifically checking for the Mini Shai-Hulud payload. |
| 5 | [P2] Update Elementor Website Builder WordPress plugin to the latest version to mitigate the high-severity CSRF vulnerability. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |