Threats tagged 'sideeye backdoor'

UNC6240 (ShinyHunters) has resumed a mass exploitation campaign targeting Oracle PeopleSoft systems worldwide by exploiting CVE-2026-35273. The attacker bypassed web application firewall protections using URL encoding to access a vulnerable endpoint. Post-exploitation, multiple web shells, a trojanized backdoor (SIDEEYE), tunneling tools, and persistence agents were deployed. The actor conducted reconnaissance, credential theft, and prepared for data exfiltration, indicating potential extortion activities.