ShinyHunters is again mass-exploiting Oracle PeopleSoft flaw CVE-2026-35273, defeating firewall rules by URL-encoding a single character. Anyone who filtered the endpoint instead of applying Oracle's June 10 patch should assume exposure.
Perspective Coverage
8 publishers
- Builder
- Builder 25%
- Operator
- Operator 58%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+8
- Incentives58
- Confidence74
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence70
Storm-2570 brings the same intrusion toolkit to Qilin, DragonForce, Anubis and BERT attacks
Microsoft says affiliate Storm-2570 has run the same remote access and exfiltration tools whether it deploys Qilin, DragonForce, Anubis or BERT ransomware. Detections built on those tools can catch the operator before any payload runs.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence55
Open staging directory documents a CVE-2024-21762 intrusion at Thai carrier 3BB
Hunt.io says a threat actor left 298 files in an open directory in Thailand, including FortiGate and F5 exploit scripts written for 3BB and a MeshCentral backdoor that the cleanup script checked was still running.
Reality
- Evidence55
- Adoption30
- Hype gap+18
- Incentives60
- Confidence50
An attacker kept root inside Thai broadband provider 3BB with a hidden MeshCentral install
Hunt.io captured the operator's own server on June 3, 2026, while the intrusion was live. The files on it show password spraying across more than 55 internal hosts and a cleanup script written to erase everything except the MeshCentral agent.
Reality
- Evidence62
- Adoption45
- Hype gap−12
- Incentives60
- Confidence58