Google and Mandiant Flag Renewed Oracle PeopleSoft Exploitation
Google Threat Intelligence Group and Mandiant have issued a fresh warning about ShinyHunters, the extortion crew tracked as UNC6240, after the group launched a new mass-exploitation campaign against Oracle PeopleSoft customers. The alert, issued over the weekend, indicates that the notorious data-theft group is not slowing down after its earlier wave of attacks. Instead, it has adapted its tooling and is now targeting a broader set of industries with a modified exploit designed to slip past common web application firewall protections.
PeopleSoft is an integrated enterprise resource planning suite used by large organizations to manage core business functions. Its modules support finance, human resources, payroll, supply chain, and other operational workflows. Because those systems often hold sensitive employee, customer, financial, and vendor data, they are high-value targets for cybercriminals focused on extortion. A successful intrusion can give attackers access to payroll records, HR databases, financial systems, and the credentials used to connect PeopleSoft to other enterprise applications.
From Zero-Day to Mass Exploitation
The renewed activity comes roughly four months after ShinyHunters was observed exploiting a zero-day vulnerability in PeopleSoft, tracked as CVE-2026-35273. That flaw allowed remote code execution without authentication, making it especially dangerous for internet-facing or weakly segmented PeopleSoft deployments. In June, the group targeted more than 100 PeopleSoft customers. Confirmed victims included the University of Nottingham in the United Kingdom, the National Association of Insurance Commissioners, and Nissan. The education sector featured prominently in the initial campaign, but the attackers have since widened their scope.
According to Google, the new wave stems from UNC6240 modifying its exploit to bypass web application firewall rules that block the vulnerable Environment Management Hub endpoint, known as PSEMHUB. The original mitigation advice focused on blocking or restricting access to that endpoint. The updated attack shows that a simple literal-path block is not enough when an application server performs URL decoding after the WAF or reverse proxy has already inspected the request.
The %50 WAF Bypass Explained
In the new campaign, the hackers have been deploying web shells on dozens of systems after bypassing WAF rules using %50, the URL-encoded form of the character P, in request paths containing the string /PSEMHUB. Many WAF and reverse proxy rules match the literal path before URL decoding. The PeopleSoft application server, however, decodes the request and routes it to the vulnerable servlet. That mismatch allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure.
This technique is a textbook example of path normalization and encoding evasion. Security controls that inspect raw HTTP requests may see %50SEMHUB rather than PSEMHUB. The application later interprets the encoded value as P, reconstructing the dangerous route. For defenders, the lesson is that virtual patching and WAF rules must account for how the backend application parses and decodes requests, not merely how the edge device sees them. In PeopleSoft environments, that means reviewing rules for case variation, double encoding, path traversal, and mixed encoding in addition to the obvious literal block.
Web Shell Deployment and Persistence
Once the attackers reached the vulnerable endpoint, they moved quickly to establish persistence. Google and Mandiant observed the group deploying two complementary, single-line JSP web shells. Single-line shells are small and can be easier to hide in application directories, making them a common choice for attackers who want reliable remote access without dropping large binaries. The attackers also sent multiple POST requests to access web shells behind some load-balanced environments. This likely ensured that a copy of the web shell was deployed on every WebLogic node, preventing the intrusion from breaking when traffic was routed to a different server. In other cases, the attackers sent POST requests that returned command output directly in the HTTP response to spawn shell processes.
On Windows servers, the group deployed the SideEye backdoor. According to the warning, SideEye can steal credentials from browsers and applications, manage files and processes, and provide reverse shell and reverse proxy capabilities. That combination gives an attacker both collection and control. Stolen browser credentials can be used to pivot into cloud services, webmail, and administrative portals. File and process management allows the intruder to stage data, disable defenses, or install additional tooling. Reverse shell and reverse proxy functionality creates a durable channel that can survive some network-level blocks.
The attackers also deployed the open source Neo-reGeorg tunneling toolkit for internal discovery and lateral movement, and the open source remote management platform MeshCentral. Neo-reGeorg is often used to tunnel traffic through compromised web servers, allowing an attacker to reach internal systems that are not directly exposed to the internet. MeshCentral, meanwhile, is a legitimate remote management tool that can be abused to maintain control and interact with endpoints. The presence of either tool in a PeopleSoft environment should be treated as a serious indicator of compromise, particularly if it was not approved or installed by IT operations.
Privilege Abuse and Data Access
The hackers executed commands with root or System privileges to perform host and user discovery and process verification. That level of access indicates that the exploit gave them significant control over the affected servers. The group also abused PeopleSoft and WebLogic service accounts to gain access to application data, configuration files, and database connection strings. Service accounts are particularly valuable because they often have broad permissions and are not always monitored as closely as human administrator accounts. Once an attacker obtains database connection strings, they may be able to move from the application server to backend databases, extract large data sets, and identify further systems to compromise.
This pattern aligns with ShinyHunters’ well-established focus on data theft extortion. Rather than deploying ransomware immediately, the group steals data and threatens to release it on a data leak site unless the victim pays a ransom. That approach can be harder to detect because it may not involve mass file encryption. Instead, the attackers may quietly exfiltrate records, configuration files, and credentials while maintaining access through web shells, tunnels, and remote management tools.
Expanded Targeting Across Critical Sectors
While the initial PeopleSoft campaign focused on the education sector, the new wave has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations. That broadening is significant. Agriculture and transportation organizations may have operational technology and supply chain dependencies that are not traditionally treated as high-risk software environments. Government and healthcare entities hold sensitive personal and regulated data. IT services and technology firms can serve as stepping stones into their own customers’ environments. The shift suggests that the attackers are scanning broadly for exposed PeopleSoft systems and prioritizing victims based on data value or ease of exploitation rather than a single vertical.
The FBI-related claim also deserves scrutiny. In a recent attack aimed at the FBI, ShinyHunters claimed to have leveraged a PeopleSoft zero-day. Google notes that the hackers may be referring to this modified exploit rather than a new zero-day. That distinction matters for defenders. If the activity is a variant of CVE-2026-35273 rather than an entirely new flaw, then organizations that have patched and hardened correctly may already be protected. If it is a new vulnerability, the risk profile changes. Either way, the public claim shows how extortion groups use high-profile victims to amplify pressure and shape news coverage.
Detection and Mitigation Priorities
PeopleSoft customers are advised to apply Oracle’s patches for CVE-2026-35273, harden their environments, hunt for potential indicators of compromise and data theft, and prepare for extortion in the event of compromise. Patching is essential, but it is not sufficient on its own. Organizations should verify that all PeopleSoft and WebLogic nodes are updated, including systems behind load balancers, disaster recovery environments, and forgotten test instances. Attackers frequently exploit the node that administrators assumed was isolated or obsolete.
Defenders should also review WAF and reverse proxy configurations with decoding behavior in mind. Rules that block /PSEMHUB should be tested against encoded variants such as %50SEMHUB, double-encoded forms, case changes, and path normalization tricks. Where possible, restrict access to the Environment Management Hub endpoint to trusted management networks rather than exposing it to the public internet. Network segmentation between web tiers, application servers, and databases can limit the impact of a successful web shell deployment.
Hunting should focus on unusual JSP files, unexpected POST requests to PeopleSoft paths, repeated requests across multiple WebLogic nodes, and outbound connections associated with Neo-reGeorg or MeshCentral. Security teams should review service account activity, especially access to configuration files and database connection strings. On Windows systems, they should look for SideEye artifacts, suspicious process creation, credential access attempts, and reverse proxy behavior. Any evidence of root or System-level command execution on PeopleSoft servers should trigger immediate incident response.
Because UNC6240 has a well-established pattern of data theft extortion, affected organizations should prepare for extortion communications and monitor for potential public exposure of stolen data. That preparation includes legal, communications, and executive stakeholders, not only technical teams. The group may attempt to contact victims through email, chat, or leak site postings. Having a response plan in place can reduce the chaos that follows a data theft claim and help organizations verify what was taken, notify affected parties, and meet regulatory obligations.
Source: SecurityWeek News