Google’s Mandiant and Threat Intelligence Group (GTIG) have observed ShinyHunters launching a renewed mass-exploitation campaign against vulnerable Oracle PeopleSoft servers, compromising dozens of systems across multiple industries.
The activity supports recent claims from the cybercrime group that it had resumed exploiting PeopleSoft environments against a broader range of targets.
The threat group, tracked by Google as UNC6240, is again exploiting CVE-2026-35273, a critical PeopleSoft vulnerability it previously used as a zero-day between May 27 and June 9.
Oracle issued an emergency security update for the flaw on June 10. However, Mandiant says ShinyHunters has now modified its attacks to bypass organizations that attempted to mitigate the vulnerability using web application firewall (WAF) rules instead of installing the patch.
The bypass is remarkably simple. Rather than requesting the vulnerable /PSEMHUB/ endpoint directly, attackers replace the letter “P” with its URL-encoded equivalent and request /%50SEMHUB/.
Some WAFs inspect the original URL and therefore fail to recognize the blocked path, while the PeopleSoft application decodes it back to /PSEMHUB/ and processes the request normally.
Mandiant observed the technique being used against organizations in higher education, technology, IT services, healthcare, agriculture, transportation, and government.
Oracle PeopleSoft is an enterprise software platform widely used by large organizations for human resources, payroll, recruiting, finance, and other administrative operations. Compromising a PeopleSoft server can expose sensitive employee and organizational data and give attackers a foothold in internal networks.
After successfully exploiting vulnerable systems, ShinyHunters deployed JSP web shells including x.jsp and u.jsp, allowing the attackers to execute commands and upload additional malware.
On Windows systems, the group also installed a 5.2MB executable called Ple64.exe, which Mandiant tracks as the SIDEEYE backdoor. The malware can steal browser and application credentials, manage files and processes, provide a reverse shell, and proxy traffic into internal networks.
The attackers additionally used the Neo-reGeorg tunneling tool and the legitimate MeshAgent remote-management software to maintain access to compromised environments.
ShinyHunters claimed on September 22 that they had compromised FBI infrastructure through a PeopleSoft server and subsequently accessed other systems. Screenshots previously shared with CyberInsider showed an FBI Jobs page under a /PSEMHUB/ path displaying system information. The FBI later acknowledged the group’s claims but has not confirmed the alleged theft of 2TB–3TB of data.
Mandiant recommends that PeopleSoft administrators install Oracle’s CVE-2026-35273 security update rather than relying on WAF filtering, disable or remove the Environment Management Hub where possible, and search logs for both normal and encoded /PSEMHUB/ requests.
Organizations should also inspect PeopleSoft directories for unexpected JSP or executable files, investigate unusual remote-management agents, and rotate credentials accessible from any server found to be compromised.
Leave a Reply