ShinyHunters has resumed large-scale attacks against Oracle PeopleSoft, using a small change to its exploit to get past some web application firewall (WAF) rules.
Mandiant and Google Threat Intelligence Group (GTIG) say the group, tracked as UNC6240, has deployed web shells on dozens of systems worldwide.
The latest targets span higher education, technology, IT services, healthcare, agriculture, transportation, and government.
CVE-2026-35273 affects Oracle PeopleSoft PeopleTools. Oracle says the flaw can be exploited remotely without authentication and may allow an attacker to run code on a vulnerable server.
Oracle lists PeopleTools versions 8.61 and 8.62 as affected and rates the issue 9.8 on the CVSS scale. The company issued an emergency security alert on June 10, 2026.
ShinyHunters Renew PeopleSoft Attacks
ShinyHunters first exploited the flaw as a zero-day between May 27 and June 9, mainly against universities. In the renewed campaign, the group changed the request path from /PSEMHUB/ to /%50SEMHUB/.
The sequence %50 represents the letter “P.” A WAF rule looking only for the literal /PSEMHUB/ path may miss the encoded request, while the PeopleSoft server decodes it and sends it to the vulnerable Environment Management Hub endpoint.
Mandiant observed attackers sending repeated POST requests to /%50SEMHUB/hub to check whether servers were vulnerable.
Successful attacks used Java deserialization to deploy JSP web shells or run commands directly without creating a file. The fileless method means a search limited to new web-shell files could miss some intrusions.
On compromised systems, the attackers used x.jsp to run commands and u.jsp to upload files in chunks. On Windows servers, they deployed Ple64.exe, a trojanized installer that loads the SIDEEYE backdoor in memory.
Mandiant also observed Neo-reGeorg tunnels for access to internal networks and MeshAgent remote-management software on Linux hosts. GTIG linked SIDEEYE to the command-and-control address 162[.]219[.]30[.]165, using TCP ports 3333 and 3334.
Oracle PeopleSoft operators should apply the CVE-2026-35273 patch immediately. Mandiant warns that WAF rules are not a substitute for patching.
Organizations should also disable Environment Management Hub where appropriate, or remove the PSEMHUB application in single-server setups, following Oracle’s guidance. If a WAF is used, its blocking rules must account for decoded and other modified forms of the path.
Security teams should search WebLogic access logs for /PSEMHUB/, encoded variants such as /%50SEMHUB/, suspicious POST requests to /hub, and unexpected JSP requests.
They should inspect every relevant WebLogic node for unfamiliar files, including x.jsp, u.jsp, tunnel.jsp, and Ple64.exe, and investigate shell processes launched by Java, Google said.
Indicators of Compromise
| Type | Indicator | Reported role |
|---|---|---|
| IPv4 | 5.199.162.157 | Attack controller, scanner, and HTTP callback receiver |
| IPv4 | 104.219.234.138 | Exfiltration staging and remote management host |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
