Full Report
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution. The vulnerability was first exploited as a zero-day
Analysis Summary
# Incident Report: Mass Exploitation of Oracle PeopleSoft (UNC6240)
## Executive Summary
The threat actor group UNC6240 (linked to ShinyHunters) is conducting a global mass-exploitation campaign targeting Oracle PeopleSoft environments via CVE-2026-35273. By using URL-encoding to bypass Web Application Firewalls (WAFs), attackers achieve unauthenticated remote code execution (RCE) to deploy web shells and backdoors. The primary objective is data theft for extortion, affecting dozens of organizations across multiple sectors.
## Incident Details
- **Discovery Date:** September 26, 2026 (Reported by Google/Mandiant)
- **Incident Date:** Initial zero-day exploitation began June 2026; renewed campaign ongoing.
- **Affected Organization:** Multiple (over 100 global organizations notified)
- **Sector:** Higher Education, Technology, IT Services, Healthcare, Agriculture, Transportation, and Government.
- **Geography:** Global, with a high concentration in the U.S.
## Timeline of Events
### Initial Access
- **Date/Time:** June 2026 (Initial zero-day) / September 2026 (Renewed WAF bypass).
- **Vector:** Exploitation of CVE-2026-35273 in the Environment Management Hub (PSEMHUB).
- **Details:** Attackers send POST requests containing serialized Java objects to the PSEMHUB hub servlet.
### Lateral Movement
- **Techniques:** Attackers move laterally over SSH using shell scripts and known/stolen username and password combinations to access other internal PeopleSoft machines.
### Data Exfiltration/Impact
- **Details:** Staging of large archive files in temporary directories. Target data includes HR, payroll, and student records for the purpose of ransom-based extortion.
### Detection & Response
- **Discovery:** Mandiant identified a new wave of activity where attackers modified exploits to bypass string-based WAF rules.
- **Response:** Notification of affected entities; Google/Mandiant released guidance on WAF bypass identification and remediation.
## Attack Methodology
- **Initial Access:** Java Deserialization vulnerability (CVE-2026-35273).
- **Persistence:** Deployment of `MeshAgent` (RMM tool) and `SIDEEYE` C++ backdoor.
- **Privilege Escalation:** Execution of commands as `root` or `NT Authority\SYSTEM`.
- **Defense Evasion:** URL-encoding the request path (`/%50SEMHUB/` instead of `/PSEMHUB/`) to bypass WAFs; use of signed installers (`Ple64.exe`) to load backdoors in memory.
- **Credential Access:** `SIDEEYE` backdoor facilitates browser and desktop application credential theft.
- **Discovery:** Initial reconnaissance via zero-day exploitation and PSEMHUB targeting.
- **Lateral Movement:** SSH tunneling and use of the Neo-reGeorg toolkit.
- **Collection:** Bulk queries against database tables (HR, Payroll, Student records).
- **Exfiltration:** Data theft for public leak site extortion.
- **Impact:** Financial extortion and unauthorized full system control.
## Impact Assessment
- **Financial:** High risk of ransom demands; potential regulatory fines for data loss.
- **Data Breach:** Sensitive PII (Student records, payroll, HR data).
- **Operational:** Deployment of web shells (`x.jsp`, `u.jsp`) allows full remote control of PeopleSoft servers.
- **Reputational:** Public exposure of stolen data on ShinyHunters-linked leak sites.
## Indicators of Compromise
- **Network Indicators:**
- `162.219.30[.]165` (C2 Server)
- `/%50SEMHUB/` (WAF bypass path)
- **File Indicators:**
- `x.jsp` (Command execution web shell)
- `u.jsp` (Chunked file upload web shell)
- `Ple64.exe` (Trojanized installer)
- `SIDEEYE` (C++ backdoor)
- **Behavioral Indicators:**
- Unauthorized use of `MeshAgent` on Linux PeopleSoft servers.
- Large archive files in `/tmp/` or web-accessible directories.
## Response Actions
- **Containment:** Disable the Environment Management Hub (EMHub) or remove the PSEMHUB application.
- **Eradication:** Delete JSP web shells from the `PSEMHUB.war` directory and terminate unauthorized RMM processes.
- **Recovery:** Apply Oracle security patches for CVE-2026-35273 and rotate all PeopleSoft service account credentials.
## Lessons Learned
- **WAF Limitations:** String-based WAF rules are insufficient if they do not account for URL-encoding variations that the backend application server will decode.
- **Patch Management:** Even known vulnerabilities (post-June 2026) remain high-risk targets if patches are not applied immediately across all global instances.
## Recommendations
- **Immediate Patching:** Prioritize Oracle PeopleSoft security updates.
- **WAF Optimization:** Update WAF rules to normalize/decode URLs before pattern matching.
- **Monitoring:** Implement egress filtering on PeopleSoft hosts and audit database logs for unusual bulk exports.