ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

Google Cloud Threat Intelligence and Mandiant report that the ShinyHunters group, tracked as UNC6240, has resumed mass exploitation of CVE-2026-35273, targeting Oracle PeopleSoft systems worldwide. The threat actor modified its attack method to bypass web application firewall rules by URL-encoding a single character in the request path, allowing access to the vulnerable Environment Management Hub (PSEMHUB) endpoint. This bypass technique exploits the difference between WAF string matching and PeopleSoft’s URL decoding process, enabling attacks even on systems believed to be protected. Organizations previously relying on WAF rules alone are now at renewed risk.

The campaign has expanded beyond academic institutions to include technology, healthcare, agriculture, transportation, and government sectors. Mandiant observed the deployment of web shells on dozens of compromised systems, with threat actors using a consistent sequence of discovery, verification, and post-exploitation activities. Attackers sent POST requests to /%50SEMHUB/hub containing serialized Java objects to confirm exploitability before deploying additional payloads. Defenders are advised to inspect logs for these encoded requests and monitor for unexpected file creation or command execution.

UNC6240 has developed multiple persistence mechanisms, including single-line JSP web shells designed to evade detection. The primary shell, x.jsp, enables cross-platform command execution via hex-encoded commands, while a secondary shell, u.jsp, facilitates large file uploads in 150 KB chunks to bypass size limits. On Windows systems, the group deployed a 5.2 MB trojanized installer named Ple64.exe, masquerading as a legitimate media player installer but containing a three-stage backdoor chain leading to the SIDEEYE malware.

Mandiant recommends immediate actions for Oracle PeopleSoft administrators, including disabling the EMHub service or removing the PSEMHUB application, searching logs for encoded path requests, inspecting PSEMHUB.war for unauthorized files, rotating credentials, and monitoring outbound traffic for indicators of compromise. The threat actor’s adaptation to defensive measures highlights the need for organizations to enforce blocking on normalized paths and review all WebLogic nodes, not just the first identified as compromised.