ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

What it is

UNC6240 (ShinyHunters) is again mass-exploiting Oracle PeopleSoft CVE-2026-35273, a Java deserialization flaw in the PSEMHUB hub servlet. Mandiant and GTIG say it is now an n-day: Oracle shipped an out-of-band Security Alert on 10 June 2026, after zero-day use between 27 May and 9 June 2026. The new wave hit dozens of systems in higher education, technology, IT services, healthcare, agriculture, transportation and government.

How it works

The actor adapted to the June guidance by requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAF and reverse proxy rules match the literal path before URL decoding, while WebLogic decodes it and serves the servlet. Operators who added a WAF rule but did not patch are exposed.

Observed sequence:

1. Verification: 5 to 15 POSTs to /%50SEMHUB/hub carrying a serialized Java object. Unpatched servers return the host OS name and write nothing. Some hosts show only this, with no follow-on activity.
2. Exploitation, by one of two methods. Web shell: a burst of POSTs, then new JSP files (x.jsp or numbered files) in PSEMHUB.war. The burst likely copies the shell to every node behind a load balancer. Fileless: command output is returned in the HTTP response and no file is written.
3. Tooling: x.jsp runs hex-encoded commands over POST and builds /bin/sh from an ASCII array. u.jsp and u2.jsp upload Base64 chunks of 150 KB. u.jsp delivered Ple64.exe (SIDEEYE), a trojanized Light Alloy installer signed with an EV certificate issued to Tobias Weihmann Software Development OU. SIDEEYE talks to 162[.]219[.]30[.]165 over raw TCP 3333 (control) and 3334 (data). Neo-reGeorg (tunnel.jsp, tunnel.jspx) provides SOCKS5 over HTTP(S). On Linux the actor installed MeshAgent.
4. About a quarter of observed commands ran as root or NT Authority\SYSTEM. The rest ran as PeopleSoft or WebLogic service accounts, which can reach configuration files, database connection strings and application data.

What to do

• Apply the Oracle Security Alert for CVE-2026-35273 and stay on supported PeopleTools versions.
• Disable EMHub if it is not used for patching, or remove the PSEMHUB application. Restricting EMHub and the Integration Broker listening connector from the internet does not break standard PIA user sessions.
• Block on the normalized path. Assume any percent-encoded, mixed-case or non-normalized variant of /PSEMHUB/ may be used.
• Search WebLogic access logs for /PSEMHUB/ and encoded variants, external POSTs to /hub, and unexpected .jsp or .jspx files under PSEMHUB or PORTAL.
• Alert on cmd.exe, /bin/sh or bash spawned by the WebLogic Java process, especially with base64 -d, curl, /dev/tcp, tasklist or start /b. This is the only coverage for the fileless method.
• Scan PSEMHUB.war/ and PORTAL.war/ for unexpected .jsp, .jspx and .exe files, inspect PSEMHUB.war/envmetadata/transactions/, and look for unexpected MeshCentral agents.
• Check every WebLogic node, not only the first one found.
• If a web shell is found, treat the host as compromised, preserve evidence, and rotate all credentials reachable from the PeopleSoft tier. Start with hosts where WebLogic runs as root or SYSTEM.
• Hunt for theft: large .tar, .tar.gz or .zst files in temp or web-accessible directories, tar, zstd, rsync, sshpass or curl run by service accounts, bulk queries against HR, payroll and student tables, and large outbound transfers (rsync on TCP 873, SSH, HTTP POST).
• Prepare for extortion: UNC6240 steals data and threatens to publish it on a leak site.

Host paths to check, under <PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/: x.jsp, u.jsp, Ple64.exe, tunnel.jsp, tunnel.jspx.

MeshAgent artifacts: /tmp/meshagent, meshagent.msh, meshagent.db. Domains seen: azurenetfiles.net, microsoft-entra.net, enroll.azuredevice.cloud, and winmanage-me.network (104.219.234.138).

Google SecOps rules in the Mandiant Frontline Threats pack: Oracle PeopleSoft Configuration Inspection, Sshpass Interactive File Deployment, Data Archiving or Compression via Zstd Utility, MeshCentral Command Execution via Meshctrl. A rule for suspicious file writes to the web application archive directory is pending deployment.

Caveats

• Detections that depend on JSP file creation miss the fileless method.
• Hash and full network IOC tables are not in the post text. The IOCs are in a GTI collection for registered users.
• GTIG has asked Sectigo to revoke the EV certificate, and revocation status is not stated.
• The post does not name affected PeopleTools versions.