Google Warns ShinyHunters Is Exploiting Oracle PeopleSoft in a New Campaign
Summary
Google says ShinyHunters is modifying a PeopleSoft exploit to bypass WAF rules, deploying web shells and other tools. It advises customers to patch CVE-2026-35273, investigate for compromise and data theft, and prepare for possible extortion.
Key points
- Google attributes the campaign to ShinyHunters, tracked as UNC6240, and says it targets Oracle PeopleSoft customers across multiple sectors.
- The group reportedly modified its exploit for CVE-2026-35273 to bypass WAF rules by using “%50” in requests to the “/PSEMHUB” endpoint.
- Attackers deployed JSP web shells and the SideEye backdoor, which can steal credentials and manage files and processes.
- Google also observed use of Neo-reGeorg for tunneling and internal discovery, and MeshCentral for remote management.
- Attackers used privileged commands and PeopleSoft and WebLogic service accounts to access application data, configuration files, and database connection strings.
- Google advises customers to apply Oracle’s patches, harden systems, hunt for compromise and data theft, and prepare for possible extortion.
Article Details
- Attack Vectors
- Modified exploit targeting the vulnerable PeopleSoft Environment Management Hub (PSEMHUB) endpoint, using '%50' in the request path to bypass WAF rules that match the literal path before URL decoding.
- POST requests were used to deploy JSP web shells across WebLogic nodes or to return command output directly in HTTP responses and spawn shell processes.
- SideEye was deployed on Windows servers to steal credentials from browsers and applications and provide reverse-shell and reverse-proxy capabilities.
- Neo-reGeorg was used for internal discovery and lateral movement; MeshCentral was also deployed.
- PeopleSoft and WebLogic service accounts were abused to access application data, configuration files, and database connection strings.
- Defensive Notes
- Apply Oracle's patches for CVE-2026-35273 and harden PeopleSoft environments.
- Hunt for potential indicators of compromise and data theft.
- Prepare for extortion communications and monitor for possible public exposure of stolen data.
MITRE ATT&CK
T1005 · Data from Local SystemThe group accessed application data, configuration files, and database connection strings through PeopleSoft and WebLogic service accounts.T1021 · Remote ServicesThe attackers used Neo-reGeorg for lateral movement.T1059 · Command and Scripting InterpreterThe attackers executed commands with root or System privileges for host and user discovery and process verification.T1071 · Application Layer ProtocolSideEye provided reverse-shell and reverse-proxy capabilities.T1087 · Account DiscoveryThe attackers used commands for host and user discovery.T1190 · Exploit Public-Facing ApplicationUNC6240 modified its exploit to reach the vulnerable PeopleSoft PSEMHUB endpoint remotely and bypass WAF rules.T1505.003 · Web ShellMandiant and GTIG observed the group establishing persistence with single-line JSP web shells.T1555 · Credentials from Password StoresSideEye was deployed to steal credentials from browsers and applications.T1657 · Financial TheftUNC6240's described pattern is stealing victim data and threatening publication unless ransom is paid.
CVE
Threat Actors
Malware
Vendors
Products
PeopleSoftMandiant and Google Threat Intelligence Group (GTIG) over the weekend warned that the notorious extortion group ShinyHunters has launched a fresh mass-exploitation campaign targeting Oracle PeopleSoft customers.WebLogicsome load-balanced environments, likely to ensure that a copy of the web shell is deployed on every WebLogic node, or sent POST requests that returned command output directly in the HTTP response to spawn the
Tools
MeshCentralAdditionally, the attackers deployed the open source Neo-reGeorg tunneling toolkit for internal discovery and lateral movement, and the open source remote management platform MeshCentral.Neo-reGeorgAdditionally, the attackers deployed the open source Neo-reGeorg tunneling toolkit for internal discovery and lateral movement, and the open source remote management platform MeshCentral.
Countries
Industries
Agricultureinitial PeopleSoft campaign focused on the education sector, the new wave of attacks has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations, Google says.EducationWhile ShinyHunters’ initial PeopleSoft campaign focused on the education sector, the new wave of attacks has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations,Governmentcampaign focused on the education sector, the new wave of attacks has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations, Google says.Healthcarefocused on the education sector, the new wave of attacks has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations, Google says.IT serviceson the education sector, the new wave of attacks has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations, Google says.Technologysector, the new wave of attacks has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations, Google says.Transportationnew wave of attacks has expanded to agriculture, government, healthcare, IT services, technology, and transportation organizations, Google says.