Google Reports UNC6240 Campaign Bypassing WAFs to Exploit Oracle PeopleSoft Flaw
Summary
Google reports renewed exploitation of Oracle PeopleSoft CVE-2026-35273, with UNC6240-linked attackers using an encoded path to bypass WAFs, deploy web shells, and steal data across multiple sectors.
Key points
- Attackers bypassed string-based WAF rules by requesting the vulnerable endpoint as /%50SEMHUB/ instead of /PSEMHUB/.
- The exploit abuses Java deserialization in the PeopleSoft PSEMHUB servlet to deploy JSP web shells and enable command execution.
- Google attributes the activity to UNC6240 and reports SIDEEYE, Neo-ReGeorg, and MeshAgent use for credential theft, tunneling, and persistence.
- Targets span higher education, technology, IT services, healthcare, agriculture, transportation, and government; web shells were deployed on dozens of systems.
- Google recommends patching CVE-2026-35273, disabling or removing the Environment Management Hub, reviewing logs and files for malicious artifacts, rotating exposed credentials, and monitoring outbound traffic.
- The article separately reports ShinyHunters' claim that it breached FBIJobs.gov and stole 2–3 TB of data; the group said it used a different PeopleSoft zero-day.
Article Details
- Attack Vectors
- Attackers sent POST requests containing serialized Java objects to the PeopleSoft PSEMHUB endpoint, URL-encoding the initial “P” as “%50” to bypass literal-path WAF and reverse-proxy rules.
- Abuse of Java deserialization in the PSEMHUB hub servlet enabled web-shell deployment and fileless command execution.
- Two JSP web shells, x.jsp and u.jsp, were placed in the PSEMHUB.war directory; u.jsp supported chunked file uploads and command execution.
- A trojanized installer, Ple64.exe, loaded the SIDEEYE backdoor in memory. The article also reports staging of the Neo-reGeorg tunneling toolkit and deployment of MeshAgent for persistent access on Linux systems.
- The article describes SSH lateral movement and data theft in earlier exploitation, and says the renewed campaign deployed web shells on dozens of systems.
- Defensive Notes
- Apply patches for CVE-2026-35273.
- Disable the Environment Management Hub service in multi-server configurations, or remove the PSEMHUB application in single-server configurations.
- Search WebLogic access logs for /PSEMHUB/ requests and percent-encoded variants.
- Inspect PSEMHUB.war for JSP web shells and other malicious artifacts.
- Rotate credentials readable by the PeopleSoft application service account.
- Hunt PeopleSoft and database hosts for large archive files in temporary or web-accessible directories, and review database audit logs for bulk queries or exports involving HR, payroll, and student records.
- Monitor outbound traffic from PeopleSoft hosts and prepare for possible extortion communications or public exposure of stolen data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 162[.]219[.]30[.]165 | External server contacted by the SIDEEYE backdoor over TCP. |
MITRE ATT&CK
T1005 · Data from Local SystemThe article reports theft of data from affected organizations' systems.T1021.004 · SSHEarlier exploitation included lateral movement over SSH to other internal PeopleSoft machines.T1053 · Scheduled Task/JobThe article reports deployment of MeshAgent for persistent access, but does not specify a particular scheduling mechanism.T1059 · Command and Scripting InterpreterThe u.jsp web shell enabled command execution, including via cmd.exe.T1059.003 · Windows Command ShellThe u.jsp web shell is described as enabling command execution via cmd.exe.T1059.004 · Unix ShellThe article reports a shell script used to connect over SSH to other internal PeopleSoft machines.T1090 · ProxySIDEEYE is described as providing reverse-proxy capabilities.T1105 · Ingress Tool TransferThe u.jsp web shell was used to upload Ple64.exe to the server.T1190 · Exploit Public-Facing ApplicationAttackers exploited the vulnerable PeopleSoft PSEMHUB servlet via POST requests to gain remote code execution.T1555 · Credentials from Password StoresSIDEEYE facilitated theft of credentials from browsers and desktop applications.
CVE
Threat Actors
ShinyHuntersThe article reports separate ShinyHunters claims of breaching FBIJobs.gov and stealing sensitive data; the group said it used a different Oracle PeopleSoft zero-day.UNC6240Google and Mandiant attribute the renewed PeopleSoft exploitation and deployment of web shells and related tooling to UNC6240.
Malware
Vendors
Products
MeshCentralin attacks against academic institutions to conduct reconnaissance, deploy remote access software like MeshCentral agent for persistence, move laterally over SSH, run a shell script to connect via SSH to other internalOracle PeopleSoftGoogle says UNC6240 and ShinyHunters-linked activity are driving renewed mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273, with attackers bypassing WAF controls, dropping web shells, and stealing data acrossWebLogicThe remaining commands have been found to be run under PeopleSoft or WebLogic service accounts.
Tools
Industries
Agriculturethe latest activity include entities spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors, with the attackers deploying web shells on dozens of systems.GovernmentThe campaign has affected higher education, healthcare, government, technology, and other organizations, while separate ShinyHunters claims mention a breach of FBIJobs.gov and theft of sensitive data.HealthcareThe campaign has affected higher education, healthcare, government, technology, and other organizations, while separate ShinyHunters claims mention a breach of FBIJobs.gov and theft of sensitive data.Higher EducationThe campaign has affected higher education, healthcare, government, technology, and other organizations, while separate ShinyHunters claims mention a breach of FBIJobs.gov and theft of sensitive data.IT servicesTargets of the latest activity include entities spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors, with the attackers deploying web shells on dozens ofTechnologyThe campaign has affected higher education, healthcare, government, technology, and other organizations, while separate ShinyHunters claims mention a breach of FBIJobs.gov and theft of sensitive data.Transportationinclude entities spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors, with the attackers deploying web shells on dozens of systems.