ShinyHunters Resumes Oracle PeopleSoft Attacks with WAF-Bypassing Exploit
Mandiant and Google Threat Intelligence Group (GTIG) issued a joint warning over the weekend that the extortion-focused hacking group ShinyHunters has launched a renewed mass-exploitation campaign targeting Oracle PeopleSoft customers. The campaign involves a modified exploit for a previously disclosed zero-day vulnerability tracked as CVE-2026-35273, which allows unauthenticated remote code execution.
Oracle PeopleSoft is a widely used enterprise resource planning (ERP) suite deployed by large organizations to manage critical functions such as finance, human resources, payroll, and supply chain operations. Google’s alert follows a prior wave of activity in June, during which ShinyHunters — tracked by Google as UNC6240 — compromised more than 100 PeopleSoft instances, including victims like the University of Nottingham in the UK, the National Association of Insurance Commissioners (NAIC), and Nissan.
Attackers Modify Exploit to Evade Web Application Firewalls
According to Mandiant and GTIG, the current wave of attacks stems from UNC6240 altering its exploit to bypass web application firewall (WAF) rules that were previously blocking access to the vulnerable Environment Management Hub (PSEMHUB) endpoint. The attackers achieve this by using URL-encoded characters — specifically ‘%50’, the encoded form of the letter ‘P’ — in the request path.
Many WAF and reverse proxy systems inspect the literal path before URL decoding, meaning they block requests containing plaintext strings like ‘/PSEMHUB’. However, the PeopleSoft application server decodes the incoming request after it passes through the WAF, allowing the malicious payload to reach the vulnerable servlet. This technique enables threat actors to exploit systems where administrators believed WAF rules had mitigated the risk.
Web Shells, Backdoors, and Lateral Movement Tools Deployed
In the ongoing campaign, ShinyHunters has been deploying web shells on dozens of compromised systems after bypassing WAF protections. The attackers use one of two methods: sending multiple POST requests to ensure web shell deployment across all nodes in load-balanced WebLogic environments, or issuing POST requests that return command output directly in the HTTP response to spawn shell processes.
Mandiant and GTIG observed the group establishing persistence through two complementary, single-line JSP web shells. Additionally, they deployed the SideEye backdoor on Windows servers, which enables credential theft from browsers and applications, file and process management, and reverse shell or reverse proxy capabilities.
For internal discovery and lateral movement, the attackers used the open-source Neo-reGeorg tunneling toolkit and the remote management platform MeshCentral. Commands were executed with root or System privileges to conduct host and user discovery, verify running processes, and abuse PeopleSoft and WebLogic service accounts to access application data, configuration files, and database connection strings.
Extortion Risk Remains High Following Data Theft
Google and Mandiant emphasize that UNC6240 follows a consistent pattern of data theft followed by extortion. The group steals sensitive information and threatens to publish it on leak sites unless a ransom is paid. Organizations affected by this campaign should prepare for potential extortion communications and monitor for signs of public data exposure.
To mitigate risk, PeopleSoft customers are urged to apply Oracle’s official patches for CVE-2026-35273, harden their environments against similar bypass techniques, conduct thorough hunts for indicators of compromise (IoCs), and assess for signs of data theft. Proactive monitoring and incident response planning are critical given the group’s history of leveraging stolen data for financial extortion.
Source: SecurityWeek