The extortion crew ShinyHunters — tracked by Google Threat Intelligence Group (GTIG) as UNC6240 — has restarted mass exploitation of CVE-2026-35273, a critical (CVSS 9.8) unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools. Oracle patched it as an emergency fix on June 10, 2026 after the group burned it as a zero-day.
The renewed wave defeats the defensive WAF rules organisations deployed after June by URL-encoding a single character: requesting /%50SEMHUB/ instead of /PSEMHUB/. Many WAFs match the literal path before decoding, so the rule misses — but Oracle WebLogic decodes the request and routes it straight to the vulnerable Environment Management Hub servlet.
Successful hits chain into JSP web shells, the SIDEEYE C++ backdoor (loaded by a trojanised Ple64.exe), Neo-reGeorg tunnels and legitimate MeshAgent RMM for persistence. If you run internet-facing PeopleSoft and relied on a WAF signature rather than the patch, treat yourself as exposed and hunt now.
◈ Table of Contents
01 · Threat Actor Profile
UNC6240ShinyHunters is a financially motivated data-theft and extortion collective, not a nation-state actor. GTIG clusters this PeopleSoft activity as UNC6240 and links it to the long-running ShinyHunters brand, which emerged from the earlier GnosticPlayers data-broker persona that rebranded in 2020. The group's business model is straightforward: breach, exfiltrate bulk data, then extort. What is new here is the operational discipline — a fast pivot from zero-day burn to a signature-defeating WAF bypass once defenders adapted.
| Attribute | Detail |
|---|---|
| Primary name | ShinyHunters |
| Google/GTIG cluster | UNC6240 |
| Historical persona | GnosticPlayers (rebranded to ShinyHunters, 2020) |
| Motivation | Financial — bulk data theft & extortion |
| Attribution confidence | Attribution to UNC6240/ShinyHunters per GTIG |
| First seen (this flaw) | Zero-day exploitation late May 2026 |
| Targeting | Higher education, technology, IT services, healthcare, agriculture, transportation, government |
| Notable claim | Alleged PeopleSoft-based intrusion at the FBI (Sept 22, 2026), unconfirmed |
ShinyHunters is an extortion actor. A PeopleSoft box is not the prize — it is the pivot into HR, finance and identity data. Assume any confirmed web shell is a precursor to bulk database export, not an isolated event.
02 · Disclosure & Campaign Timeline
May → Sept 2026The story splits into two acts: a zero-day burn in late spring, and a renewed wave in September that specifically engineers around the mitigations defenders put up after Oracle's patch.
- 1Late May 2026 (≈May 27 – Jun 9): UNC6240 exploits the PSEMHUB flaw as a zero-day against internet-facing PeopleSoft.
- 2Jun 10, 2026: Oracle ships an emergency security update for the vulnerability.
- 3Jun 11, 2026:
CVE-2026-35273published in NVD at CVSS 9.8; GTIG confirms UNC6240 exploitation. - 4June 2026: Initial wave — over 100 organisations notified of compromise.
- 5Sep 22, 2026: ShinyHunters publicly claims a PeopleSoft-based intrusion at the FBI; the agency acknowledges the claim but does not confirm the alleged multi-terabyte theft.
- 6Sep 26, 2026: GTIG/Mandiant report the renewed campaign using the
/%50SEMHUB/WAF bypass against dozens of systems worldwide.
The gap between "we patched" and "we are safe" is where this campaign lives. Several victims in the renewed wave had WAF rules for /PSEMHUB/ but had not applied the June PeopleTools update. The bypass only matters because the underlying host was still vulnerable.
03 · Initial Access & Affected Versions
PSEMHUBThe vulnerable component is the Environment Management Hub (PSEMHUB), a servlet used by PeopleSoft's Change Assistant / Environment Management framework. CVE-2026-35273 is classified CWE-306 (Missing Authentication for Critical Function): an unauthenticated attacker with only HTTP network access can reach the hub and drive it to full system takeover. There is no privilege or user-interaction requirement, which is why the CVSS vector is AV:N/AC:L/PR:N/UI:N and the base score sits at 9.8.
| Field | Value |
|---|---|
| CVE | CVE-2026-35273 CVSS 9.8 |
| CWE | CWE-306 — Missing Authentication for Critical Function |
| CVSS 3.1 vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Product | Oracle PeopleSoft Enterprise PeopleTools |
| Affected versions | PeopleTools 8.61, 8.62 |
| Vulnerable endpoint | /PSEMHUB/hub (and encoded variants) |
| Published (NVD) | 2026-06-11 · last modified 2026-07-23 |
| Exploitation status | Active in-the-wild (zero-day burn + renewed wave) |
If PSEMHUB is reachable from the internet, you have a pre-auth RCE surface. This servlet was never meant to be public — it is an internal environment-management endpoint. Exposure is the root cause; the WAF bypass is only the delivery trick.
04 · Technical Deep Dive: The WAF Bypass
The core trickThis is the phase that makes the campaign notable. The vulnerability itself is a Java deserialization sink in the PSEMHUB hub servlet — the attacker POSTs a serialized Java object and the servlet deserializes it, yielding code execution. That primitive is unchanged from June. What changed is how the request reaches the servlet without tripping the defensive rules everyone deployed.
The path-matching mismatch
After June, a common quick fix was a WAF rule blocking any request to /PSEMHUB/. Many WAF engines evaluate that rule against the raw, still-encoded request path. Oracle WebLogic, however, percent-decodes the path before routing. So the attacker encodes the leading P as %50:
The lesson is a classic parser-differential: two components in the request path disagree about what the path is. Any character in PSEMHUB can be encoded (%53=S, %45=E, %4D=M, %48=H, %42=B, %55=U), so a single hard-coded string signature is trivially defeated. A rule must normalise (URL-decode, case-fold, collapse) before matching.
Low-and-slow validation before weaponisation
GTIG observed the actor sending roughly 5–15 POST requests to the encoded hub endpoint to fingerprint vulnerable systems without disrupting them, before committing a payload. This keeps the noisy exploitation off hosts that are already patched and reduces the chance of tipping defenders early.
The dropped web shells
On a vulnerable host, the actor writes JSP web shells into the PSEMHUB.war deployment directory and executes commands in-memory. Each shell has a job:
| Artifact | Role |
|---|---|
| x.jsp | Cross-platform command execution shell |
| u.jsp / u2.jsp | Chunked file upload (stage further tooling) |
| tunnel.jsp / tunnel.jspx | Neo-reGeorg tunnel endpoint for internal proxying |
| Ple64.exe | ~5.2 MB trojanised installer masquerading as the Light Alloy media player; loads SIDEEYE |
Because commands run inside the WebLogic JVM, a meaningful share never touch disk as child processes. GTIG noted about a quarter of executed commands ran as root or NT AUTHORITY\SYSTEM; the rest ran under the PeopleSoft/WebLogic service account. Hunt in application logs and JVM behaviour, not only process-creation telemetry.
05 · Post-Exploitation & Lateral Movement
SIDEEYE · Neo-reGeorg · MeshAgentOnce execution is established, UNC6240 layers persistence and pivoting so that losing the web shell does not end the intrusion. The tooling is a deliberate mix of custom malware and legitimate software to blend into normal admin activity.
SIDEEYE Backdoor
A C++ implant delivered on Windows via the trojanised Ple64.exe. Capabilities: browser and application credential theft, file and process management, reverse shell, and SOCKS-style proxying of traffic into the internal network.
Neo-reGeorg Tunnels
Open-source tunneling toolkit dropped as tunnel.jsp / tunnel.jspx. Turns the compromised web server into an entry proxy so the actor can reach internal-only systems over the existing HTTPS channel.
MeshAgent / MeshCentral
On Linux hosts the actor installs legitimate MeshAgent RMM software for durable remote access — a living-off-trusted-software technique that evades naive malware signatures.
Bulk Data Access
Consistent with the extortion motive, responders should expect large archive staging in temp directories and bulk export activity against the PeopleSoft database as the ultimate objective.
MeshAgent and Neo-reGeorg are dual-use. Do not assume "it's just our RMM" — validate every MeshCentral/MeshAgent instance against your approved asset inventory, and treat unmanaged instances on a PeopleSoft host as hostile until proven otherwise.
06 · C2 Infrastructure
Pivot pointsReporting on the renewed wave surfaced at least one external server used for TCP command-and-control. Treat it as a hunting seed rather than a complete list — extortion actors rotate infrastructure quickly.
| Type | Indicator | Context |
|---|---|---|
| IPv4 (C2) | 162.219.30[.]165 | External server used for TCP communication (defanged) |
| Channel | HTTPS web shell + Neo-reGeorg | Internal proxying rides the existing web-server port |
| RMM | MeshAgent → MeshCentral | Persistence beacon on Linux hosts |
Do not just block the single IP and move on. Pivot on it in Censys/Shodan for shared TLS certs, hosting ASN and co-located infrastructure, then sweep your egress logs for any PeopleSoft/WebLogic host that ever talked to that neighbourhood.
07 · DFIR Investigation Steps
Responder runbookWork from the web tier inward. The goal of the first hour is to confirm/deny web-shell presence, preserve WebLogic logs before they roll, and scope whether the intrusion has already reached the database.
- 1Confirm exposure: is
/PSEMHUB/reachable from outside? If yes, block at the edge immediately (see Phase 11) before investigating. - 2Preserve WebLogic access + server logs now — copy them off-host. Grep for
/PSEMHUB/and percent-encoded variants (%50,%53, etc.). - 3Inspect the PSEMHUB.war directory for unexpected
.jsp/.jspxfiles — especiallyx.jsp,u.jsp,u2.jsp,tunnel.jsp. - 4Hunt the Windows host for
Ple64.exe(~5.2 MB) and any process masquerading as Light Alloy; the Linux host for unexpected MeshAgent. - 5Check egress to
162.219.30[.]165and any anomalous outbound from the PeopleSoft host. - 6Scope the database: review PeopleSoft DB audit logs for bulk/unusual exports — this is the extortion objective.
- 7Rotate credentials accessible from the host: PeopleSoft/WebLogic service accounts, DB creds, and any secrets SIDEEYE could have harvested.
- 8Assume timeline back to June: if unpatched, dwell time may extend to the original zero-day window. Widen log retention scope accordingly.
- WebLogic logs show POSTs to /PSEMHUB/hub or an encoded variant returning 200
- Unexpected JSP files exist in the PSEMHUB.war directory
- Ple64.exe or unmanaged MeshAgent is present on the host
- Outbound traffic to the reported C2 or unusual DB export activity is observed
08 · Indicators of Compromise
IOC tablesHost and network indicators from GTIG/Mandiant and BleepingComputer reporting. No public SHA-256 hashes were released for the web shells at time of writing; hunt on filenames, paths and behaviour, and generate your own hashes from recovered samples for internal blocking.
| Category | Indicator | Notes |
|---|---|---|
| Web shell | x.jsp | Cross-platform command execution |
| Web shell | u.jsp, u2.jsp | Chunked file upload |
| Tunnel | tunnel.jsp, tunnel.jspx | Neo-reGeorg endpoint |
| Dropper | Ple64.exe | ~5.2 MB, fake Light Alloy installer; loads SIDEEYE |
| Backdoor | SIDEEYE | C++ implant; creds, files, reverse shell, proxy |
| RMM | MeshAgent (MeshCentral) | Persistence on Linux hosts |
| Deploy path | PSEMHUB.war directory | Location of dropped JSP shells |
| Request URI | /PSEMHUB/hub · /%50SEMHUB/hub | Exploit endpoint + encoded bypass |
| Network (C2) | 162.219.30[.]165 | External TCP C2 (defanged) |
These filenames are cheap for the actor to change. Do not build your only detection on x.jsp/u.jsp strings — anchor on the request pattern to the hub servlet, unexpected files in PSEMHUB.war, and JVM-spawned shells.
09 · Detection & Hunt Queries
KQL · SPL · SigmaNormalise before you match. Decode percent-encoding, fold case and collapse duplicate slashes at ingest, then run these queries against the normalised URI field. That single pipeline change closes the entire class of encoding bypasses — not just %50.
10 · MITRE ATT&CK Mapping
Techniques| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Exploit Public-Facing Application (PSEMHUB deserialization) | T1190 |
| Defense Evasion | Obfuscated/Encoded request path to bypass WAF | T1027 |
| Execution | Command & Scripting Interpreter | T1059 |
| Persistence | Server Software Component: Web Shell | T1505.003 |
| Defense Evasion | Masquerading: Match Legitimate Name (Ple64.exe → Light Alloy) | T1036.005 |
| Command & Control | Remote Access Software (MeshAgent) | T1219 |
| Command & Control | Proxy: Internal / Multi-hop (Neo-reGeorg) | T1090 |
| Lateral Movement | Lateral Tool Transfer | T1570 |
| Credential Access | Credentials from Web Browsers (SIDEEYE) | T1555.003 |
| Collection | Data from Local System / bulk DB access | T1005 |
| Exfiltration | Exfiltration Over C2 / Web Service | T1567 |
11 · Mitigation & Hardening
Do these now- 1Patch, don't paper over: apply Oracle's June 2026 PeopleTools update for CVE-2026-35273. A WAF rule alone does not fix the underlying deserialization flaw.
- 2Remove PSEMHUB from the internet. Restrict
/PSEMHUB/*to internal management networks; it is not a user-facing endpoint. - 3Fix the WAF logic, not just the string: URL-decode, case-fold and normalise the path before rule evaluation so encoded variants like
/%50SEMHUB/are caught. - 4Hunt retroactively using the Phase 09 queries across your full log-retention window — exploitation predates the September reporting.
- 5Rotate exposed secrets: PeopleSoft/WebLogic service accounts, database credentials and anything SIDEEYE could reach.
- 6Baseline your RMM: inventory every MeshAgent/MeshCentral instance and remove any not explicitly approved.
- 7Monitor the database tier for bulk exports — that is the extortion endgame, and the earliest place to catch data theft in progress.
- PeopleTools is patched to a fixed release and PSEMHUB is not internet-reachable
- WAF normalises encoding before matching; encoded probes are blocked and logged
- No unexpected JSP files in PSEMHUB.war and no unmanaged MeshAgent present
- Service-account and DB credentials rotated post-eviction
Do not close the case on eviction alone. If bulk export occurred before you contained it, this becomes a data-breach and extortion matter — engage legal, notify per your obligations, and prepare for a leak-site threat.
12 · Sources & References
Primary◈ Run the IOCs against your estate
Paste the filenames, paths and the C2 IP from this report into the CyberHawk IOC Scanner to sweep your environment, and track this actor on our Threat Intel feed. If you operate internet-facing PeopleSoft, patch CVE-2026-35273 first, then hunt with the Phase 09 queries.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."