"This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint," Mandiant said.
Google is warning of a renewed, global campaign that weaponizes CVE-2026-35273 (CVSS 9.8) — a critical Oracle PeopleSoft vulnerability that permits unauthenticated remote code execution. The activity, which Google describes as linked to ShinyHunters and attributed by Mandiant to UNC6240 for the recent changes, has expanded beyond earlier academic targets and now touches higher education, technology, IT services, healthcare, agriculture, transportation and government systems, with web shells found on dozens of machines.
Mandiant and Google: how a small encoding trick defeated many WAFs
Mandiant explained that the campaign’s recent success rests on a deceptively simple bypass: URL-encoding a single character. Rather than requesting the vulnerable path /PSEMHUB/, the attackers requested /%50SEMHUB/. Many WAF and reverse-proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. That change allowed the same Java-deserialization exploit to reach the PSEMHUB hub servlet despite existing string-based WAF protections.
The full attack chain observed by defenders
- Identify susceptible targets by sending POST requests to "/%50SEMHUB/hub" containing a serialized Java object.
- Bypass WAF rules using an encoded capital P ("%50") in the POST request path.
- Abuse Java deserialization in the PSEMHUB hub servlet to deploy web shells and enable fileless command execution.
- Drop two JSP web shells into the PSEMHUB.war directory — "x.jsp" (cross-platform command execution) and "u.jsp" (chunked file uploads and command execution via cmd.exe) — a tactic intended to minimize WAF detection during post-exploitation.
- Use "u.jsp" to upload a valid, signed, trojanized installer ("Ple64.exe") that loads SIDEEYE, a C++ backdoor, and stage the open-source Neo-reGeorg tunneling toolkit.
- Establish persistent remote access on Linux systems by deploying the legitimate RMM tool MeshAgent, and move laterally over SSH using known username/password combinations.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePayloads, capabilities, and operational reach
The deployed Ple64.exe loads SIDEEYE, a C++ backdoor that communicates over TCP to 162.219.30[.]165 and provides a broad feature set for attackers, including browser and desktop credential theft, process and file management, interactive reverse shell and reverse proxy functions. Google also reported that about a quarter of the threat actor’s commands were executed as root or NT AUTHORITY\SYSTEM — giving full operating-system control — while the remainder ran under PeopleSoft or WebLogic service accounts.
Earlier exploitation as a zero-day focused on academic institutions and included reconnaissance, installation of remote-access software such as the MeshCentral agent for persistence, lateral movement over SSH, running shell scripts to connect to additional internal PeopleSoft machines, and data theft. Mandiant said it notified over 100 global organizations whose IP addresses matched vulnerable endpoints, most of which were located in the United States.
Affected sectors, extortion risks, and the ShinyHunters connection
Targets now span higher education, technology, IT services, healthcare, agriculture, transportation and government. Google cautioned that UNC6240 has a “well-established pattern of data theft extortion,” in which stolen information is threatened for public release unless a ransom is paid. Affected organizations should therefore prepare for extortion communications and monitor for potential public exposure of stolen data.
Separately, the disclosure arrives as ShinyHunters claimed responsibility for a breach of the U.S. FBI’s FBIJobs.gov portal and said it stole roughly 2–3 TB of sensitive data; the group told The Hacker News it used a different Oracle PeopleSoft zero-day to access the portal and denied any financial motive. “We want to reiterate and emphasise that we are NOT extorting the FBI,” a ShinyHunters spokesperson told The Hacker News. The group also said it originally operated as GnosticPlayers before rebranding to ShinyHunters in 2020.
What this means for security teams, procurement leaders, and higher education
- Security teams: prioritize applying the patch for CVE-2026-35273, hunt for JSP web shells in PSEMHUB.war and search WebLogic and PeopleSoft logs for /PSEMHUB/ and percent-encoded variants, and monitor outbound traffic from PeopleSoft hosts for connections to suspicious IPs such as 162.219.30[.]165.
- Procurement and operations leaders: consider the recommendation to disable the Environment Management Hub (EMHub) in multi-server setups or remove the PSEMHUB application entirely in single-server environments, and rotate credentials readable by the PeopleSoft application service account.
- Higher education administrators: review database audit logs for bulk queries or exports against HR, payroll and student records tables, and hunt hosts for large archive files left in temporary or web-accessible directories that may indicate exfiltration staging.
The campaign illustrates how low-complexity changes — a single percent-encoded character in a URL — can render widely deployed controls ineffective. Organizations with PeopleSoft exposed to the internet face a pointed, immediate decision: patch and remove or harden affected endpoints now, or risk web-shell deployments that have already translated into credential theft and extortion-ready data collection.
