7 minhigh
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
ShinyHunters renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft, bypassing WAF rules via URL-encoded PSEMHUB paths to deploy web shells and SIDEEYE backdoor for data theft extortion. UNC6240 bypassed WAF protections by URL-encoding the PSEMHUB path (%50 replaces P), reaching vulnerable servlets on unpatched systems. The actor deployed JSP web shells, Neo-reGeorg tunnels, MeshAgent RMM, and the SIDEEYE backdoor (Ple64.exe) to establish persistent access, steal credentials, and exfiltrate data across education, healthcare, government, and other sectors.
Sens:■ Immediate
IOCs22
9file path5sha2564domain3ip1cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Apply Oracle Security Alert patch for CVE-2026-35273 immediately
- Disable EMHub service or remove PSEMHUB application entirely
- Block normalized /PSEMHUB/ paths at perimeter, not literal strings only
- Rotate all credentials accessible from PeopleSoft service accounts
Key Takeaways
- WAF bypass uses /%50SEMHUB/ to evade string-based path matching rules
- Two web shells: x.jsp (command execution) and u.jsp (chunked file upload) deployed in PSEMHUB.war
- Ple64.exe is trojanized Light Alloy installer with valid EV cert delivering SIDEEYE backdoor
- SIDEEYE C2 at 162.219.30.165 over TCP/3333 (control) and TCP/3334 (data)
- Microsoft-masquerading domains route MeshAgent traffic for persistent Linux access
Attack Chain
- Initial Access: CVE-2026-35273 exploited via PSEMHUB endpoint using URL-encoded WAF bypass (/%50SEMHUB/)
- Execution: JSP web shells (x.jsp, u.jsp) deployed for command execution and file staging
- Persistence: Neo-reGeorg tunnel servlets and MeshAgent RMM deployed for persistent access
- Command and Control: SIDEEYE backdoor (Ple64.exe) communicates over TCP/3333 and TCP/3334
- Discovery: Host and user discovery commands (hostname, whoami, tasklist) run via web shells
- Exfiltration: Data staged as archives and exfiltrated via rsync, SSH, and HTTP POST to attacker infrastructure
Affected Systems
- Oracle PeopleSoft with Environment Management Hub (PSEMHUB) enabled
- Oracle WebLogic application servers running PeopleSoft Internet Architecture
- Windows servers hosting PeopleSoft web tier
- Linux servers hosting PeopleSoft web tier
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-35273 | Oracle PeopleSoft Environment Management Hub (PSEMHUB) | Critical | Java deserialization flaw in PSEMHUB servlet allows unauthenticated remote code execution. |
Detection Availability
- Published: Other detection logic
- Platforms: Google Security Operations (Mandiant Frontline Threats rule pack)
Google SecOps rules in Mandiant Frontline Threats pack: PeopleSoft config inspection, sshpass deployment, zstd archiving, MeshCentral execution, suspicious WAR file writes.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Shell processes spawned by WebLogic are visible; JSP file writes and in-memory execution are less so. |
| Network Visibility | Medium | SIDEEYE raw TCP on non-standard ports visible; Neo-reGeorg and MeshAgent traffic disguised as HTTPS. |
| Detection Difficulty | Moderate | WAF bypass and fileless execution complicate detection; web shell and backdoor artifacts are identifiable with host auditing. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Shell processes (cmd.exe, /bin/sh) spawned by WebLogic Java process indicate web shell command execution (T1059.003, T1059.004) | EDR process ancestry with parent WebLogic Java | Execution | Low — WebLogic rarely spawns shells normally |
| Unexpected JSP or JSPL files written to PSEMHUB.war or PORTAL.war directories indicate web shell deployment (T1505.003) | File write events to WAR directories | Persistence | Low — WAR dirs should not receive runtime files |
| Outbound connections from PeopleSoft hosts to non-standard TCP ports 3333 or 3334 indicate SIDEEYE C2 (T1071) | Network firewall egress logs | Command and Control | Low — non-standard ports from web servers unusual |
| MeshAgent or MeshCentral binaries running under PeopleSoft service accounts indicate attacker-deployed RMM (T1219) | EDR process inventory and service account context | Persistence | Medium — legitimate RMM possible but uncommon |
Required Log Sources
- WebLogic PIA access logs
- EDR process telemetry
- Network firewall egress logs
- DNS resolution logs
- Database audit logs
- File integrity monitoring alerts
Key Behavioral Indicators
- WebLogic Java process spawning cmd.exe or /bin/sh
- JSP files in PSEMHUB.war not part of shipped product
- POST requests to /%50SEMHUB/hub with serialized Java objects
- Outbound TCP connections to ports 3333 or 3334 from PeopleSoft hosts
- MeshAgent binaries in /tmp under service accounts
- Large archive files in web-accessible temporary directories
Control Gaps
- WAF rules matching literal paths fail against URL-encoded variants
- Fileless command execution via deserialization leaves no file artifacts
- Chunked file upload via web shell bypasses HTTP request-size limits
- Credentials in PeopleSoft config files accessible to service accounts
- Load balancer distribution requires checking all WebLogic nodes
False Positive Assessment
Low — web shells and backdoor artifacts in PSEMHUB.war are anomalous; shell processes spawned by WebLogic are rare in normal operation.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict EMHub and Integration Broker from public internet access
- Enforce path normalization in WAF rules before string matching
- Monitor outbound traffic from PeopleSoft hosts to listed network indicators
- Block TCP ports 3333 and 3334 egress from PeopleSoft tier
User Protection
- Deploy EDR detection for WebLogic-spawned shell processes
- Scan PSEMHUB.war and PORTAL.war for unexpected JSP and EXE files
- Check for unexpected MeshCentral agents on all PeopleSoft hosts
- Review all WebLogic nodes behind load balancers, not just first
Security Awareness
- Prepare for extortion communications and monitor data leak sites
- Monitor for public exposure of stolen organizational data
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping15 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
Hackers are attacking organizations using Oracle PeopleSoft software by exploiting a known vulnerability that security filters were supposed to block. They bypassed the filters by slightly changing web addresses, letting them install hidden backdoors and steal data. Organizations in education, healthcare, government, and other sectors are affected. Apply Oracle's security patch immediately, disable unused services, and check systems for unauthorized files.
Additional IOCs
- File Hashes:
2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7(SHA256) - u.jsp chunked file upload and execution stager web shell419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86(SHA256) - tunnel.jsp Neo-reGeorg JSP tunneling servletba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07(SHA256) - tunnel.jspx Neo-reGeorg JSPX tunneling servlet
- File Paths:
applications/peoplesoft/PSEMHUB.war/x.jsp- Primary command execution web shell dropped by attackerapplications/peoplesoft/PSEMHUB.war/u.jsp- Chunked file upload stager web shell dropped by attackerapplications/peoplesoft/PSEMHUB.war/u2.jsp- Offset-based variant of u.jsp file upload stagerapplications/peoplesoft/PSEMHUB.war/Ple64.exe- SIDEEYE backdoor binary uploaded via u.jspapplications/peoplesoft/PSEMHUB.war/tunnel.jsp- Neo-reGeorg JSP tunneling servlet for SOCKS5 proxyapplications/peoplesoft/PSEMHUB.war/tunnel.jspx- Neo-reGeorg JSPX tunneling servlet for SOCKS5 proxy/tmp/meshagent- MeshAgent RMM binary dropped on Linux under service account/tmp/meshagent.msh- MeshAgent configuration file dropped on Linux/tmp/meshagent.db- MeshAgent database file dropped on Linux
- Command Lines:
- Purpose: Verify uploaded backdoor file size on disk | Tools:
cmd.exe| Stage: Execution |for %F in (<filepath>) do @echo %~zF - Purpose: Execute backdoor as background process | Tools:
cmd.exe| Stage: Execution |cmd.exe /c start /b "" <filepath> - Purpose: Verify backdoor process is running | Tools:
tasklist,findstr| Stage: Discovery |tasklist | findstr /i Ple64
- Purpose: Verify uploaded backdoor file size on disk | Tools:
Showing defanged values
- cveCVE-2026-35273Java deserialization flaw in PSEMHUB servlet allows unauthenticated remote code execution.
- domainazurenetfiles[.]netMicrosoft-masquerading domain routing MeshAgent traffic
- domainenroll[.]azuredevice[.]cloudMicrosoft-masquerading domain routing MeshAgent traffic
- domainmicrosoft-entra[.]netMicrosoft-masquerading domain routing MeshAgent traffic
- domainwinmanage-me[.]networkMeshCentral infrastructure resolving to 104.219.234.138
- file_pathapplications/peoplesoft/PSEMHUB.war/Ple64.exeSIDEEYE backdoor binary uploaded via u.jsp
- file_pathapplications/peoplesoft/PSEMHUB.war/tunnel.jspNeo-reGeorg JSP tunneling servlet for SOCKS5 proxy
- file_pathapplications/peoplesoft/PSEMHUB.war/tunnel.jspxNeo-reGeorg JSPX tunneling servlet for SOCKS5 proxy
- file_pathapplications/peoplesoft/PSEMHUB.war/u2.jspOffset-based variant of u.jsp file upload stager
- file_pathapplications/peoplesoft/PSEMHUB.war/u.jspChunked file upload stager web shell dropped by attacker
- file_pathapplications/peoplesoft/PSEMHUB.war/x.jspPrimary command execution web shell dropped by attacker
- file_path/tmp/meshagentMeshAgent RMM binary dropped on Linux under service account
- file_path/tmp/meshagent.dbMeshAgent database file dropped on Linux
- file_path/tmp/meshagent.mshMeshAgent configuration file dropped on Linux
- ip104[.]219[.]234[.]138Exfiltration staging and MeshAgent remote management host
- ip162[.]219[.]30[.]165SIDEEYE backdoor C2 server over raw TCP
- ip5[.]199[.]162[.]157Attack controller, scanner, and HTTP callback receiver
- sha2562bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7u.jsp chunked file upload and execution stager web shell
- sha2563ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3Ple64.exe trojanized installer delivering SIDEEYE backdoor
- sha256419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86tunnel.jsp Neo-reGeorg JSP tunneling servlet
- sha25648b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494x.jsp primary cross-platform command execution web shell
- sha256ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07tunnel.jspx Neo-reGeorg JSPX tunneling servlet