ShinyHunters Circumvents WAF Defenses in Fresh Wave of PeopleSoft Exploitation

The extortion group known as ShinyHunters, tracked by Mandiant and Google Threat Intelligence Group as UNC6240, has resumed mass exploitation operations against Oracle PeopleSoft environments running vulnerable PeopleTools versions 8.61 and 8.62. The activity exploits CVE-2026-35273, a critical unauthenticated remote code execution vulnerability rated CVSS 9.8 residing within the Updates Environment Management component, specifically the PeopleSoft Environment Management Hub (PSEMHUB). While Oracle issued an out-of-band security patch in June following an initial wave of attacks against higher education institutions, the threat actor recently evolved its approach to target unpatched organizations that attempted to mitigate the flaw using web application firewall (WAF) path-blocking rules instead of deploying the official update. Attackers bypassed perimeter appliances by submitting requests to `/%50SEMHUB/` rather than the literal `/PSEMHUB/` URI path, taking advantage of path normalization discrepancies where reverse proxies inspect pre-decoded strings while backend WebLogic servers decode the hex-encoded `%50` into the letter `P` and route the payload to the vulnerable servlet. Initial compromise involves sending serialized Java objects via HTTP POST requests to the `/%50SEMHUB/hub` endpoint to validate whether the instance is vulnerable. Upon gaining access, operators drop single-line JSP web shells, such as `x.jsp` and `u.jsp`, directly into the PSEMHUB application directory to execute hex-encoded commands or stage chunked, Base64-encoded file uploads. On compromised Windows instances, the actor deploys a 5.2 MB trojanized Light Alloy installer named `Ple64.exe` (tracked as the SIDEEYE backdoor), which maintains distinct control and data streams over raw TCP ports 3333 and 3334 to execute reverse shell functionality, manage processes, and steal credentials. Linux systems were targeted with the legitimate remote-management agent `MeshAgent` dropping into `/tmp`, while the open-source SOCKS5 tunneling tool `Neo-reGeorg` was deployed across environments to facilitate internal network pivoting. Approximately one-fourth of the executed commands operated under `NT AUTHORITY\SYSTEM` or `root` privileges, allowing full administrative control over the underlying hosts. The ongoing campaign has extended beyond academia into healthcare, government, transportation, agriculture, technology, and IT services sectors to stage enterprise data for downstream extortion.