Google Warns of ShinyHunters Fresh Oracle PeopleSoft Campaign

1. Executive summary

ShinyHunters (MITRE G1057, tracked by Google as UNC6240) has launched a second mass-exploitation campaign against Oracle PeopleSoft, modifying its exploit for CVE-2026-35273 to bypass WAF rules that block the vulnerable Environment Management Hub (PSEMHUB) endpoint. CVE-2026-35273 carries a CVSS score of 9.8 (CRITICAL), is listed in CISA KEV (added 2026-06-12), and has an EPSS of 9%; it is a CWE-306 missing-authentication flaw in the Environment Management component that yields unauthenticated remote code execution. The first wave, observed 27 May to 9 June 2026, hit more than 100 organisations, 68% of them higher-education institutions, and the new wave has broadened to agriculture, government, healthcare, IT services, technology and transportation. EMEA financial services running PeopleSoft for finance, HR, payroll or supply chain are in scope: the exploit reaches the application server even where operators believe a WAF rule has closed the exposure, and confirmed victims already include the University of Nottingham in the UK. Treat any internet-reachable PSEMHUB endpoint as compromised until proven otherwise.

2. Regulatory framing

No DORA Art. 17, 18, 24, 29 or 30, NIS2 Art. 21(2)(d), or UK NIS 2018 obligation is engaged by a fact distinctive to this item beyond the three rows above.

3. Technical analysis & attack chain

CVE-2026-35273 is a critical remote code execution vulnerability in the PeopleSoft Environment Management component, classified CWE-306 (missing authentication for a critical function). The verified reference data records CVSS 9.8, CISA KEV listing (added 2026-06-12) and EPSS 9%. The flaw was exploited as a zero-day: the first campaign ran 27 May to 9 June 2026, before Oracle's 10 June 2026 advisory. Oracle has since released a patch; Oracle has not stated publicly whether it treats the flaw as a zero-day, per SecurityWeek's coverage of the advisory.

Confirmed steps in the observed campaign:

1. Reconnaissance and targeting of internet-reachable PeopleSoft Environment Management Hub (PSEMHUB) endpoints. GTIG correlated over 100 global organisations with potentially vulnerable endpoints; 68% were higher-education institutions.
2. WAF bypass. The attackers place %50, the URL-encoded form of the character P, in the request path containing the string /PSEMHUB. Many WAF and reverse-proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. The request therefore reaches the endpoint on systems whose operators believed their WAF rules had mitigated the exposure.
3. Exploitation of CVE-2026-35273 for unauthenticated remote code execution against the Environment Management Hub.
4. Web shell deployment. The attackers deploy two complementary, single-line JSP web shells to establish persistence. In load-balanced environments they send multiple POST requests, likely to ensure a copy of the web shell lands on every WebLogic node; in other cases POST requests return command output directly in the HTTP response to spawn the shell processes.
5. Post-exploitation tooling. The attackers deploy the SideEye backdoor on Windows servers, which steals credentials from browsers and applications, manages files and processes, and provides reverse shell and reverse proxy capability. They also deploy the open-source Neo-reGeorg tunnelling toolkit for internal discovery and lateral movement, and the open-source MeshCentral remote management platform.
6. Privilege and account abuse. Commands are executed with root or System privileges for host and user discovery and process verification. The attackers abuse PeopleSoft and WebLogic service accounts to reach application data, configuration files and database connection strings.
7. Data theft and extortion. Stolen data was published on the ShinyHunters Data Leak Site (DLS) on 9 June 2026. Google describes UNC6240 as having a well-established pattern of data-theft extortion: stealing data and threatening release unless the victim pays.

The June staging infrastructure is documented in detail and is useful for retrospective hunting. GTIG triaged five sequential IP addresses, 142.11.200.186 through 142.11.200.190, which hosted Python SimpleHTTP servers on port 8888 exposing directory contents, staging materials, customised agents and attacker command histories. The staging hosts carried pre-configured Windows MeshCentral agent binaries disguised as Microsoft Azure services: meshagent32-azure-ops.exe, meshagent64-azure-ops.exe and meshagent64-v2.exe. Static analysis showed these agents hardcoded to communicate with the C2 server wss://azurenetfiles.net:443/agent.ashx; the domain azurenetfiles.net mimics legitimate Microsoft Azure NetApp Files endpoints. An unconfigured Linux meshagent binary was also staged, suggesting parameters were passed dynamically on the command line at deployment. The exposed .bash_history, identical across all five staging hosts, shows MeshCentral remote management server version 1.1.59 installed on 27 May 2026 at 22:14 UTC to establish the C2 staging environment. The staging environments also hosted a custom lateral movement and defacement script named [victim_abbreviation]_fanout.sh.

Confidence caveats. The technical detail above (WAF bypass mechanism, web shells, SideEye, Neo-reGeorg, MeshCentral, staging IPs and agent filenames) rests on the Mandiant/GTIG report and Google's warning as relayed by SecurityWeek; it is single-sourced to Google's threat-intelligence teams and has not been independently corroborated in the material provided. The staging IPs and C2 domain are from June 2026 and may be stale; verify before enforcement. ShinyHunters' claim to have used a PeopleSoft zero-day in a recent attack on the FBI is unverified, and Google notes the group may be referring to this modified exploit rather than a new zero-day. The attribution of the activity to ShinyHunters/UNC6240 is Google's; the MITRE mapping to G1057 is from the verified reference data.

4. Mitigation & containment

P1 (within 24 hours)

• Apply Oracle's patch for CVE-2026-35273 to every PeopleSoft instance. This is the only fix that closes the flaw; the WAF bypass means a blocking rule on /PSEMHUB is not sufficient on its own.
• If patching cannot be completed immediately, remove internet reachability to the PSEMHUB endpoint entirely (network ACL or reverse-proxy deny at the edge, not a path-match rule) until the patch is applied.
• Hunt for the two single-line JSP web shells on every PeopleSoft/WebLogic node, including all nodes behind load balancers. Check for unexpected JSP files in the deployed web application directories and for POST requests returning command output in the HTTP response.
• Hunt for SideEye on Windows servers, and for Neo-reGeorg and MeshCentral artefacts. Check for the MeshCentral agent filenames meshagent32-azure-ops.exe, meshagent64-azure-ops.exe and meshagent64-v2.exe, and for outbound connections to azurenetfiles.net on 443.
• Rotate credentials for PeopleSoft and WebLogic service accounts, and for any database connection strings reachable from the compromised application, on the assumption they were read.

P2 (within 72 hours)

• Review WAF and reverse-proxy configuration for any rule that matches a literal path before URL decoding. Add decoding-aware normalisation so that %50-encoded paths cannot slip past a /PSEMHUB rule.
• Audit PeopleSoft and WebLogic service-account permissions and reduce them to the minimum the application needs; these accounts were the route to application data, configuration files and database connection strings.
• Search proxy and application logs for requests containing /PSEMHUB in any encoded form, and for repeated POST requests to the same path across load-balanced nodes.

P3 (within 7 days)

• Prepare for extortion. Google's guidance is explicit that affected organisations should prepare for extortion communications and monitor for public exposure of stolen data. Confirm who owns the extortion-response decision and the DLS monitoring.
• Confirm the PeopleSoft dependency and the service-account exposure are recorded in the third-party risk register (DORA Art. 28) and that the incident-reporting path for a confirmed compromise is tested.

5. Indicators of compromise

ipv4  142.11.200[.]186
ipv4  142.11.200[.]187
ipv4  142.11.200[.]188
ipv4  142.11.200[.]189
ipv4  142.11.200[.]190
domain  azurenetfiles[.]net
url  hxxps://azurenetfiles[.]net:443/agent[.]ashx
filename  meshagent32-azure-ops.exe
filename  meshagent64-azure-ops.exe
filename  meshagent64-v2.exe
filename  [victim_abbreviation]_fanout.sh

The sources describe observable behaviours but no atomic file hashes. Behavioural indicators:

6. Detection

The sources give distinctive artefacts (the %50//PSEMHUB path pattern, the MeshCentral agent filenames, the C2 domain and path, the fanout script name), so detection rules are warranted. The YARA rule below targets the staged MeshCentral agent binaries and the fanout script by their distinctive strings; the Sigma rule targets the WAF-bypass request pattern and the C2 connection.

rule AT_ShinyHunters_PeopleSoft_Staging_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-28"
        reference = "https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/"
        description = "Detects ShinyHunters/UNC6240 PeopleSoft campaign staging artefacts: MeshCentral agents masquerading as Azure services and the fanout lateral movement script"
    strings:
        $agent1 = "meshagent32-azure-ops.exe" ascii wide
        $agent2 = "meshagent64-azure-ops.exe" ascii wide
        $agent3 = "meshagent64-v2.exe" ascii wide
        $c2     = "azurenetfiles.net" ascii wide
        $c2path = "/agent.ashx" ascii wide
        $fanout = "_fanout.sh" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of them
        or 3 of them
}

title: ShinyHunters PeopleSoft PSEMHUB WAF Bypass and MeshCentral C2
id: 8f3c1a2e-6b4d-4e9a-9c1f-2d7a5e0b3c11
status: experimental
description: Detects the URL-encoded PSEMHUB path used to bypass WAF rules in the ShinyHunters Oracle PeopleSoft campaign, and outbound connections to the MeshCentral C2 domain.
author: Adverse Trace
date: 2026-09-28
references:

    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/
    - https://www.securityweek.com/google-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign/
logsource:
    category: webserver
detection:
    selection_path:
        cs-uri-stem|contains:

            - '/PSEMHUB'
            - '%50SEMHUB'
    selection_method:
        cs-method: 'POST'
    condition: selection_path and selection_method
fields:

    - c-ip
    - cs-uri-stem
    - cs-method
falsepositives:

    - Legitimate administrative access to the Environment Management Hub
level: high
---
title: Outbound Connection to ShinyHunters MeshCentral C2 Domain
id: 2b9d4c7a-1e5f-4a8b-b6c2-9f0e3d8a7b44
status: experimental
description: Detects outbound TLS connections to the azurenetfiles.net domain used as MeshCentral C2 in the ShinyHunters Oracle PeopleSoft campaign.
author: Adverse Trace
date: 2026-09-28
references:

    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/
logsource:
    category: proxy
detection:
    selection:
        query|contains: 'azurenetfiles.net'
    condition: selection
fields:

    - src_ip
    - query
    - dest_port
falsepositives:

    - None expected; the domain mimics Microsoft Azure NetApp Files and is not a legitimate service endpoint
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

Threat actor context

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

7. Sources

• SecurityWeek, "Google Warns of ShinyHunters' Fresh Oracle PeopleSoft Campaign", https://www.securityweek.com/google-warns-of-shinyhunters-fresh-oracle-peoplesoft-campaign/, 2026-09-28.
• The Hacker News, "Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells", https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html.
• Mandiant / Google Threat Intelligence Group, "ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit", https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit/.
• Cybersecurity Dive, "ShinyHunters linked to exploitation of critical flaw in Oracle PeopleSoft", https://www.cybersecuritydive.com/news/shinyhunters-exploitation-critical-flaw-oracle-peoplesoft/822796/.
• SecurityWeek, "Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks", https://www.securityweek.com/oracle-addresses-peoplesoft-vulnerability-amid-reports-of-zero-day-attacks/.
• BleepingComputer, "Oracle mitigates PeopleSoft zero-day exploited in data theft attacks", https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/.
• BleepingComputer, "Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks", https://www.bleepingcomputer.com/news/security/oracle-peoplesoft-servers-hacked-in-shinyhunters-data-theft-attacks/.

8. Adverse Trace position

CVE-2026-35273 is CVSS 9.8 CRITICAL, in CISA KEV since 2026-06-12, with EPSS 9%, and it is under active exploitation in a data-theft extortion campaign that has already named UK victims. The WAF bypass is the part that changes client risk: organisations that believe a path-match rule has closed the exposure are still reachable, so the practical question is whether the patch is applied and whether the endpoint is internet-facing at all. We assess the technical detail as single-sourced to Google's threat-intelligence teams and will say so in any client briefing; the KEV status and severity are independently verified. We will monitor for updated staging infrastructure and any change to the exploit that moves beyond the %50 encoding, and we will re-issue this advisory if Google or Oracle publishes new technical detail or a revised patch. Clients running PeopleSoft should confirm patch status and internet exposure for PSEMHUB to Adverse Trace within 24 hours so we can prioritise support.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.