Image: files.cyberriskalliance.com · rights & removal
Executive Summary
The Google Threat Intelligence Group warned that the threat group ShinyHunters launched an expanded campaign targeting vulnerable Oracle PeopleSoft instances by exploiting a flaw in Oracle PeopleSoft known as CVE-2026-35273. This exploit targeted a missing authentication flaw, which was present as a zero-day between May 27 and June 9, before being patched on June 10. The group has since expanded its targeting to other sectors and employed new techniques to compromise systems that remain unpatched. A key method observed involved bypassing Web Application Firewall (WAF) rules by using URL-encoding of characters in the request path, specifically requesting /%50SEMHUB/ instead of /PSEMHUB/, which allowed requests to reach vulnerable endpoints in WebLogic.
ShinyHunters has reportedly deployed web shells and achieved fileless command execution via these exploits on unpatched systems across sectors including higher education, technology, healthcare, agriculture, transportation, and government globally, deploying webshells on at least dozens of systems. The threat group also utilized a second web shell to stage payloads, including a trojanized installer named Ple64.exe that ultimately deployed the SIDEEYE C++ backdoor for credential theft and remote control. Furthermore, ShinyHunters deployed the Neo-reGeorg tunneling kit and MeshAgent on Linux hosts for internal discovery and lateral movement.
Facts Only
* The Google Threat Intelligence Group (GTIG) warned about a campaign by ShinyHunters targeting vulnerable Oracle PeopleSoft instances.
* ShinyHunters exploited a flaw in Oracle PeopleSoft known as CVE-2026-35273, which was a missing authentication flaw.
* The vulnerability was present as a zero-day between May 27 and June 9 and patched on June 10.
* ShinyHunters bypassed Web Application Firewall (WAF) rules by using URL-encoding of characters in the request path, specifically requesting /%50SEMHUB/ to evade string-based rules.
* The exploitation allowed attackers to deploy web shells and achieve fileless command execution via POST requests.
* Web shells deployed included "x.jsp" for command execution and "u.jsp" or "u2.jsp" for staging binaries, including a trojanized installer named Ple64.exe.
* Ple64.exe loaded a second-stage launcher that executed the SIDEEYE C++ backdoor, which facilitates credential theft and remote control.
* ShinyHunters deployed the Neo-reGeorg tunneling kit and MeshAgent on Linux hosts for internal discovery and lateral movement.
* Targeted instances included systems in higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors globally.
* Defenders are recommended to patch CVE-2026-35273 immediately and disable EMHub/remove PSEMHUB if not in use.
Full Take
The narrative describes a sophisticated pivot where a known software flaw is leveraged through novel evasion techniques against layered security controls, demonstrating a shift from simple vulnerability exploitation to advanced persistence and exfiltration. The mechanism of using URL-encoding to bypass WAF rules illustrates a critical failure in defense-in-depth: relying solely on perimeter defenses (WAF) while overlooking application-level interaction with the underlying application logic (WebLogic decoding). This pattern suggests that patching technical vulnerabilities alone is insufficient; control over how applications process input—the interface between the application and the network—is equally vital. The deployment of multi-stage persistence mechanisms (web shells leading to binary execution, then a backdoor like SIDEEYE) followed by internal reconnaissance tools (Neo-reGeorg/MeshAgent) reflects an attacker mindset focused on long-term access rather than a single intrusion point. The extortion aspect further solidifies that the ultimate goal is not just compromise, but demonstrable leverage over data. The implication for organizations is that security posture must evolve from simple patching compliance to auditing the full lifecycle of application interaction and internal network monitoring, treating all application endpoints as potential vectors for manipulation, rather than trusting perimeter controls implicitly.
Bridge Questions: If WAF rules are demonstrably ineffective against encoded requests, what systemic changes are required in how application frameworks handle input sanitization across disparate platforms? How should organizations re-evaluate the dependency on vendor-supplied patching schedules when sophisticated exploitation relies on zero-day mechanics and network bypasses? What mechanisms must be established to ensure that internal reconnaissance activities, like those involving RMM tools, are prioritized alongside known external threat indicators?
From the original · SC Magazine
Google Threat Intelligence Group (GTIG) warned Friday that the threat group known as ShinyHunters has launched an expanded campaign targeting vulnerable Oracle PeopleSoft instances, as the FBI investigates claims the group hacked its systems via the same software. GTIG says ShinyHunters, which it tracks as UNC6240, exploited a flaw in Oracle PeopleSoft known as CVE-2026-35273.Read the full story at scworld.com
Sentinel — Human
The text reads like a detailed technical briefing synthesizing threat intelligence, showing high fidelity in technical details but lacking the overly generalized tone often seen in pure AI output.