Google Threat Intelligence Group (GTIG) warned Friday that the threat group known as ShinyHunters has launched an expanded campaign targeting vulnerable Oracle PeopleSoft instances, as the FBI
investigates claims the group hacked its systems via the same software.
GTIG says ShinyHunters, which it tracks as UNC6240, exploited a flaw in Oracle PeopleSoft known as
CVE-2026-35273. ShinyHunters
previously exploited this critical missing authentication flaw as a zero-day between May 27 and June 9 in attacks against higher education institutions. The flaw was patched on June 10.
Now, GTIG says ShinyHunters has renewed its targeting of CVE-2026-35273, expanding the campaign to other sectors and using new techniques to compromise instances that have not yet been patched. Notably, the group found a way to bypass web application firewall (WAF) rules meant to protect vulnerable PeopleSoft Environment Management Hub (PSEMHUB) endpoints.
Threat researchers observed the attackers using URL-encoding of characters in the request path to defeat string-based WAF rules, specifically requesting /%50SEMHUB/ instead of /PSEMHUB/, where %50 encodes the letter P. Certain WAF rules will not catch this discrepancy and fail to block the requests, while WebLogic decodes the encoded character and serves the vulnerable application endpoint.
ShinyHunters has been leveraging this technique against unpatched Oracle PeopleSoft instances in higher education, technology, IT services, healthcare, agriculture, transportation and government sectors globally, Google reported, deploying webshells on at least dozens of systems.
The threat group previously claimed it had exploited an Oracle PeopleSoft zero-day in its recent attack on the FBI’s job portal,
according to 404 Media, though it's unclear whether the FBI attack was related to the techniques described by Google. The FBI was not mentioned in Google’s report, nor does the report identify any previously unknown zero-day.
The FBI has not released further details about the attack, in which its job portal was defaced with the ShinyHunters logo, but said it's investigating the incident. ShinyHunters claims to have stolen more than 2 terabytes of data encompassing sensitive information on thousands of FBI agents, and has threatened to release the data if the FBI doesn’t retract a previous
PSA about the group.
ShinyHunters drops web shells on unpatched PeopleSoft instances
Targeted instances are first probed with five to 15 POST requests to /%50SEMHUB/hub, which allows the attackers to confirm exploitability without writing files, although organizations can discover this activity by reviewing logs, GTIG said.
After a successful firewall bypass and exploitation of CVE-2026-35273 on unpatched systems, ShinyHunters was observed deploying web shells as well as achieving fileless command execution via POST requests.
Two web shells are deployed to establish persistence and stage additional payloads; the first is titled “x.jsp” and enables command execution across Windows and Linux by receiving hex-encoded commands via POST.
Another web shell, titled “u.jsp” or “u2.jsp”, is used for staging larger binaries on Windows hosts, decoding base64-encoded file chunks and appending them to the target path in 150 KB increments to bypass HTTP request size limits, Google said.
Attackers were observed using this second web shell to deploy a trojanized installer called Ple64.exe, which is disguised as an installer for the Light Alloy media player, signed with a valid certificate issued by Sectigo to “Tobias Weihmann Software Development OU.” This installer loads a second-stage launcher, which decrypts data embedded within Ple64.exe to load and execute the SIDEEYE C++ backdoor.
SIDEEYE provides credential theft from browsers and applications, process and file management and reverse shell and reverse proxy capabilities. GTIG said it has reached out to Sectigo to revoke the certificate for the trojanized installer.
In addition to the backdoor, ShinyHunters also deploys the Neo-reGeorg tunneling kit to enable further internal discovery and lateral movement from the compromised PeopleSoft host. On Linux hosts, the attackers deployed MeshAgent, a legitimate open-source remote monitoring and management (RMM) tool.
To defend against this latest wave of ShinyHunters attacks, GTIG recommends immediately patching CVE-2026-35273; organizations cannot assume placing a WAF in front of PSEMHUB is sufficient. The researchers also recommend disabling EMHub and removing the PSEMHUB application if it's not in use.
Defenders can monitor for signs of exploitation by searching PIA WebLogic access logs for requests to /%50SEMHUB/ and /PSEMHUB/, POST requests to /hub with external content and requests to unfamiliar .jsp and.jspx files under PSEMHUB or PORTAL, Google said. Shell processes spawned from WebLogic Java should also be monitored.
Teams should audit hosts for unusual files, especially x.jsp, u.jsp, tunnel.jsp, tunnel.jspx and Ple64.exe, within the PSEMHUB.war directory, unexpected MeshCentral agents, and monitor outbound traffic from PeopleSoft hosts for indicators of compromise included in GTIG’s report. They should also review PeopleSoft and database hosts for archive files staged in temporary or web-accessible directories, and for tar, zstd, rsync, sshpass and curl processes spawned from PeopleSoft or WebLogic service accounts, which are potentailly evidence of data exfiltration, the researchers said.
The report concludes by noting that ShinyHunters is known for its extortion attempts, demanding ransom to prevent stolen data from being published on its data leak site. Organizations that identify signs of exploitation should monitor for public data exposure and rotate all secrets accessible from PeopleSoft instances.