Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign

Extortion group ShinyHunters has launched a mass-exploitation campaign targeting Oracle PeopleSoft customers. This activity follows a previous incident where the group exploited a zero-day vulnerability in PeopleSoft, tracked as CVE-2026-35273, to achieve remote code execution without authentication. The recent wave of activity involves modifying the exploit to bypass web application firewall (WAF) rules protecting the Environment Management Hub (PSEMHUB) endpoint. ShinyHunters previously targeted over 100 PeopleSoft customers in June, including entities like the University of Nottingham, NAIC, and Nissan.
The attackers deployed web shells on numerous systems by bypassing WAF rules using URL encoding for the character 'P' in the request path containing '/PSEMHUB'. This technique allowed access to vulnerable servlet endpoints that were previously shielded by WAF rules. The hackers established persistence using JSP web shells and deployed the SideEye backdoor on Windows servers to steal credentials, manage files, and gain reverse shell capabilities. They also utilized open-source tools such as Neo-reGeorg for lateral movement and MeshCentral for internal discovery.
Customers are advised to apply Oracle patches for CVE-2026-35273, enhance security posture, search for indicators of compromise, and prepare for potential extortion demands, as the group has a pattern of data theft followed by threats to release stolen data publicly.

* Mandiant and Google Threat Intelligence Group (GTIG) warned about ShinyHunters launching a mass-exploitation campaign targeting Oracle PeopleSoft customers.
* PeopleSoft is an integrated enterprise resource planning (ERP) software suite used for finance, HR, payroll, and supply chain management across large enterprises.
* The hacking group previously exploited a zero-day vulnerability in PeopleSoft, tracked as CVE-2026-35273, to gain remote code execution without authentication.
* ShinyHunters targeted more than 100 PeopleSoft customers in June, including the University of Nottingham, NAIC, and Nissan.
* The new wave modified the exploit to bypass web application firewall (WAF) rules blocking the Environment Management Hub (PSEMHUB) endpoint.
* Attackers deployed web shells by using URL-encoded character '%50' for 'P' in the request path '/PSEMHUB'.
* Hackers used multiple POST requests or direct command output to spawn web shell processes on load-balanced environments.
* Persistence was established via two complementary, single-line JSP web shells and the SideEye backdoor on Windows servers.
* Attackers deployed Neo-reGeorg for internal discovery and lateral movement, and MeshCentral for remote management.
* Hackers executed commands with root or System privileges, abusing PeopleSoft and WebLogic service accounts to access application data and configuration files.
* PeopleSoft customers are advised to apply Oracle patches for CVE-2026-35273 and prepare for extortion demands.

The progression of the attack from exploiting a zero-day to modifying exploitation techniques to bypass security controls reveals a maturation in adversary tradecraft focused on persistence and data exfiltration through established enterprise systems. The shift from initial code execution to web shell deployment using WAF evasion suggests that threat actors are not solely focused on initial breach but on establishing long-term, stealthy access within complex environments where security tooling—like WAFs—can be circumvented via understanding application logic (e.g., URL decoding). This operational layering indicates a focus on maximizing dwell time and operational reach across diverse sectors, expanding from education to agriculture, government, and healthcare.
The pattern of using legitimate service accounts (PeopleSoft/WebLogic) for privilege escalation demonstrates an exploitation of inherent trust within enterprise architecture rather than relying solely on zero-day discovery. This leverages the implicit access granted by business function management systems to move laterally and exfiltrate sensitive data, which fuels the established extortion model observed in prior campaigns. The implication is that vulnerability remediation must extend beyond patching specific CVEs to addressing systemic architectural weaknesses regarding trust boundaries and internal segmentation.
What are the second-order consequences of adversaries successfully weaponizing existing, trusted application infrastructure for command and control? How does the focus on exploiting legacy ERP systems like PeopleSoft influence the perceived risk prioritization among organizations? If attackers reliably use public tooling for lateral movement (like MeshCentral) alongside custom backdoors, what responsibility do defenders bear in securing the entire operational stack rather than just patching the initial entry vector?