UNC6240 Bypasses PeopleSoft WAF Rules to Deploy Web Shells

Google Threat Intelligence and Mandiant report a renewed campaign exploiting Oracle PeopleSoft environments through CVE-2026-35273. The activity is attributed in the research to UNC6240, which Mandiant associates with ShinyHunters. Unlike the earlier wave described by the researchers, the newer campaign uses URL-encoded request paths to evade literal, path-based web application firewall rules.

The report describes activity across multiple sectors and regions, including higher education, technology, IT services, healthcare, agriculture, transportation, and government. Mandiant says the observed intrusions progressed from exploit validation to web-shell deployment and hands-on-keyboard activity. In some cases, the operators also deployed a trojanized executable, tunneling software, and legitimate remote-management tooling.

The central defensive lesson is straightforward: a WAF rule that blocks only the literal /PSEMHUB/ path is not an adequate substitute for patching or removing the exposed service. Organizations should treat encoded and otherwise non-normalized representations of the path as equivalent, while prioritizing Oracle’s security guidance and forensic review of every affected WebLogic node.

What Mandiant observed

According to Google Threat Intelligence and Mandiant, the campaign abuses the Environment Management Hub servlet in PeopleSoft. The researchers observed attackers sending approximately five to 15 POST requests to /%50SEMHUB/hub before exploitation. The sequence contained a serialized Java object and, on unpatched systems, typically elicited a response identifying the host operating system without immediately writing a file.

Mandiant assesses that this behavior allowed the operators to verify whether a server was exploitable before committing to a fuller intrusion. A validation request may therefore appear in access logs without a subsequent web shell or other obvious artifact. The absence of follow-on activity does not, by itself, establish that the system was unaffected.

The bypass relies on a normalization difference between perimeter infrastructure and the application. The character P is represented by %50 in the encoded path. Rules that search for the literal string /PSEMHUB/ may fail to match the request before decoding, while the WebLogic application decodes the path and routes it to the vulnerable servlet.

The researchers say they observed two exploitation outcomes. In one, the operators wrote JSP web shells into the PeopleSoft application archive. In the other, they executed commands without creating a file, with command output returned directly in the HTTP response. The fileless method is important operationally because a hunt limited to newly created JSP files can miss the intrusion.

Web shells and payload staging

Mandiant identified two complementary JSP components. The primary shell, commonly named x.jsp, supports command execution on both Windows and Linux systems. It accepts commands through an HTTP POST parameter using hexadecimal encoding rather than cleartext command strings. The shell detects the operating system and starts either cmd.exe or a Unix shell, then returns command output to the requester.

A second component, typically u.jsp or an offset-based variant called u2.jsp, supports chunked file transfer and execution on Windows hosts. The servlet decodes Base64-encoded file fragments and writes or appends them to a selected path. Mandiant observed the technique being used to overcome request-size limitations and stage a larger executable in relatively small pieces.

The report identifies the staged file as Ple64.exe, a 5.2 MB executable tracked by the researchers as SIDEEYE. Although it masqueraded as an installer for the Light Alloy media player, analysis described by GTIG found that it was a trojanized installer containing a multi-stage chain. The first stage loads a protected launcher in memory, which decrypts and loads the final SIDEEYE backdoor in memory.

GTIG’s initial analysis indicates that SIDEEYE can steal credentials from browsers and desktop applications, manage processes and files, provide an interactive reverse shell, and support reverse-proxy functionality. The analyzed sample communicated with 162[.]219[.]30[.]165 over raw TCP using ports 3333 and 3334 for separate control and data traffic. The researchers also reported that the executable carried a valid Extended Validation certificate and said they had contacted the certificate issuer regarding revocation.

Persistence, tunneling, and operator activity

On compromised Linux systems, the campaign used MeshAgent, a legitimate remote-management component associated with MeshCentral, to maintain interactive access. Earlier intrusions described by Mandiant placed agent files and configuration data in /tmp under the PeopleSoft service account. The report links observed activity to infrastructure that included the domains azurenetfiles[.]net, microsoft-entra[.]net, and enroll[.]azuredevice[.]cloud. In September activity, the researchers also identified winmanage-me[.]network, resolving to 104[.]219[.]234[.]138, as staging and management infrastructure.

The operators additionally deployed Neo-reGeorg tunneling components named tunnel.jsp and tunnel.jspx. Mandiant says the tooling can route SOCKS5 traffic through ordinary HTTP or HTTPS connections to the web tier, creating a means for internal discovery and lateral movement from the PeopleSoft host.

Observed commands included host and account discovery, process enumeration, and payload verification. Examples included hostname, whoami, tasklist, and checks to confirm that Ple64.exe remained active. Mandiant reports that roughly one quarter of observed commands ran with root or NT Authority\SYSTEM privileges. Other commands ran under PeopleSoft or WebLogic service accounts, which still had access to application data, configuration files, and database connection information.

The report identifies a broader risk of data theft and extortion. Mandiant recommends reviewing database activity for bulk queries or exports involving human-resources, payroll, and student records, along with signs of archive creation and sustained outbound transfers. The research does not establish that every organization targeted in the campaign experienced data theft, so these activities should be treated as investigation priorities rather than assumed outcomes.

Confirmed findings and researcher assessments

Confirmed observations in the supplied research include exploitation of CVE-2026-35273 through the PSEMHUB servlet, encoded path requests, deployment of the named JSP files and tunneling components, use of the SIDEEYE-delivering Ple64.exe sample, and connections to the listed network indicators. Mandiant also reports seeing fileless command execution and activity across multiple sectors.

Some conclusions are explicitly presented as assessments. The repeated exploit requests likely helped place a web shell on multiple nodes behind a load balancer. The validation sequence appears designed to test exploitability quietly. Mandiant also assesses that UNC6240 adapted its tooling after defensive guidance was published, targeting organizations that relied on WAF rules without patching or disabling the vulnerable component.

The supplied research does not provide a complete victim list, establish the impact for every targeted organization, or prove that every listed indicator remains active. It also does not establish that a particular system was exfiltrated merely because a web shell or tunneling component was found. Incident responders should preserve evidence and determine scope from host, application, database, identity, and network telemetry.

Detection and investigation priorities

• Search PIA and WebLogic access logs for both literal and encoded forms of the PSEMHUB path, including /%50SEMHUB/, POST requests to /hub, and externally sourced requests for unexpected JSP or JSPX files.
• Inspect every WebLogic node, not only the first system identified, for unexpected files under <PS_CFG_HOME>/webserv/<domain>/applications/peoplesoft/PSEMHUB.war/.
• Prioritize the filenames x.jsp, u.jsp, u2.jsp, tunnel.jsp, tunnel.jspx, and Ple64.exe, while recognizing that attackers can rename or modify them.
• Correlate WebLogic Java processes spawning cmd.exe, /bin/sh, or bash. Investigate related use of tasklist, curl, base64 -d, /dev/tcp, or background process launch commands.
• Look for MeshAgent or MeshCentral artifacts in temporary directories and for unexpected outbound connections from PeopleSoft hosts to 5[.]199[.]162[.]157, 104[.]219[.]234[.]138, and 162[.]219[.]30[.]165.
• Review database audit records, temporary directories, and web-accessible locations for large archives or processes involving tar, zstd, rsync, sshpass, or unusual HTTP POST activity.

Relevant file hashes published by Mandiant include SHA-256 values for the reported samples: x.jsp (48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494), u.jsp (2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7), tunnel.jsp (419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86), tunnel.jspx (ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07), and Ple64.exe (3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3). Mandiant notes that some JSP hashes may vary because of added newline characters or different keys.

What organizations should do now

1. Patch immediately. Apply Oracle’s security alert for CVE-2026-35273 and maintain supported PeopleTools versions. WAF filtering should be considered a compensating control, not remediation.
2. Remove or disable unnecessary exposure. Disable the Environment Management Hub service in multi-server deployments, or remove the PSEMHUB application in single-server deployments, following Oracle’s guidance. Restrict EMHub and Integration Broker administrative interfaces from the public internet.
3. Normalize before filtering. Ensure reverse proxies and WAF controls decode and canonicalize paths before applying access rules. Block equivalent encoded, mixed-case, and otherwise non-normalized representations of the vulnerable route.
4. Assume compromise when a web shell is found. Isolate affected hosts, preserve logs and volatile evidence where feasible, and examine all nodes behind load balancers.
5. Rotate exposed credentials. Prioritize database credentials in psappsrv.cfg, Integration Broker secrets, cloud credentials accessible from the web tier, and any credentials readable by the PeopleSoft service account.
6. Review privilege and egress controls. PeopleSoft and WebLogic services should not run with unnecessary root or SYSTEM privileges. Limit outbound connectivity from the application tier and monitor permitted destinations.
7. Prepare for possible extortion. Coordinate incident response, legal, privacy, and communications teams while investigating whether sensitive records were accessed or transferred.

Conclusion

The renewed PeopleSoft campaign demonstrates why literal URL blocking cannot stand in for vulnerability remediation. UNC6240’s reported use of encoded paths, fileless execution, application-archive web shells, tunneling, and remote-management tooling gives defenders several opportunities to detect activity—but only if application, host, identity, and network telemetry are examined together. Organizations operating PeopleSoft should patch or remove the vulnerable component, normalize requests before filtering, and conduct a full compromise assessment rather than relying on a single blocked-path rule.

Sources

Google Threat Intelligence / Mandiant: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft