A single encoded character is letting ShinyHunters back into Oracle PeopleSoft servers that their owners thought were protected. Mandiant and Google Threat Intelligence Group (GTIG) report renewed mass exploitation of CVE-2026-35273 by UNC6240, the cluster Google tracks as ShinyHunters, with web shells now planted on dozens of systems worldwide.
It is the same flaw the ShinyHunters crew used as a zero-day between May 27 and June 9, 2026, mostly against universities, as we reported in June. Oracle shipped an out-of-band Security Alert on June 10. This time GTIG counts higher education, technology, IT services, healthcare, agriculture, transportation and government among the targets.
One character defeats the firewall rule
After the June campaign, Mandiant advised organizations that could not patch right away to block external access to the vulnerable Environment Management Hub (PSEMHUB) endpoint at the perimeter. Many did that with web application firewall (WAF) rules that match the literal path /PSEMHUB/.
UNC6240 adapted. It now requests /%50SEMHUB/ instead, where %50 is simply the URL-encoded form of the letter P. According to GTIG, many WAF and reverse proxy rules check the raw path before decoding it, while the PeopleSoft application server decodes the request and routes it straight to the vulnerable servlet. Organizations that added a WAF rule but never applied Oracle's patch were exposed all over again, and the researchers say defenders should assume any percent-encoded, mixed-case or otherwise non-normalized variant of the path may be used.
From a quiet probe to a signed backdoor
GTIG describes a consistent sequence. Targeted servers typically first received five to 15 POST requests carrying a serialized Java object. Unpatched hosts answer with their operating system without writing files, quietly confirming they are exploitable. Exploitation then took one of two paths, both abusing Java deserialization (unsafe handling of data that an application turns back into live objects) in the hub servlet: dropping JSP web shells such as x.jsp and u.jsp into the PSEMHUB.war directory, or running commands filelessly, with output returned directly in the HTTP response.
Bursts of repeated requests likely seed a web shell on every node behind a load balancer, GTIG says, so check all WebLogic nodes. On Windows servers the upload shell was used to stage Ple64.exe, a 5.2 MB trojanized installer posing as the Light Alloy media player and signed with a valid Extended Validation certificate issued to Tobias Weihmann Software Development OU via Sectigo. The installer loads a C++ backdoor GTIG tracks as SIDEEYE, which supports credential theft from browsers and desktop applications, file and process management, and a reverse shell and proxy. The crew also deployed the open-source Neo-reGeorg tunneling kit and, on Linux hosts, the legitimate MeshAgent remote management tool. About a quarter of the commands GTIG observed ran as root or NT Authority\SYSTEM.
GTIG warns that UNC6240 has a well-established pattern of stealing data and threatening to publish it on a leak site unless a ransom is paid, and that affected organizations should prepare for extortion demands.
Patch CVE-2026-35273, then hunt for %50SEMHUB
- Apply Oracle's Security Alert patch for CVE-2026-35273. GTIG is explicit that WAF rules are no substitute.
- Disable the EMHub service in multi-server configurations, or remove the PSEMHUB application in single-server ones.
- Search WebLogic access logs for /PSEMHUB/ and encoded variants such as /%50SEMHUB/, especially POST requests to /hub and requests for .jsp files from external IP addresses.
- Alert on shell processes spawned by the WebLogic Java process. Detections that only watch for new JSP files will miss the fileless method.
- Treat any host with a web shell as compromised and rotate every credential readable from the PeopleSoft tier, including database connection strings in psappsrv.cfg.
Indicators
- 5[.]199[.]162[.]157 (attack controller, scanner and callback receiver)
- 104[.]219[.]234[.]138 and winmanage-me[.]network (exfiltration staging and MeshCentral infrastructure)
- 162[.]219[.]30[.]165 (SIDEEYE command and control, TCP ports 3333 and 3334)
- Ple64.exe SHA-256: 3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3
The lesson reaches well beyond PeopleSoft. A WAF rule written against a literal string is a bet that attackers will spell their request the same way every time, and a crew that reads published defensive guidance has just shown it will not.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.