ShinyHunters Evolves Exploitation of Oracle PeopleSoft, Bypassing WAFs
The threat group UNC6240, also known as ShinyHunters, has escalated its exploitation of Oracle PeopleSoft, developing new techniques to bypass web application firewall rules and broaden its targeting across multiple sectors.
Mandiant and Google Threat Intelligence have observed a renewed and expanded mass exploitation campaign by the threat group UNC6240, commonly known as ShinyHunters, targeting Oracle PeopleSoft systems via the critical CVE-2026-35273 vulnerability. This latest wave of activity represents an evolution from their previous campaign in June 2026, which predominantly affected academic institutions.
The primary innovation in this new campaign is ShinyHunters' sophisticated method for circumventing web application firewall (WAF) rules. By URL-encoding a single character within the request path, specifically encoding 'P' as '%50', the attackers are able to submit requests to the vulnerable Environment Management Hub (PSEMHUB) endpoint. Many WAFs and reverse proxies inspect the literal path before URL decoding, thus failing to detect the malicious request. However, the PeopleSoft application server correctly decodes the path and routes the request to the vulnerable servlet, allowing exploitation on systems that may have been considered protected by WAF configurations.
This WAF bypass technique has enabled ShinyHunters to significantly broaden their attack surface. The group has deployed web shells on dozens of systems globally, extending their reach beyond the education sector to include organizations in technology, IT services, healthcare, agriculture, transportation, and government. This widespread targeting underscores the critical nature of the vulnerability and the actor's adaptability in pursuing high-value targets.
Mandiant outlines a clear attack lifecycle observed in these incidents, beginning with target verification. Before deploying malicious payloads, attackers send several POST requests to the URL-encoded PSEMHUB endpoint. Unpatched servers respond with system information without writing files, allowing the threat actor to confirm exploitability discreetly. This reconnaissance phase is crucial for identifying vulnerable targets without triggering immediate alerts.
Following successful verification, the exploitation phase involves abusing Java deserialization within the PSEMHUB servlet. Two primary methods have been observed: web shell deployment, where JSP files like 'x.jsp' are created in the PSEMHUB.war directory to establish persistence, and fileless command execution, where command output is returned directly in the HTTP response without writing files to disk. The latter method is particularly stealthy, as it bypasses detections that rely on file creation.
Post-exploitation activities involve the deployment of dual web shells designed for stealth and persistence. The primary shell, 'x.jsp', facilitates cross-platform command execution by accepting commands in a less conspicuous manner than typical URL query strings. These shells are crucial for staging further payloads and maintaining access to compromised systems, often with minimal detection by security controls.
Mandiant strongly advises organizations running Oracle PeopleSoft to prioritize patching CVE-2026-35273 immediately, as WAF rules are not a substitute for timely security updates. Additional recommended actions include disabling the EMHub service or removing the PSEMHUB application, scrutinizing web server logs for suspicious requests, inspecting the PSEMHUB.war directory for unauthorized files, rotating credentials, and monitoring outbound network traffic for indicators of compromise, such as unexpected MeshCentral agents.
The renewed exploitation campaign highlights the persistent threat posed by ShinyHunters and the critical need for organizations to stay ahead of evolving attacker tactics. The group's ability to adapt its exploit to bypass common security measures like WAFs demonstrates a sophisticated understanding of defensive postures and a commitment to exploiting known vulnerabilities.