ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
ShinyHunters is mass-exploiting Oracle PeopleSoft CVE-2026-35273, bypassing WAF rules to plant web shells.
Mandiant and Google Threat Intelligence Group say UNC6240, also known as ShinyHunters, resumed mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273. The group requests /%50SEMHUB/ so WAF rules matching /PSEMHUB/ before URL decoding miss the Environment Management Hub servlet, then abuses Java deserialization to deploy JSP web shells or run fileless commands. Dozens of systems were hit across higher education, technology, IT services, healthcare, agriculture, transportation, and government. Oracle issued an out-of-band patch on June 10, 2026; Mandiant says WAF rules are not a substitute for patching.
- UNC6240 exploited CVE-2026-35273 as a zero-day in May–June 2026, mainly against universities.
- Attackers request /%50SEMHUB/ so literal-path WAF rules miss the vulnerable servlet.
- They drop JSP web shells such as x.jsp or run commands without writing files.
- Dozens of hosts across education, healthcare, government, and other sectors were hit.
- Patch CVE-2026-35273; path blocking alone does not stop encoded variants.
- CVEs
- CVE-2026-35273
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1059.003 Windows Command ShellT1059.004 Unix Shell
- Vendors
- Oracle
- Threat actors
- ShinyHuntersUNC6240
- Organizations
- MandiantGoogle Threat Intelligence GroupOracle
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | azurenetfiles.net | und connections to Microsoft-masquerading domains including azurenetfiles.net , microsoft-entra.net , and enroll.azuredevice.cloud . In S |
| domain | microsoft-entra.net | icrosoft-masquerading domains including azurenetfiles.net , microsoft-entra.net , and enroll.azuredevice.cloud . In September 2026 intrusio |
| domain | winmanage-me.network | to use IT-themed infrastructure associated with MeshAgent ( winmanage-me.network on 104.219.234.138 ) for secondary staging and management. |
| ipv4 | 104.219.234.138 | ructure associated with MeshAgent ( winmanage-me.network on 104.219.234.138 ) for secondary staging and management. MeshCentral is a le |
| ipv4 | 162.219.30.165 | hat communicates with its command-and-control (C2) server ( 162[.]219[.]30[.]165 ) over raw TCP using separate control ( TCP/3333 ) an |
| ipv4 | 5.199.162.157 | tered users . Network Indicators Indicator Type Description 5.199.162.157 IPv4 Attack controller, scanner, and HTTP callback receiver |
| sha256 | 2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7 | ll; hashes will vary due to extra newline characters. u.jsp 2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7 Execution stager servlet tunnel.jsp 419c571ee38b7e7266d130c |
| sha256 | 3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3 | nnel (open-source). Hashes will vary by key used. Ple64.exe 3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3 Trojanized installer delivering SIDEEYE backdoor Table 2: F |
| sha256 | 419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86 | 5c8f2d6b668e3360dfdb5d7 Execution stager servlet tunnel.jsp 419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86 Neo-reGeorg JSP tunnel (open-source). Hashes will vary by k |
| sha256 | 48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494 | path). File Indicators File Name SHA-256 Description x.jsp 48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494 Primary execution web shell; hashes will vary due to extra |
| sha256 | ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07 | el (open-source). Hashes will vary by key used. tunnel.jspx ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07 Neo-reGeorg JSPX tunnel (open-source). Hashes will vary by |
From the original article
11 min read at cloud.google.com
Introduction As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with expanded global targeting across multiple sectors.
By Mandiant · cloud.google.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.