UNC6240 ShinyHunters Mass Exploitation of Oracle PeopleSoft CVE-2026-35273

UNC6240, also known as ShinyHunters, has launched a renewed mass exploitation campaign targeting Oracle PeopleSoft environments globally. Initially acting as a zero-day threat in May 2026, the group has recently adapted its tradecraft to bypass Web Application Firewall (WAF) mitigations by using percent-encoded URL paths (e.g., /%50SEMHUB/) to access the vulnerable Environment Management Hub (PSEMHUB) servlet. This activity has impacted dozens of organizations across academic, technology, healthcare, and government sectors.

The attack chain involves target verification via Java serialization, followed by the deployment of custom JSP web shells (x.jsp, u.jsp). Once established, the threat actor deploys SIDEEYE (Ple64.exe), a multi-stage C++ backdoor, and leverages legitimate tools like MeshCentral and Neo-reGeorg for persistent access and lateral movement. The campaign is primarily motivated by data theft and extortion, with stolen data frequently appearing on the ShinyHunters Data Leak Site (DLS).

This threat is critical due to the effectiveness of the WAF bypass and the actor's ability to escalate privileges to root or SYSTEM. Organizations are urged to move beyond perimeter blocking and apply official Oracle security patches immediately while auditing their web tiers for unauthorized JSP files and suspicious outbound network activity.