MANDIANT and Google Threat Intelligence Group (GTIG) say ShinyHunters, tracked as UNC6240, has resumed mass exploitation of Oracle PeopleSoft flaw CVE-2026-35273, after first using it as a zero-day against mainly academic institutions between 27 May and 9 June 2026. The renewed campaign has affected dozens of systems worldwide across higher education, technology, IT services, healthcare, agriculture, transport and government.
The attackers altered their exploit to evade web application firewall (WAF) rules by requesting `/%50SEMHUB/` instead of `/PSEMHUB/`; many WAFs match the encoded path before decoding it, while the PeopleSoft server decodes and routes it to the vulnerable servlet.
Mandiant observed Java-deserialisation exploitation used to deploy JSP web shells, execute commands without writing files, upload the 5.2 MB `Ple64.exe` trojanised installer and install the SIDEEYE backdoor, as well as Neo-reGeorg tunnelling tools and MeshCentral agents. SIDEEYE can steal browser and desktop application credentials, manage files and processes, and provide reverse-shell and proxy functions.
Some commands ran as `root` or `NT Authority\SYSTEM`, while others used PeopleSoft or WebLogic service accounts that could access application data and credentials. Mandiant recommends applying Oracle’s security alert patch, disabling EMHub or removing PSEMHUB where appropriate, and not treating WAF rules as a substitute for patching.
Organisations should search logs for normalised and encoded PSEMHUB requests, inspect all WebLogic nodes for unexpected files such as `x.jsp`, `u.jsp`, `tunnel.jsp` and `Ple64.exe`, rotate credentials accessible from the PeopleSoft tier, and investigate outbound connections and possible data theft.