ShinyHunters Launches New Oracle PeopleSoft Exploitation Campaign Bypassing WAFs

New Exploitation Campaign Targets PeopleSoft

Mandiant and Google Threat Intelligence Group (GTIG) issued a warning regarding a new mass-exploitation campaign by the ShinyHunters group, also tracked as UNC6240. This campaign specifically targets organizations using Oracle PeopleSoft, an enterprise resource planning (ERP) software suite for managing core business functions like finance, HR, and payroll.

WAF Bypass Mechanism

The new wave of attacks stems from ShinyHunters modifying an exploit for a zero-day vulnerability in PeopleSoft, tracked as CVE-2026-35273. The modification allows the exploit to bypass web application firewall (WAF) rules that block the vulnerable Environment Management Hub (PSEMHUB) endpoint. This is achieved by using '%50', the URL-encoded form of 'P', in the request path containing '/PSEMHUB', which many WAFs fail to decode before matching rules.

Expanded Targeting and Tactics

While ShinyHunters' initial PeopleSoft campaign in June targeted over 100 customers, primarily in the education sector, the new attacks have expanded to include agriculture, government, healthcare, IT services, technology, and transportation organizations. Confirmed victims from the initial campaign include the University of Nottingham, NAIC, and Nissan.

As part of the new campaign, attackers deploy web shells on systems after bypassing WAFs. They use multiple POST requests to ensure web shell deployment across load-balanced environments or to directly execute commands and receive output in HTTP responses. The group establishes persistence using two single-line JSP web shells and deploys the SideEye backdoor on Windows systems.