Ethical Hacking News
ShinyHunters has been linked to a campaign involving the exploitation of a known security vulnerability in Oracle PeopleSoft,CVE-2026-35273, to deploy web shells on dozens of systems, primarily targeting higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors. The attackers have bypassed web application firewall (WAF) rules and exploited the vulnerability to achieve fileless command execution and deploy a valid, signed trojanized installer that facilitates credential theft, process and file management, and interactive reverse shell capabilities. To counter this threat, organizations are advised to apply patches, disable the Environment Management Hub service, and conduct regular threat assessments to protect themselves against this campaign.
The ShinyHunters group has been linked to a campaign exploiting a critical security vulnerability in Oracle PeopleSoft (CVE-2026-35273) to gain unauthorized access to sensitive systems. The attackers have deployed web shells on dozens of systems, primarily targeting higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors. The attackers bypassed web application firewalls (WAFs) by URL-encoding a single character in the request path, evading detection by WAF and reverse proxy rules. The attack chain involves multiple stages, including Java deserialization, web shell deployment, and fileless command execution. The attackers use a C++ backdoor called SIDEEYE to facilitate browser and desktop application credential theft, process and file management, interactive reverse shell, and reverse proxy capabilities. The attackers have been found to use the Neo-reGeorg tunneling toolkit to establish persistent access after web shell placement on Linux systems. Organizations are advised to apply patches for CVE-2026-35273, disable the Environment Management Hub (EMHub) service, and monitor outbound traffic from PeopleSoft hosts to counter this threat.
The threat landscape has witnessed numerous high-profile attacks in recent times, with cybercriminals continually evolving their tactics to bypass security measures and gain unauthorized access to sensitive systems. The latest threat actor to gain attention is the ShinyHunters group, which has been linked to a campaign involving the exploitation of a known security vulnerability in Oracle PeopleSoft. The vulnerability, identified as CVE-2026-35273, holds a critical security score of 9.8 and can result in unauthenticated remote code execution, rendering it a highly dangerous vulnerability.
According to the latest intelligence report from Google-owned Mandiant, the ShinyHunters group has been actively exploiting the CVE-2026-35273 vulnerability to deploy web shells on dozens of systems, primarily targeting higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors. The attackers have bypassed web application firewall (WAF) rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/. This tactic allows the attackers to evade detection by WAF and reverse proxy rules that match the literal path before URL decoding.
The entire attack chain is comprised of several stages. Initially, the attackers identify susceptible targets by sending POST requests to "/%50SEMHUB/hub" containing a serialized Java object. The attackers then abuse Java deserialization in the PSEMHUB hub servlet to deploy web shells and achieve fileless command execution. To further minimize WAF detections during post-exploitation, the attackers drop two JSP web shells in the PSEMHUB.war directory. The "x.jsp" web shell enables cross-platform command execution, while the "u.jsp" web shell allows chunked file uploads to the server and command execution via "cmd.exe." The attackers also deploy a valid, signed trojanized installer ("Ple64.exe") that loads in memory SIDEEYE, a C++ backdoor that communicates with an external server ("162.219.30[.]165") to facilitate browser and desktop application credential theft, process and file management, interactive reverse shell, and reverse proxy capabilities.
The attackers have also been found to use the Neo-reGeorg tunneling toolkit to establish persistent access after web shell placement on Linux systems. Notably, about a quarter of the threat actor's commands are executed as root or NT Authority\SYSTEM, granting them full control of the operating system. The remaining commands are run under PeopleSoft or WebLogic service accounts.
To counter this threat, organizations are advised to apply patches for CVE-2026-35273, disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application entirely in single-server configurations. They should also search WebLogic access logs for requests to "/PSEMHUB/" and any percent-encoded variant, inspect the "PSEMHUB.war" directory for JSP web shells and other malicious artifacts, rotate credentials readable by the PeopleSoft application service account, hunt PeopleSoft and database hosts for large archive files in temporary or web-accessible directories, review database audit logs for bulk queries or exports against HR, payroll, and student records tables, and monitor outbound traffic from PeopleSoft hosts.
The ShinyHunters group has also claimed responsibility for breaching the U.S. Federal Bureau of Investigation's FBIJobs.gov portal, stealing about 2-3 TB of sensitive data, and contesting allegations made by the agency against the group in a May 2026 alert. The group maintains that the breach was not financially motivated and is an effort to protect their organization's image.
The disclosure of this campaign highlights the need for organizations to prioritize vulnerability patching, web application security, and threat intelligence. The fact that ShinyHunters has bypassed WAFs and deployed web shells on dozens of systems underscores the importance of maintaining robust security controls and conducting regular threat assessments.
Related Information:
https://www.ethicalhackingnews.com/articles/ShinyHunters-Web-Shell-Deployment-Campaign-Exploiting-Oracle-PeopleSoft-Flaw-for-Mass-Exploitation-ehn.shtml
https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html
https://nvd.nist.gov/vuln/detail/CVE-2026-35273
https://www.cvedetails.com/cve/CVE-2026-35273/
Published: Sat Sep 26 09:53:36 2026 by llama3.2 3B Q4_K_M
