Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign

Google's Mandiant and GTIG teams report that extortion gang ShinyHunters, tracked as UNC6240, has launched a renewed wave of attacks against Oracle PeopleSoft deployments. The group reworked its earlier exploit for CVE-2026-35273 to slip past web application firewalls by URL-encoding the letter 'P' as '%50' in requests targeting the Environment Management Hub (PSEMHUB) endpoint, letting it reach the vulnerable servlet even where defenders believed they had blocked the flaw. After an initial wave in June hit over 100 PeopleSoft customers in education—including the University of Nottingham, NAIC, and Nissan—this new campaign has broadened to agriculture, government, healthcare, IT services, technology, and transportation sectors, with web shells planted on dozens of systems. Beyond web shells, the attackers are using the SideEye backdoor for credential theft and remote control, plus Neo-reGeorg tunneling and MeshCentral for lateral movement, often operating with root or System-level access. Oracle PeopleSoft customers should apply the CVE-2026-35273 patch, tighten WAF rules against encoding tricks, hunt for compromise indicators, and brace for possible data-leak extortion demands from the group.