UNC6240 Exploits Critical Oracle PeopleSoft Vulnerability Through Sophisticated WAF Bypass Techniques

A sophisticated cyber-espionage and data theft campaign has been identified targeting organizations globally, specifically focusing on those utilizing Oracle PeopleSoft for core business operations. The threat actor, identified as UNC6240—also known in the cybersecurity community as ShinyHunters—has been observed exploiting a critical vulnerability in the Oracle PeopleSoft environment. This campaign is particularly notable for its use of clever obfuscation techniques to bypass Web Application Firewalls (WAF), followed by the deployment of a diverse array of web shells and remote access tools designed to maintain long-term persistence within victim networks.

The crux of the intrusion revolves around the exploitation of CVE-2026-35273, a high-severity vulnerability that allows for pre-authentication remote code execution. Security researchers have confirmed that UNC6240 successfully circumvented security perimeters by utilizing a simple yet highly effective URL encoding trick. By percent-encoding a single character in the request path—specifically changing the "P" in the /PSEMHUB/ directory to its hexadecimal equivalent, %50—the attackers were able to slip past WAF rules that were configured to look for the raw, unencoded string.

This discrepancy in how different layers of the IT stack interpret data is a classic security challenge. While the WAF sees /%50SEMHUB/ as a non-matching string and allows the traffic through, the backend Oracle WebLogic server decodes the URL and routes the request to the identical, vulnerable handler. This "impedance mismatch" between security filters and the application server provided UNC6240 with an open door to dozens of systems before many organizations even realized they were under attack.

The Anatomy of the Intrusion: From Entry to Persistence

Once the initial bypass is achieved, the attack flow typically diverges into two primary paths, depending on the environment and the attacker’s specific objectives. In what researchers call "Path A," the threat actors focus on the deployment of JSP (JavaServer Pages) web shells. These files, often named simply x.jsp or following a numerical sequence like 1.jsp and 2.jsp, are placed directly into web-accessible directories. These shells act as a persistent command-and-control interface, allowing the attackers to execute operating system commands through subsequent HTTP requests.

In more stealthy instances, categorized as "Path B," UNC6240 utilizes fileless execution. In this scenario, commands are executed through shell processes spawned directly by the Java process associated with WebLogic. This method is particularly dangerous as it leaves no physical JSP file on the disk for traditional antivirus or file integrity monitors to detect. The results of the malicious commands are returned directly within the HTTP responses, allowing the attackers to operate with a significantly reduced footprint.

The post-intrusion phase reveals a well-equipped toolkit designed for various operating environments. One of the most prominent tools identified in this campaign is SIDEEYE, which is often launched via a secondary loader or a modified, validly signed installer. Specifically, investigators have seen SIDEEYE deployed through a modified Light Alloy media player installer that carries an Extended Validation (EV) signature. This tactic is designed to bypass reputation-based security controls and endpoint detection and response (EDR) systems. Once active, SIDEEYE provides the attackers with robust credential theft capabilities and acts as a reverse proxy, typically communicating over TCP ports 3333 and 3334.