UNC6240 Exploits Critical Oracle PeopleSoft Vulnerability Through Sophisticated WAF Bypass Techniques

To move laterally within the internal network, UNC6240 employs Neo-reGeorg, a popular tool for establishing SOCKS tunnels via web servers. By tunneling traffic through the compromised PeopleSoft server, the attackers can bypass internal firewalls and access sensitive resources that are not directly exposed to the internet. For Linux-based environments, the group has been observed deploying MeshAgent, a remote management tool that allows for persistent access and administrative control over the underlying operating system.

Impacts on Global and Regional Organizations

The targeting of Oracle PeopleSoft is a strategic choice. As an Enterprise Resource Planning (ERP) platform, PeopleSoft often houses an organization’s most sensitive data, including human resources records, payroll information, and financial data. A successful compromise of these systems can lead to massive data breaches, financial fraud, and the exposure of personally identifiable information (PII) for thousands of employees.

The impact is particularly pronounced for Japanese organizations, many of which rely heavily on PeopleSoft for their core administrative functions. Security experts warn that Japanese firms must be vigilant in verifying their environments, as the reliance on WAFs alone has proven insufficient against UNC6240’s encoding tactics. The incident serves as a stark reminder that even with a CVSS score of 9.8, a vulnerability’s exploitability is often determined by the nuances of URL normalization and the configuration of perimeter defenses.

For administrators, the perspective is one of urgent remediation. The primary goal is to ensure that official patches are applied and that the PSEMHUB functions are not directly accessible from the public internet. If direct access is required for business operations, it should be restricted via VPN or strict IP whitelisting. Relying on simple string-matching WAF rules is no longer a viable strategy against a threat actor capable of basic URL obfuscation.

Forensic Investigation and Success Determination

Determining whether an organization has been successfully breached requires a multi-layered investigation. Forensics teams are encouraged to look beyond simple file checks. In a load-balanced environment, a single compromised node can provide a foothold for the entire network, necessitating a thorough analysis of all servers in the cluster.

Key indicators of compromise (IoCs) include the presence of encoded URIs in HTTP access logs, particularly those containing %50SEMHUB. Investigators should also search for suspicious JSP files in web directories and monitor for Java processes that unexpectedly spawn shell commands like /bin/sh or cmd.exe. Network logs should be scrutinized for outbound connections to unknown IP addresses on ports 3333 or 3334, which are indicative of SIDEEYE activity.