UNC6240 Exploits Critical Oracle PeopleSoft Vulnerability Through Sophisticated WAF Bypass Techniques

The success of the attack is often confirmed by the presence of specific artifacts. Public reporting confirms that the creation of sequential JSPs and the execution of the SIDEEYE binary (Ple64.exe) are definitive signs of a successful intrusion. Furthermore, the establishment of persistent sessions destined for external command-and-control (C2) servers via MeshAgent or Neo-reGeorg indicates that the attackers have moved beyond initial exploitation and are actively managing the compromised environment.

Defense Strategies and Strategic Mitigation

To defend against the tactics employed by UNC6240, organizations must adopt a defense-in-depth approach. The most critical step is the immediate application of security patches for Oracle PeopleSoft and WebLogic. However, patching is only one part of the solution. Organizations must also address the "normalization discrepancy" by ensuring that their WAFs are capable of decoding and inspecting URL-encoded traffic before applying security rules.

Beyond technical controls, the investigation playbook for such an incident should include a comprehensive review of system configuration and auditing settings. High-fidelity logging is essential; without detailed HTTP and process-level logs, detecting fileless execution or subtle proxy traffic becomes nearly impossible.

The MITRE ATT&CK mapping for this campaign highlights the diverse techniques used by UNC6240. From exploiting public-facing applications (T1190) and using obfuscated files (T1027) to the deployment of web shells (T1505.003) and the use of proxies (T1090), the group demonstrates a high level of operational maturity. Their ability to abuse legitimate remote access tools (T1219) like MeshAgent further complicates the detection process, as these tools can often blend in with legitimate administrative activity.

In conclusion, the campaign by UNC6240 against Oracle PeopleSoft users highlights a significant evolution in how threat actors bypass modern security infrastructure. The use of simple encoding to defeat WAFs, combined with the deployment of both file-based and fileless malware, presents a complex challenge for SOCs and IT administrators. Organizations must move toward a more proactive security posture that includes rigorous patching, enhanced log visibility, and a healthy skepticism of perimeter-only defenses. As this threat continues to evolve, the ability to perform deep forensic analysis across entire server environments will remain a critical component of enterprise resilience.