UNC6240 Exploits Critical Oracle PeopleSoft Vulnerability Through Sophisticated WAF Bypass Techniques

A sophisticated cyber-espionage and data theft campaign has been identified targeting organizations globally, specifically focusing on those utilizing Oracle PeopleSoft for core business operations. The threat actor, identified as UNC6240—also known in the cybersecurity community as ShinyHunters—has been observed exploiting a critical vulnerability in the Oracle PeopleSoft environment. This campaign is particularly notable for its use of clever obfuscation techniques to bypass Web Application Firewalls (WAF), followed by the deployment of a diverse array of web shells and remote access tools designed to maintain long-term persistence within victim networks.

The crux of the intrusion revolves around the exploitation of CVE-2026-35273, a high-severity vulnerability that allows for pre-authentication remote code execution. Security researchers have confirmed that UNC6240 successfully circumvented security perimeters by utilizing a simple yet highly effective URL encoding trick. By percent-encoding a single character in the request path—specifically changing the "P" in the /PSEMHUB/ directory to its hexadecimal equivalent, %50—the attackers were able to slip past WAF rules that were configured to look for the raw, unencoded string.

This discrepancy in how different layers of the IT stack interpret data is a classic security challenge. While the WAF sees /%50SEMHUB/ as a non-matching string and allows the traffic through, the backend Oracle WebLogic server decodes the URL and routes the request to the identical, vulnerable handler. This "impedance mismatch" between security filters and the application server provided UNC6240 with an open door to dozens of systems before many organizations even realized they were under attack.

The Anatomy of the Intrusion: From Entry to Persistence

Once the initial bypass is achieved, the attack flow typically diverges into two primary paths, depending on the environment and the attacker’s specific objectives. In what researchers call "Path A," the threat actors focus on the deployment of JSP (JavaServer Pages) web shells. These files, often named simply x.jsp or following a numerical sequence like 1.jsp and 2.jsp, are placed directly into web-accessible directories. These shells act as a persistent command-and-control interface, allowing the attackers to execute operating system commands through subsequent HTTP requests.

In more stealthy instances, categorized as "Path B," UNC6240 utilizes fileless execution. In this scenario, commands are executed through shell processes spawned directly by the Java process associated with WebLogic. This method is particularly dangerous as it leaves no physical JSP file on the disk for traditional antivirus or file integrity monitors to detect. The results of the malicious commands are returned directly within the HTTP responses, allowing the attackers to operate with a significantly reduced footprint.

The post-intrusion phase reveals a well-equipped toolkit designed for various operating environments. One of the most prominent tools identified in this campaign is SIDEEYE, which is often launched via a secondary loader or a modified, validly signed installer. Specifically, investigators have seen SIDEEYE deployed through a modified Light Alloy media player installer that carries an Extended Validation (EV) signature. This tactic is designed to bypass reputation-based security controls and endpoint detection and response (EDR) systems. Once active, SIDEEYE provides the attackers with robust credential theft capabilities and acts as a reverse proxy, typically communicating over TCP ports 3333 and 3334.

To move laterally within the internal network, UNC6240 employs Neo-reGeorg, a popular tool for establishing SOCKS tunnels via web servers. By tunneling traffic through the compromised PeopleSoft server, the attackers can bypass internal firewalls and access sensitive resources that are not directly exposed to the internet. For Linux-based environments, the group has been observed deploying MeshAgent, a remote management tool that allows for persistent access and administrative control over the underlying operating system.

Impacts on Global and Regional Organizations

The targeting of Oracle PeopleSoft is a strategic choice. As an Enterprise Resource Planning (ERP) platform, PeopleSoft often houses an organization’s most sensitive data, including human resources records, payroll information, and financial data. A successful compromise of these systems can lead to massive data breaches, financial fraud, and the exposure of personally identifiable information (PII) for thousands of employees.

The impact is particularly pronounced for Japanese organizations, many of which rely heavily on PeopleSoft for their core administrative functions. Security experts warn that Japanese firms must be vigilant in verifying their environments, as the reliance on WAFs alone has proven insufficient against UNC6240’s encoding tactics. The incident serves as a stark reminder that even with a CVSS score of 9.8, a vulnerability’s exploitability is often determined by the nuances of URL normalization and the configuration of perimeter defenses.

For administrators, the perspective is one of urgent remediation. The primary goal is to ensure that official patches are applied and that the PSEMHUB functions are not directly accessible from the public internet. If direct access is required for business operations, it should be restricted via VPN or strict IP whitelisting. Relying on simple string-matching WAF rules is no longer a viable strategy against a threat actor capable of basic URL obfuscation.

Forensic Investigation and Success Determination

Determining whether an organization has been successfully breached requires a multi-layered investigation. Forensics teams are encouraged to look beyond simple file checks. In a load-balanced environment, a single compromised node can provide a foothold for the entire network, necessitating a thorough analysis of all servers in the cluster.

Key indicators of compromise (IoCs) include the presence of encoded URIs in HTTP access logs, particularly those containing %50SEMHUB. Investigators should also search for suspicious JSP files in web directories and monitor for Java processes that unexpectedly spawn shell commands like /bin/sh or cmd.exe. Network logs should be scrutinized for outbound connections to unknown IP addresses on ports 3333 or 3334, which are indicative of SIDEEYE activity.

The success of the attack is often confirmed by the presence of specific artifacts. Public reporting confirms that the creation of sequential JSPs and the execution of the SIDEEYE binary (Ple64.exe) are definitive signs of a successful intrusion. Furthermore, the establishment of persistent sessions destined for external command-and-control (C2) servers via MeshAgent or Neo-reGeorg indicates that the attackers have moved beyond initial exploitation and are actively managing the compromised environment.

Defense Strategies and Strategic Mitigation

To defend against the tactics employed by UNC6240, organizations must adopt a defense-in-depth approach. The most critical step is the immediate application of security patches for Oracle PeopleSoft and WebLogic. However, patching is only one part of the solution. Organizations must also address the "normalization discrepancy" by ensuring that their WAFs are capable of decoding and inspecting URL-encoded traffic before applying security rules.

Beyond technical controls, the investigation playbook for such an incident should include a comprehensive review of system configuration and auditing settings. High-fidelity logging is essential; without detailed HTTP and process-level logs, detecting fileless execution or subtle proxy traffic becomes nearly impossible.

The MITRE ATT&CK mapping for this campaign highlights the diverse techniques used by UNC6240. From exploiting public-facing applications (T1190) and using obfuscated files (T1027) to the deployment of web shells (T1505.003) and the use of proxies (T1090), the group demonstrates a high level of operational maturity. Their ability to abuse legitimate remote access tools (T1219) like MeshAgent further complicates the detection process, as these tools can often blend in with legitimate administrative activity.

In conclusion, the campaign by UNC6240 against Oracle PeopleSoft users highlights a significant evolution in how threat actors bypass modern security infrastructure. The use of simple encoding to defeat WAFs, combined with the deployment of both file-based and fileless malware, presents a complex challenge for SOCs and IT administrators. Organizations must move toward a more proactive security posture that includes rigorous patching, enhanced log visibility, and a healthy skepticism of perimeter-only defenses. As this threat continues to evolve, the ability to perform deep forensic analysis across entire server environments will remain a critical component of enterprise resilience.