Cybersecurity
Google warns of Oracle PeopleSoft web shell attacks
Google said actors linked to UNC6240 had resumed exploiting an Oracle PeopleSoft flaw, bypassing web application firewalls, dropping web shells and staging tools across multiple sectors.
- Google said it had seen renewed exploitation of CVE-2026-35273 in Oracle PeopleSoft systems across multiple sectors.
- Mandiant said UNC6240 had changed its exploit to bypass web application firewall rules on the PSEMHUB endpoint by encoding the request path.
- Google said the attackers used web shells, Ple64.exe, SIDEEYE, Neo-ReGeorg and MeshAgent during the campaign.
- Google advised patching CVE-2026-35273, disabling EMHub or removing PSEMHUB, and checking logs, files and credentials.
- The article also said ShinyHunters had breached FBIJobs.gov, taken about 2–3 TB of data and denied extortion, saying the portal breach used a different PeopleSoft zero-day.
Google said it had seen renewed exploitation of CVE-2026-35273 in Oracle PeopleSoft systems, and it linked the activity to UNC6240. It said the campaign affected organisations across several sectors, and that an earlier phase had led to notices sent to more than 100 organisations whose IP addresses matched vulnerable endpoints.
Mandiant said the group had adjusted its exploit so that requests against the PSEMHUB endpoint could get past web application firewall rules. It said the attackers used an encoded request path, while the PeopleSoft server decoded the request and sent it to the vulnerable servlet.
Google said the actors dropped two JSP web shells, one for command execution and one for file upload and command execution. It said they then used the upload capability to place Ple64.exe, which loaded SIDEEYE in memory and connected to 162.219.30[.]165 for credential theft and remote control.
Google said the campaign also involved the Neo-ReGeorg tunnelling toolkit and MeshAgent on Linux systems. It said roughly a quarter of the commands it observed ran with root or NT Authority\SYSTEM privileges, and it advised patching, disabling EMHub or removing PSEMHUB, checking logs and rotating credentials.
The article also said ShinyHunters had broken into FBIJobs.gov and taken about 2–3 TB of sensitive data. A spokesperson for the group denied extortion, said the aim was to clear its name, and said that breach used a different Oracle PeopleSoft zero-day.
Named in this story
Companies
- issued the warning and the mitigation advice
- Mandiant
- described how the exploit was altered to evade filtering rules
Organisations
- UNC6240
- the activity cluster Google linked to the campaign
- ShinyHunters
- said it had breached FBIJobs.gov and denied extortion
Governments and agencies
- FBI
- was the agency whose jobs portal was said to have been breached
Products and systems
- Oracle PeopleSoft
- the software whose flaw was being exploited
- PSEMHUB
- the PeopleSoft endpoint and servlet the attackers targeted
- WebLogic
- whose access logs Google told defenders to review
- MeshAgent
- was used for persistence on Linux systems
- Ple64.exe
- the trojanised installer used to load SIDEEYE
- SIDEEYE
- the backdoor loaded in memory for theft and remote control
- Neo-ReGeorg
- the tunnelling toolkit staged by the attackers
- FBIJobs.gov
- the portal reported as breached and left inaccessible
How the source tells it
The source is a cautionary security report, with an urgent register built from repeated warnings, attribution to Google and Mandiant, and a mitigation checklist.
- alarm severity labels and repeated warnings about renewed mass exploitation
- urgency the defensive action list and the advice to prepare for extortion