1. Executive summary
Mandiant's 25 September 2026 investigation reports renewed exploitation of CVE-2026-35273 in Oracle PeopleSoft, with web shells deployed across multiple sectors. Mandiant and Google Threat Intelligence Group attribute the activity to their UNC6240 cluster, which they identify as ShinyHunters. The campaign reached unpatched systems through requests that bypassed literal-path web application firewall rules, then established additional access through web shells, tunnelling and remote-management tooling. Likely (B2), organisations that treated those temporary rules as completed remediation risk an undetected gap between apparent protection and actual application exposure.
2. Contextual background
Mandiant places the renewed activity after a campaign it reported in June 2026, when the same vulnerability was exploited predominantly against academic institutions. Its September 2026 account describes broader global targeting, including technology, healthcare, transportation and government. These are the researcher's observed sectors; they do not establish that every exposed installation was attacked or that every affected organisation lost data.
The vulnerability also appears in CISA's Known Exploited Vulnerabilities catalogue as captured on 25 September 2026. CISA added it on 12 June 2026, describes missing authentication for a critical function and marks known ransomware-campaign use in that historical record. That catalogue flag is separate from proof of ransomware deployment during this particular campaign.
The operational question is whether each server received the vendor fix. Mandiant says the renewed activity exploited a difference between the path inspected by some perimeter rules and the path processed by the application. A firewall rule remaining enabled therefore cannot establish that the underlying vulnerability was removed.
3. Technical analysis
The affected component is PeopleSoft's Environment Management Hub, commonly called EMHub, exposed through the PSEMHUB application. Mandiant describes requests whose encoded representation avoided literal string matching before the application normalised the path. The defensive lesson is to evaluate how the perimeter and application interpret the same request, while completing patching; this article does not reproduce the bypass request.
The technical account describes two exploitation paths. One writes JSP web shells into the application directory. The other returns command output without writing a web shell, with operating-system shell processes launched beneath the WebLogic Java process. A search restricted to newly created JSP files will therefore cover only part of the reported activity.
Mandiant also observed repeated requests in some load-balanced environments and assesses that repetition likely placed shells on multiple nodes. Its recommendation is to examine every WebLogic node. Our recommendation is to reconcile the investigation inventory with the actual server pool, including nodes temporarily removed from service, rather than stopping after the first positive finding.
Post-exploitation tooling served different purposes. Mandiant describes command-execution and file-upload shells, the Neo-reGeorg tunnelling toolkit and a trojanised installer named Ple64.exe delivering the SIDEEYE backdoor. The analysed installer masqueraded as Light Alloy software and carried a valid signing certificate. That observation supports checking content and execution behaviour rather than accepting a signature as proof that an unexpected installer belongs on a PeopleSoft server.
Mandiant's initial analysis describes SIDEEYE capabilities for credential theft, file and process management, and interactive command or proxy access. Those are capabilities of the analysed backdoor, not confirmation that every function ran in every victim environment. We recommend separating installation, execution, command-server contact and subsequent tasking in the local timeline. Each finding supports a different level of confidence about the operator's access. If tasking records are unavailable, document that limit while investigating credentials and downstream connections that the backdoor could have exposed.
4. Impact assessment
Mandiant reports commands executed both with highly privileged operating-system access and under PeopleSoft or WebLogic service accounts. Its analysis emphasises that the latter could still reach configuration files, database connection strings and application data. Root or system-level execution is therefore an escalation in scope, not the threshold at which this incident becomes serious.
The relevant exposure extends beyond the web directory. Our recommendation is to identify which database, integration and cloud credentials the application tier could read, then investigate their use. Distinguish a secret accessible to the compromised account from evidence that the actor actually extracted or used it. Both matter, but they support different conclusions in the incident record.
Mandiant describes UNC6240's established data-theft extortion pattern and advises affected organisations to prepare for extortion communications. That warning should prompt investigation and preparation, not an unsupported statement that every compromised server produced stolen records. Review data-access evidence alongside the access mechanism.
For operational teams, patching and incident recovery answer different questions. Installing the fix addresses the vulnerable entry point. Establishing whether shells, agents, stolen credentials or internal connections remain requires a separate investigation. A server can meet the patch requirement while its earlier exposure remains unresolved.
5. Artefacts and hunting guidance
These selected artefacts are attributed to Mandiant's September 2026 report. They are leads for investigation, not universal identifiers of UNC6240.
| Artefact or behaviour | Reported role | Hunting use |
|---|---|---|
x.jsp, u.jsp, u2.jsp |
Command execution or file staging | Compare unexpected files with the shipped application and deployment history |
tunnel.jsp, tunnel.jspx |
Neo-reGeorg tunnel components | Investigate application-tier proxying and internal destinations |
Ple64.exe |
Trojanised installer delivering SIDEEYE | Preserve the sample and associated process history |
winmanage-me[.]network |
September 2026 MeshCentral infrastructure | Correlate connections with agent installation and host activity |
| Shell processes beneath WebLogic Java | Fileless execution path | Review process ancestry even when no web shell is present |
Mandiant reports use of MeshAgent, a legitimate remote-management agent, and distinguishes September 2026 infrastructure from domains observed during earlier intrusions. Do not collapse those dates into a claim that every historical domain participated in the current wave. For a local match, preserve the connection timestamp and the indicator's reported role.
The source warns that some shell hashes vary with formatting, and tunnel hashes can change with configuration. Use the published hashes as precise matches where available, but retain filename, location, content and behaviour searches. A negative hash search is weaker evidence than a complete review of the application tree and its execution records.
We recommend joining perimeter logs with application access logs and endpoint events. Establish which backend handled a suspicious request, what the application returned and whether the Java process launched a shell. Treat missing host telemetry as a coverage gap, rather than using it to dismiss a request that otherwise warrants investigation.
6. Incident response guidance
Mandiant advises treating a host containing a web shell as compromised, preserving evidence and rotating credentials accessible from the PeopleSoft tier. Begin by establishing a safe containment plan with the application's owner. Retain relevant logs, unexpected files, configuration state and process evidence before changes remove the available history.
Inventory all nodes behind the affected service and record patch status separately from investigation status. Our recommendation is to maintain a disposition for each node: examined without findings, confirmed compromised, or insufficient evidence. An aggregate statement that the cluster is patched should not conceal a node that was never examined.
Scope credential recovery to what the compromised account could reach. Mandiant specifically identifies database connection strings, Integration Broker credentials and reachable cloud credentials. Coordinate replacement with service owners so recovery does not preserve unauthorised access through an overlooked integration or cause an avoidable outage through an unplanned change.
Hunt for data theft using the sources Mandiant identifies: large archives in temporary or web-accessible locations, bulk database queries or exports, and large or sustained outbound transfers. Connect each finding to a host, identity and time range. A large archive alone can have a legitimate explanation; its creator, contents and destination determine the next investigative step.
Prepare a communications process for extortion contact and possible data exposure. Preserve messages and route decisions through the organisation's established incident structure. Our recommendation is to base any statement about affected data on verified access or transfer evidence, while clearly recording what remains unknown.
7. ATT&CK context
The following mappings are our analysis of the reported behaviour using MITRE ATT&CK. They organise the investigation without claiming that MITRE independently attributed this campaign.
| Technique | Basis in the reported activity |
|---|---|
| T1190: Exploit Public-Facing Application | Exploitation of the exposed PeopleSoft component |
| T1505.003: Web Shell | Unexpected JSP components used for persistent command access |
| T1090: Proxy | Neo-reGeorg tunnelling through the application host |
Keep the fileless execution path visible alongside this table. Absence of a Web Shell finding does not exclude the separately reported command-execution method. Similarly, detecting a tunnel establishes an access mechanism; it does not establish which downstream systems were successfully compromised.
For a defensive exercise, validate whether the team can trace a benign test request from the perimeter to the correct backend and associate authorised application activity with its host records. Test visibility and ownership using approved traffic. Reproducing the exploit is unnecessary to discover that logs omit a backend or that no team receives the relevant alert.
8. Mitigation recommendations
Mandiant's priority is to apply Oracle's security fix and remain on supported PeopleTools versions. Its guidance explicitly rejects firewall rules as a substitute for patching. Verify completion per installation rather than relying on a perimeter change ticket.
The same report advises disabling EMHub where it is not needed for patching and describes different actions for single-server and multi-server deployments. Follow the vendor's instructions for the actual topology and dependencies before removing an application or service. Record whether the administrative component remains reachable and why that access is required.
Where temporary filtering remains necessary, Mandiant recommends enforcement against the normalised path. Our recommendation is to validate the rule at each relevant proxy and application boundary with approved tests, document its limits and retain an owner and deadline for the vendor fix. Passing one literal-path test is insufficient evidence of equivalent interpretation throughout the request chain.
Restrict the application service account to the permissions it needs. Review its access to configuration secrets and remote systems, then monitor outbound connections consistent with the reported agents or tunnels. These are containment and hardening measures; they do not establish that earlier compromise has been removed.
9. Historical context and limits
According to Mandiant, Oracle issued an out-of-band security alert on 10 June 2026 following the earlier zero-day campaign. Its September 2026 findings therefore concern continued exploitation after a fix was available, including systems whose operators had relied on temporary perimeter protection.
That sequence illustrates a remediation-state problem: an emergency measure can remain in place after its assumptions cease to hold. It does not show that all firewall products fail identically or that every organisation followed the same interim guidance. The source attributes the observed activity to a particular cluster and documents particular request-processing differences.
10. Outlook and assessment
Likely (B2), the strongest recovery position will combine verified patching with investigation of application-tier identities and persistence. The assessment rests on Mandiant's reported shells, agents, tunnels and readable credentials, each of which extends the work beyond closing the initial entry point.
Evidence that every node was patched before exposure and that suspicious requests failed would narrow the incident. Confirmed command execution, unexplained agents or credential use would expand it. Keep those findings distinct so a successful maintenance task does not prematurely close an unresolved intrusion.
