ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

SOC Prime Team

ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

The threat actor UNC6240, also known as ShinyHunters, is running an active compromise and extortion campaign against Oracle PeopleSoft environments. The attackers abuse a zero-day remote code execution flaw in the Environment Management component to gain initial access. They then rely on MeshCentral for command and control and use custom scripts to support lateral movement and data theft.

Investigation

Mandiant and Google Threat Intelligence Group uncovered the campaign through analysis of exposed attacker staging directories. Their investigation revealed Python SimpleHTTP servers hosting malicious MeshCentral agents along with command-history artifacts. The researchers followed the intrusion chain from exploitation of CVE-2026-35273 through to later data exposure on the ShinyHunters Data Leak Site.

Mitigation

Organizations should immediately disable the Environment Management Hub (EMHub) service or remove the PSEMHUB application entirely. Perimeter defenses should block external access to /PSEMHUB/* and /PSIGW/HttpListeningConnector endpoints. Additional hardening should include auditing web-tier file systems for unauthorized .jsp files, watching for suspicious new directories, and monitoring for unexpected outbound SMB traffic.

Response

If compromise is suspected, organizations should restrict access to vulnerable PeopleSoft endpoints and review WebLogic access logs for suspicious POST activity. Forensic teams should search PSEMHUB directories for unauthorized files and inspect for XMLDecoder-based persistence. Outbound monitoring on port 445 should also be enabled to identify potential NTLM hash capture attempts.

"graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#cccccc classDef vulnerability fill:#ff9999 classDef file fill:#ccffcc %% Initial Access Stage vuln_psemhub["Vulnerability CVE-2026-35273 Exploitation of Oracle PeopleSoft Environment Management component (PSEMHUB)"] class vuln_psemhub vulnerability action_initial_access["Action – T1210: Exploitation of Remote Services Description: Exploiting a zero-day RCE in PSEMHUB to gain initial access."] class action_initial_access action %% Command and Control Stage tool_meshcentral["Tool – MeshCentral Description: Remote management server used for C2 staging. Type: Remote Access Tool"] class tool_meshcentral tool tool_acme_client["Tool – acme-client (npm package) Description: Automates SSL certificate provisioning for the masquerading domain azurenetfiles.net"] class tool_acme_client tool file_meshagent["File – meshagent64-azure-ops.exe Description: Customized Windows MeshCentral agent used to facilitate remote management."] class file_meshagent file %% Reconnaissance Stage action_recon["Action – T1082: System Information Discovery Description: Mapping Oracle PeopleSoft configurations and auditing network mounts."] class action_recon action tool_meshctrl["Tool – meshctrl.js Description: MeshCentral command-line utility used for discovery."] class tool_meshctrl tool file_config_files["Files Targeted psappsrv.cfg and WebLogic config.xml used for mapping configurations."] class file_config_files file %% Lateral Movement Stage action_lateral["Action – T1110.003: Brute Force: Password Spraying Description: Performing SSH credential spraying against internal hosts."] class action_lateral action script_fanout["File/Script – [victim_abbreviation]_fanout.sh Description: Custom bash script for credential spraying and propagation of extortion files."] class script_fanout file file_extort["File – README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT Description: Defacement and extortion marker file."] class file_extort file %% Exfiltration Stage action_exfil["Action – T1560: Archive Collected Data Description: Compressing stolen data before exfiltration."] class action_exfil action tool_zstd["Tool – zstd Description: Utility used to compress exfiltrated directories."] class tool_zstd tool %% Connections Section %% Flow from vulnerability to access vuln_psemhub –>|exploited_via| action_initial_access %% Flow from access to C2 action_initial_access –>|establishes_C2| tool_meshcentral tool_meshcentral –>|uses| tool_acme_client tool_meshcentral –>|deploys| file_meshagent %% Flow to Reconnaissance tool_meshcentral –>|facilitates| action_recon action_recon –>|uses| tool_meshctrl action_recon –>|inspects| file_config_files %% Flow to Lateral Movement action_recon –>|leads_to| action_lateral action_lateral –>|executes| script_fanout script_fanout –>|propagates| file_extort %% Flow to Exfiltration script_fanout –>|leads_to| action_exfil action_exfil –>|uses| tool_zstd "

Attack Flow

Attack Narrative & Commands: The adversary aims to exploit the Oracle PeopleSoft vulnerability to gain unauthorized access or escalate privileges. First, they perform reconnaissance by sending POST requests to PSEMHUB/hub to identify service availability. Second, they attempt to stage a web shell by writing a malicious .jsp file into the PSEMHUB.war application directory, specifically targeting the envmetadata/transactions/ path to hide their activity within legitimate-looking application metadata structures.

Regression Test Script:

#!/bin/bash
# Simulation Script for Oracle PeopleSoft PSEMHUB Exploitation

echo "[+] Starting Simulation..."

# 1. Trigger selection_webservice_requests (HTTP POST)
echo "[+] Step 1: Sending malicious POST requests..."
curl -X POST "http://localhost/PSEMHUB/hub" -d "cmd=exploit"
curl -X POST "http://localhost/PSIGW/HttpListeningConnector" -d "cmd=exploit"

# 2. Trigger selection_fs_operations (File Creation)
echo "[+] Step 2: Creating malicious .jsp files in target directories..."

# Ensure directory exists for simulation (in a real test, this is the target)
mkdir -p /webserv/applications/peoplesoft/PSEMHUB.war/envmetadata/transactions/

# Create the malicious JSP file
echo "<% out.println("Exploited"); %>" > /webserv/applications/peoplesoft/PSEMHUB.war/envmetadata/transactions/shell.jsp

# Create another .jsp file under the war directory to test the wildcard match
echo "<% out.println("Malicious"); %>" > /webserv/applications/peoplesoft/PSEMHUB.war/malicious.jsp

echo "[+] Simulation Complete. Check SIEM for alerts."

Cleanup Commands:

#!/bin/bash
# Cleanup Script

echo "[+] Cleaning up simulation artifacts..."
rm -f /webserv/applications/peoplesoft/PSEMHUB.war/envmetadata/transactions/shell.jsp
rm -f /webserv/applications/peoplesoft/PSEMHUB.war/malicious.jsp
# Note: In production, do not delete directories, only the files created for testing.
echo "[+] Cleanup finished."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free