Oracle PeopleSoft PeopleTools RCE — CVE-2026-35273

Between 27 May and 9 June 2026 the extortion crew ShinyHunters (tracked by Google/Mandiant as UNC6240) exploited a then-unpatched remote code execution flaw in Oracle PeopleSoft Enterprise PeopleTools, CVE-2026-35273 (CVSS 9.8). The bug lives in the Environment Management hub (PSEMHUB) and is reachable by an unauthenticated HTTP request — no login, no user interaction. Oracle did not publish an advisory until 10 June, so the entire campaign window was a true zero-day.

The attacker objective is bulk data theft followed by extortion, not encryption. After landing RCE, UNC6240 establishes resilient remote control with a customized MeshCentral RMM agent masqueraded as a Microsoft Azure binary (C2 at azurenetfiles.net), then spreads internally with a <name>_fanout.sh script that sprays a hardcoded SSH credential list against hosts pulled from /etc/hosts, drops a boast marker file (README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT), compresses data with zstd, and exfiltrates over SSH. More than 100 organizations were exposed; ~68% are in higher education.

The highest-value defensive angle is that a PeopleSoft application/web tier should never spawn an interactive shell, an RMM agent, or outbound SSH. Those behaviors are extremely low-volume in a clean PeopleSoft estate, so the post-exploitation chain is far more reliably detectable than the initial HTTP exploit itself.

Defender priority: Restrict /PSEMHUB/hub and /PSIGW/HttpListeningConnector at the perimeter today, and alert on any child process of the WebLogic/Java app server that is a shell, ssh, zstd, or an unknown RMM agent — that single behavior collapses almost the whole UNC6240 chain.

Atomic host-based IOCs (SHA256 of the MeshCentral agent variants) were not published as of 14 Jun 2026 — the CSV in §10 uses REPLACE_WITH_… placeholders for hashes. Network and behavioral indicators are well corroborated and carry the detection weight.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A PeopleSoft app/web-tier process (java/WebLogic/Tuxedo) spawned an interactive shell or scripting interpreter — post-RCE command execution. T1190 / T1059.004
2. H2 (high): A PeopleSoft host resolved or connected to azurenetfiles.net or the staging IP block 142.11.200.186-190 / TCP 8888 — MeshCentral C2 & SimpleHTTP staging. T1219 / T1071
3. H3 (high): A *_fanout.sh script ran, or the marker file README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT was written — lateral SSH spray + actor boast. T1021.004 / T1110
4. H4 (medium-high): An RMM agent (MeshCentral) executed from a path or under a name masquerading as a Microsoft/Azure binary. T1219 / T1036
5. H5 (medium): New .jsp appeared under the PSEMHUB web app, or a .xml under envmetadata/data/environment was modified — webshell / XMLDecoder persistence. T1505.003 / T1546
6. H6 (medium): zstd archived data and SSH carried it outbound from an app server — staging & exfiltration. T1560.001 / T1048

Attack chain

• WebLogic / reverse-proxy access logs: grep for external POSTs to /PSEMHUB/hub and /PSIGW/HttpListeningConnector, especially with non-browser user agents or anomalous source ASNs. Any external hit to PSEMHUB is suspect — it is an internal management endpoint.
• Filesystem sweep on PeopleSoft hosts: find / -name 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' -o -name '*_fanout.sh'; and list recently modified .xml under <PS_CFG_HOME>/envmetadata/data/environment.
• Webshell check: diff the PSEMHUB.war / PIA deployment directory against a known-good baseline for unexpected .jsp files.
• Linux auth logs: review /var/log/auth.log (or secure) on internal hosts for bursts of failed SSH from the PeopleSoft app-server IPs — the fanout spray signature.
• Oracle/PeopleTools version inventory: confirm whether PeopleTools 8.61/8.62 instances have the 10 Jun 2026 Oracle fix applied; flag any unpatched, internet-reachable PSEMHUB.

Q1 and Q5 are strong promotion candidates — both are near-zero-FP behaviors on a clean PeopleSoft estate. Q3/Q4/Q6 should remain investigate-only hunts until tuned to the local backup/RMM baseline.

1 — Reverse proxy: block PSEMHUB & Integration Broker externally (nginx)

# In the server block fronting PeopleSoft Internet Architecture (PIA)
location ~* ^/(PSEMHUB|PSIGW/HttpListeningConnector) {
    # allow only the internal management subnet; deny everything else
    allow 10.0.0.0/8;
    deny  all;
    return 403;
}

2 — Linux: hunt & quarantine campaign artifacts on a PeopleSoft host

#!/usr/bin/env bash
set -euo pipefail
PS_HOME="${PS_CFG_HOME:-/opt/peoplesoft}"
echo "[*] Searching for UNC6240 artifacts..."
find / -xdev -type f \( -name '*_fanout.sh' \
   -o -name 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' \) 2>/dev/null
echo "[*] Recently modified XMLDecoder config (last 30 days):"
find "$PS_HOME/envmetadata/data/environment" -name '*.xml' -mtime -30 2>/dev/null
echo "[*] Unexpected .jsp under PSEMHUB deployment:"
find "$PS_HOME" -path '*PSEMHUB*' -name '*.jsp' 2>/dev/null

3 — Linux: break the SSH credential-spray path

# /etc/ssh/sshd_config on internal hosts
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
# then: systemctl restart sshd
# verify: sshd -T | grep -E 'passwordauthentication|permitrootlogin'

Known gaps: the initial HTTP exploit (T1190) has no Falcon-native query — coverage relies on WebLogic/proxy access logs forwarded to NGSIEM (§7) and on perimeter blocking (§12). Atomic file hashes are unpublished, so host-IOC CSV uses placeholders. Validate Q1/Q6 field names and baseline against backup activity before promoting to block.