Google Threat Intelligence Group and Mandiant report that UNC6240, tracked publicly with ShinyHunters activity, has resumed broad exploitation of Oracle PeopleSoft CVE-2026-35273. The important part for defenders is not just that an enterprise application is being exploited again. It is how the campaign adapted after defenders started blocking the obvious path.

According to GTIG, the earlier wave focused heavily on higher education. The renewed activity expanded across multiple sectors, including healthcare, agriculture, transportation, technology, IT services, and government. Attackers modified requests to reach the vulnerable Environment Management Hub endpoint by using an encoded path variant instead of the plain /PSEMHUB/ string many organizations had placed into web application firewall rules.

Source: Google Threat Intelligence Group / Mandiant: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

What changed

The core lesson is straightforward: string-matching at the perimeter is brittle when the vulnerable application normalizes the request differently than the device enforcing the rule. In this case, GTIG says the attackers used a percent-encoded character in the endpoint path. Some WAF or reverse-proxy rules saw a different literal string, while the application server decoded the request and routed it to the vulnerable servlet anyway.

That is the difference between “we blocked the known URI” and “the system is no longer exploitable.” Those are not the same control.

Why this matters for SMBs and government contractors

PeopleSoft is not a small-business tool in the usual sense, but the defensive pattern applies directly to smaller environments and contractors supporting federal, healthcare, education, or logistics customers. Many organizations rely on compensating controls because patch windows are hard, legacy applications are fragile, and ownership is split between IT, business owners, and vendors.

Compensating controls can buy time. They should not become the final state.

When an attacker can bypass a WAF rule with path encoding, mixed case, alternate routing, or request normalization quirks, the defender’s confidence collapses fast. The same risk shows up in VPN appliances, file-transfer systems, help desk portals, developer platforms, and other internet-facing business applications where teams often add temporary blocks while waiting for a patch or vendor guidance.

Defensive priorities

  • Patch or disable the vulnerable component. Treat perimeter filtering as a temporary risk reducer, not remediation. If EMHub is not required, remove or disable it following Oracle and incident-response guidance.
  • Normalize before matching. Any WAF, reverse proxy, or edge rule should evaluate decoded and canonicalized paths, not just raw literal strings. Test encoded, mixed-case, and unusual path variants.
  • Search all application nodes. Load-balanced environments can leave only some servers touched during exploitation. Check every WebLogic node and application directory, not just the first host that shows suspicious traffic.
  • Hunt for fileless execution as well as web shells. A clean filesystem does not prove the application was safe. Monitor for command interpreters spawned by Java/WebLogic processes and unusual child-process chains.
  • Rotate exposed credentials. If an application server was reachable by exploitation, assume configuration files, database strings, integration credentials, and nearby cloud credentials may have been readable.
  • Constrain outbound traffic. Enterprise application servers should not have unrestricted internet egress. Web shell activity becomes harder to operationalize when outbound callbacks, tooling downloads, and reverse shells are blocked or logged.

Bulwark Black assessment

This campaign is a clean example of attackers learning from published mitigations. Once defenders blocked the obvious path, the operator adjusted the request shape instead of changing the whole exploit chain. That is exactly why patch validation matters: after a temporary control is deployed, defenders need to prove whether the vulnerable code path is actually unreachable under normalized and adversarial request conditions.

For organizations with exposed enterprise applications, the practical move is to maintain a short “internet-facing critical app” register: owner, patch state, compensating control, log source, outbound policy, credential dependencies, and last validation date. If a zero-day or n-day lands, that register turns the first two hours from guesswork into execution.

The uncomfortable truth is that WAF rules are easiest to believe when nobody is testing them like an attacker. This PeopleSoft activity is the reminder to test them that way.