ShinyHunters (UNC6240) Mass Exploitation of Oracle PeopleSoft CVE-2026-35273: SIDEEYE Backdoor, Neo-reGeorg Tunnels & MeshAgent — OTX Detection Pack

---
title: PeopleSoft WAF Bypass - URL-Encoded Path Exploitation Attempt (CVE-2026-35273)
id: 8a1f3c2e-9d4b-4e6a-b1c7-2f5d8a9e3b01
status: experimental
description: Detects URL-encoded request paths targeting Oracle PeopleSoft Environment Management endpoints, consistent with UNC6240/ShinyHunters WAF bypass technique observed in OTX pulse
date: 2026/09/28
author: Security Arsenal Threat Intelligence
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft
logsource:
  category: webserver
product: windows
service: iis
detection:
  selection_encoded_path:
    cs-uri-stem|contains:
      - '%2e'
      - '%2f'
      - '%5c'
      - '%25'
  selection_peoplesoft:
    cs-uri-stem|contains:
      - '/psc/'
      - '/psp/'
      - 'emhub'
      - 'PSEMHUB'
      - 'EnvironmentManager'
  condition: selection_encoded_path and selection_peoplesoft
falsepositives:
  - Legitimate application URLs with encoded characters (rare on these endpoints)
level: high
tags:
  - attack.initial_access
  - attack.t1190
---
title: SIDEEYE C2 Communication to ShinyHunters Infrastructure
id: 7b2e4d1f-6c3a-5f7b-c2d8-3e6f9b0c4d12
status: experimental
description: Detects network connections from PeopleSoft server processes to known UNC6240 SIDEEYE C2 infrastructure or unexpected outbound connections from Java web-tier processes
date: 2026/09/28
author: Security Arsenal Threat Intelligence
logsource:
  category: network_connection
  product: windows
detection:
  selection_c2:
    DestinationHostname: 'azurenetfiles.net'
  selection_c2_ip:
    DestinationIp: '104.219.234.138'
  selection_webtier_egress:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\w3wp.exe'
    DestinationPort:
      - 443
      - 80
  condition: selection_c2 or selection_c2_ip or selection_webtier_egress
falsepositives:
  - Legitimate Oracle update traffic from PeopleSoft web tier (baseline and exclude known Oracle endpoints)
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
---
title: MeshAgent RMM Execution on PeopleSoft Web Tier
id: 5c3a7e2d-4f1b-6a8c-d3e9-4f7a0b1d5e23
status: experimental
description: Detects execution or installation of MeshCentral MeshAgent, repurposed by UNC6240 as an RMM persistence mechanism on compromised servers
date: 2026/09/28
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\meshagent.exe'
      - '\meshagent64.exe'
  selection_cmdline:
    CommandLine|contains:
      - 'meshagent'
      - 'meshcentral'
  selection_service:
    CommandLine|contains:
      - '-fullinstall'
      - 'Mesh Agent'
  condition: selection_image or selection_cmdline or selection_service
falsepositives:
  - Authorized MeshCentral deployment (verify against approved RMM inventory)
level: high
tags:
  - attack.command_and_control
  - attack.t1219

// UNC6240 / ShinyHunters PeopleSoft Compromise Hunt - Microsoft Sentinel
// Hunts network IOCs, web-tier egress anomalies, and MeshAgent/SIDEEYE artifacts
let Lookback = 30d;
let C2IP = "104.219.234.138";
let C2Domain = "azurenetfiles.net";
let SIDEEYEHashes = dynamic([
    "2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7",
    "3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3",
    "419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86",
    "48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494",
    "ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteIP == C2IP or RemoteUrl has C2Domain
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
    | extend HuntHit = "Known C2 Network IOC"
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in~ (SIDEEYEHashes)
    | project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName
    | extend HuntHit = "SIDEEYE File Hash Match"
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (ProcessCommandLine has_any ("meshagent", "meshcentral", "Neo-reGeorg", "reGeorg"))
        or (FileName in~ ("java.exe", "javaw.exe", "w3wp.exe") and ProcessCommandLine has_any ("cmd.exe", "powershell", "certutil", "curl", "bitsadmin"))
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend HuntHit = "MeshAgent/RMM or Web-Tier Shell Spawning"
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "w3wp.exe")
    | where RemotePort in (443, 80) and not(RemoteUrl has_any ("oracle.com", "microsoft.com", "windowsupdate.com"))
    | summarize ConnectionCount = count(), RemoteHosts = make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName
    | extend HuntHit = "PeopleSoft Web Tier Unexpected Egress"
)
| sort by TimeGenerated desc

# UNC6240 / ShinyHunters - PeopleSoft Compromise IOC Sweep
# Run elevated on PeopleSoft web/application tier servers

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

# --- 1. Hash sweep for SIDEEYE payloads ---
$SIDEEYEHashes = @(
    '2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7',
    '3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3',
    '419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86',
    '48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494',
    'ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07'
)

$SearchPaths = @('C:\PSFT', 'D:\PSFT', 'C:\oracle', 'C:\Inetpub', 'C:\Temp', 'C:\Windows\Temp')
foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -Include *.jsp,*.jspx,*.asp,*.aspx,*.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            if ($SIDEEYEHashes -contains $h) {
                $Report += [PSCustomObject]@{ Check='SIDEEYE Hash Match'; Finding=$_.FullName; Severity='CRITICAL' }
            }
        }
    }
}

# --- 2. Web shell / Neo-reGeorg artifact hunt (recent JSP/JSPX in web roots) ---
$WebRoots = @('C:\PSFT\webserv', 'D:\PSFT\webserv')
foreach ($Root in $WebRoots) {
    if (Test-Path $Root) {
        Get-ChildItem -Path $Root -Recurse -Include *.jsp,*.jspx,*.war -File |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) } |
            ForEach-Object {
                $content = Get-Content $_.FullName -Raw
                if ($content -match 'reGeorg|socket|ProcessBuilder|Runtime\.getRuntime|proxy') {
                    $Report += [PSCustomObject]@{ Check='Suspicious Web Shell Content'; Finding=$_.FullName; Severity='HIGH' }
                }
            }
    }
}

# --- 3. MeshAgent persistence: services, scheduled tasks, run keys ---
$MeshSvc = Get-Service | Where-Object { $_.Name -match 'mesh' -or $_.DisplayName -match 'mesh' }
if ($MeshSvc) { $Report += [PSCustomObject]@{ Check='MeshAgent Service'; Finding=($MeshSvc | Out-String).Trim(); Severity='HIGH' } }

Get-ScheduledTask | Where-Object { $_.TaskName -match 'mesh' -or ($_.Actions.Execute -match 'meshagent') } | ForEach-Object {
    $Report += [PSCustomObject]@{ Check='MeshAgent Scheduled Task'; Finding=$_.TaskName; Severity='HIGH' }
}

$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $RunKeys) {
    (Get-ItemProperty $key).PSObject.Properties | Where-Object { $_.Value -match 'meshagent' } | ForEach-Object {
        $Report += [PSCustomObject]@{ Check='MeshAgent Run Key'; Finding="$key -> $($_.Name)=$($_.Value)"; Severity='HIGH' }
    }
}

# --- 4. Live network connections to C2 / from web-tier processes ---
$SuspiciousConns = Get-NetTCPConnection -State Established | Where-Object {
    $_.RemoteAddress -eq '104.219.234.138' -or
    ($_.OwningProcess -in (Get-Process java,javaw,w3wp -ErrorAction SilentlyContinue).Id -and $_.RemotePort -in @(80,443))
}
foreach ($c in $SuspiciousConns) {
    $proc = (Get-Process -Id $c.OwningProcess).ProcessName
    $Report += [PSCustomObject]@{ Check='Suspicious Web-Tier Egress'; Finding="$proc -> $($c.RemoteAddress):$($c.RemotePort)"; Severity='CRITICAL' }
}

# --- 5. DNS cache check for C2 domain ---
$DnsHit = Get-DnsClientCache | Where-Object { $_.Entry -match 'azurenetfiles\.net' }
if ($DnsHit) { $Report += [PSCustomObject]@{ Check='C2 DNS Resolution'; Finding=($DnsHit | Out-String).Trim(); Severity='CRITICAL' } }

# --- Output ---
if ($Report.Count -eq 0) { Write-Host '[+] No UNC6240 indicators found on this host.' -ForegroundColor Green }
else { $Report | Sort-Object Severity | Format-Table -AutoSize | Out-String | Write-Host -ForegroundColor Red }