Hunt
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Identify unauthenticated access to Oracle PeopleSoft EMHub endpoints and subsequent MeshCentral agent deployment.
Hunt Hypothesis
Threat actors exploited CVE-2026-35273 via /PSEMHUB/hub to stage MeshCentral agents and execute fanout credential spraying scripts.
Target Platforms & Environment
All internet-facing and internal Oracle PeopleSoft application servers running WebLogic and Process Scheduler.
Required Telemetry & Data Sources
✓ Operational Execution Phases
2 Structured Investigation PhasesWeb Tier Perimeter Audit
🎯 Phase Goal: Identify initial unauthenticated exploit attempts against PeopleSoft EMHub endpoints.
Procedural Actions
- 1.1 Filter web access logs for HTTP POST requests to /PSEMHUB/hub and /PSIGW/HttpListeningConnector.
- 1.2 Isolate source IPs outside of the trusted administrative range and correlate with subsequent 200 OK responses.
Phase Hunting Logic & Queries
index=web (uri_path="/PSEMHUB/hub*" OR uri_path="/PSIGW/HttpListeningConnector*") http_method=POST | stats count by src_ip, statusAnomaly Confirmation & Pivot Guidance
↪ Pivot from external source IPs to all subsequent web requests across the DMZ fleet.
Host Execution & Persistence Inspection
🎯 Phase Goal: Determine whether MeshCentral agents or unauthorized webshells were written to disk and executed.
Procedural Actions
- 2.1 Examine file creation telemetry under /PSEMHUB.war/ and temp staging folders.
- 2.2 Verify running processes for meshagent, meshctrl.js, or unexpected node instances.
Phase Hunting Logic & Queries
index=endpoint (process_name="meshagent*" OR process_name="meshctrl.js") | table _time, host, user, process_pathAnomaly Confirmation & Pivot Guidance
↪ Inspect local user accounts and cron / systemd units created around the execution timestamp.