UNC6240 Encodes /%50SEMHUB/ to Bypass WAFs and Exploit Oracle PeopleSoft CVE-2026-35273

Attackers send POST requests to /%50SEMHUB/hub containing serialized Java objects that abuse deserialization in the Environment Management Hub servlet. Two JSP web shells are dropped into PSEMHUB.war: x.jsp for command execution and u.jsp for chunked uploads. The chain then stages a signed Ple64.exe loader that runs the SIDEEYE backdoor in memory, connecting to 162.219.30[.]165, alongside Neo-reGeorg and MeshAgent for persistence. Mandiant observed the same group previously exploiting the zero-day against academic targets for lateral movement via SSH and credential reuse before shifting to WAF evasion. Roughly 25 percent of executed commands ran as root or SYSTEM. Targets now span seven sectors with web shells confirmed on dozens of hosts. The pattern matches repeated enterprise-app exposures where default or poorly monitored servlets become initial access vectors; WAFs that decode only after matching literal strings create a persistent blind spot. Procurement records show PeopleSoft remains widely deployed in regulated industries despite known deserialization risks. Organizations must apply the CVE-2026-35273 patch immediately, disable EMHub where possible, and hunt WebLogic logs for percent-encoded variants. Continued monitoring of outbound traffic from PeopleSoft hosts is required as UNC6240 shifts focus to data exfiltration from HR and payroll tables.