Exploit scripts targeting enterprise resource planning applications have compromised personal records of employees in North and South America, following a zero-day attack on Oracle PeopleSoft systems. Discover the technical attack chain, from initial deserialization flaws to automated lateral propagation.
Exploit scripts targeting enterprise resource planning applications have compromised the personal records of employees in North and South America, following a zero-day attack on Oracle PeopleSoft systems utilized by Nissan Motor Corporation. The compromised assets include highly sensitive identity files containing Social Security numbers, banking information, tax records, and direct deposit details for current and former staff. Because modern enterprises rely heavily on central human resources frameworks, this compromise highlights the severe vulnerabilities that arise when administration platforms are exposed directly to the public internet without adequate isolation zones.
By leveraging weaknesses in core business operations portals, attackers can bypass perimeter defenses to reach back-end databases. This zero-day campaign shows that enterprise resource planning applications remain high-value targets for advanced financial extortion groups. The threat actors focus on extracting structural databases that contain administrative access keys, employee payroll data, and banking routing information. When critical systems are left unpatched or exposed, the risk of data theft increases dramatically, necessitating continuous offensive testing and network micro-segmentation to secure vital assets.
Critical deserialization vulnerability in Oracle PeopleSoft Enterprise PeopleTools Environment Management component.
To understand how this intrusion occurred, security engineers must analyze the specific progression of the threat campaign. The threat actors, identified by research teams as the financially motivated group ShinyHunters, targeted the Environment Management Hub component within Oracle PeopleSoft Enterprise PeopleTools. Although the vulnerability identification code is tracked in public disclosures, the underlying root cause is a severe failure to properly validate input during the deserialization of XML metadata within the application. This allows unauthenticated remote adversaries to execute arbitrary system-level commands on the underlying web server.
The step-by-step attack chain progressed from initial boundary exploitation to automated lateral propagation, culminating in complete data exfiltration:
Initial Access: The attackers initiated the assault by scanning for exposed human resources portals on the public web. Once an active target was identified, they dispatched crafted, unauthenticated HTTP POST requests targeting the Environment Management Hub endpoints, specifically /PSEMHUB/hub and the PeopleSoft Integration Gateway listening connector. By exploiting a deserialization flaw, the attackers either executed code directly or triggered the target server to initiate outbound SMB connections to capture NetNTLM system hashes.
Web Shell Deployment: Following successful command execution, the adversaries established initial persistence by dropping JavaServer Pages web shells directly into the active web directory. These malicious scripts were hidden in the war archive structure, specifically under the web services directory. This gave the attackers a reliable, interactive administrative console to run shell commands without needing to re-exploit the zero-day vulnerability.
Remote Management Agents: To reinforce their foothold, the threat actors deployed customized, open-source MeshCentral remote management agents. They modified the executable binaries to masquerade as legitimate Microsoft Azure management utilities, using names like meshagent64-azure-ops.exe. These agents established outbound persistent WebSockets connections back to the attacker-controlled command and control domain over port 443, effectively bypassing basic egress firewall rules that permit secure web traffic.
Host Reconnaissance: Utilizing command-line utility tools, the attackers executed targeted queries across the compromised host to extract internal system configuration details. They searched for application server configuration files, specifically inspecting files like psappsrv.cfg to extract database passwords, local hostnames, active network file mounts, and internal subnet IP addresses.
Lateral Propagation: After gathering internal host details, the threat group uploaded a custom lateral movement Unix shell script named with the victim organization abbreviation to the temporary directory of the compromised host. This script automated SSH credential spraying across the internal subnet, using hardcoded administrative passwords and default credentials to compromise adjoining application and database servers.
Exfiltration: With administrative credentials secured, the actors located the principal human resource databases and compressed the files using the zstd utility to minimize the payload footprint. The resulting archive was exfiltrated over SSH connections directly to a public mirror of the adversary data leak site. To complete the phase, they dropped a local extortion text file titled README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT across several server directories.
Exploitation of CVE-2026-35273 deserialization flaw on PSEMHUB components.
JSP web shells dropped into war directory to establish basic command execution.
Deployment of customized MeshCentral agents disguised as Azure binaries establishing WebSockets.
Extraction of system metadata and db passwords from psappsrv.cfg configurations.
Execution of Unix SSH credential-spraying scripts targeting internal subnet ranges.
Compression of sensitive HR databases using zstd, transmitted via SSH to DLS mirrors.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
An online learning management system belonging to a diplomatic academy was breached via a zero-day authentication bypass exploit. Threat actors maintained persistent access for ten months, compromising the personal data of 10,000 diplomatic personnel, including encrypted passwords and email addresses.
An alleged data breach targeting Brazilian payment gateway and digital banking platform PagBank has surfaced on underground forums. A threat actor claims to possess a database containing information related to 10 billion transactions, highlighting the growing cybersecurity risks facing the fintech sector.
An 8 GB SQL database archive has been leaked online, exposing sensitive student records, institutional identifiers, and emails. The incident highlights critical security gaps in public-facing educational platforms and the immediate danger of secondary credential abuse attacks across enterprise environments.
To determine if your environment has been impacted, check the version of your Oracle PeopleTools installation to see if it resides within the vulnerable release band. Next, inspect the directory structure within the war application archives to ensure no unauthorized JSP scripts are present. Audit the modified timestamps of all configuration files under the environment metadata folders to detect unauthorized changes. If indicators of compromise are identified, immediately isolate the affected servers, terminate any unauthorized remote management processes, and initiate a comprehensive credential rotation cycle for all database and administrative accounts defined within the configuration templates.
Long-term resilience depends on removing unnecessary features from exposed servers. If the Environment Management Hub is not actively required for environment synchronization, it should be disabled or completely uninstalled from the application deployment stack. Enforce strict outbound firewall rules, specifically blocking TCP port 445 traffic from all enterprise application servers to external networks to prevent the extraction of NetNTLM system hashes. Finally, restrict access to any personnel portals, timesheet applications, or payroll databases so they are only accessible over secure, authenticated virtual private network connections.
Compromises involving enterprise resource planning and human resources databases present a unique set of challenges that extend far beyond initial technical containment. The data exposed in this breach includes comprehensive banking information, tax filings, and Social Security numbers for personnel working across multiple jurisdictions. For multinational companies, such exposure creates immense regulatory risk, requiring immediate disclosure to state, federal, and international data protection authorities under strict reporting timelines.
Furthermore, when employee banking details are leaked, the risk of targeted social engineering and phishing increases dramatically. Attackers can leverage specific routing and payroll information to draft highly convincing emails targeting corporate finance departments or individual employees. To identify and close these vulnerable exposure vectors before adversaries find them, organizations should regularly invest in proactive penetration testing to validate the integrity of their network boundaries and locate exposed admin portals.
If the domain already looks exposed, use Dark Web Scanner before requesting a full report.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
Securing enterprise applications against complex zero-day campaigns requires a coordinated defense strategy that combines strict access policies, continuous log analysis, and rapid patching pipelines. The first defensive priority is to reduce the overall attack surface by limiting the exposure of administrative portals to the public internet. Organizations should utilize comprehensive vulnerability assessments to verify that internal ERP engines are fully isolated from untrusted zones.
Security teams should establish immediate log queries and behavioral rules to check for signs of active exploitation. Search web access logs for HTTP POST requests directed at /PSEMHUB/hub or /PSIGW/HttpListeningConnector that originate from unfamiliar external addresses. Additionally, look for processes executing zstd compression commands with multi-threading flags or scripts containing SSH credential-spraying routines in temporary system folders.
Endpoint detection and response agents must be configured to alert on any non-standard binaries launching from the WebLogic directory. Pay close attention to utilities attempting to resolve connections to malicious infrastructure, specifically checking network logs for outbound traffic to the known bad hosting subnet of 142.11.200.186 through 190 or connections to the domain azurenetfiles.net.
