title: 'T1505.003 Web Shell or Payload Written into PeopleSoft PSEMHUB.war or PORTAL.war, or MeshAgent Staged in /tmp'
id: '630332b3-51f3-526c-b635-b2618660c9c1'
status: 'experimental'
description: 'File creation of a JSP, JSPX, executable or DLL inside the PeopleSoft PSEMHUB.war or PORTAL.war application directories, or of MeshAgent binaries and configuration in /tmp. After exploiting CVE-2026-35273, UNC6240 (ShinyHunters) writes single-line JSP web shells into PSEMHUB.war (x.jsp for hex-encoded command execution, u.jsp and u2.jsp for chunked uploads, and Neo-reGeorg tunnel.jsp / tunnel.jspx), often as a burst of sequentially numbered files so every node behind a load balancer gets a copy. On Windows it reassembles a 5.2 MB trojanized installer, Ple64.exe (SIDEEYE), in the same directory. On Linux it drops meshagent, meshagent.msh and meshagent.db into /tmp under the PeopleSoft service account. EMHub writes data files under PSEMHUB.war/envmetadata at runtime, but it does not write scripts or binaries, so a new JSP or executable there is the event. Google says to scan both PSEMHUB.war and PORTAL.war, and to check every WebLogic node, not just the first hit.'
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/'
    - 'https://thrunt.me/hunt/shinyhunters/'
    - 'https://attack.mitre.org/techniques/T1505/003/'
    - 'https://attack.mitre.org/techniques/T1219/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-10-24'
modified: '2026-10-24'
tags:
    - 'attack.persistence'
    - 'attack.t1505.003'
    - 'attack.command_and_control'
    - 'attack.t1219'
    - 'cve.2026-35273'
    - 'detection.emerging-threats'
    - 'tlp.clear'
logsource:
    category: 'file_event'
detection:
    selection_psemhub_dir:
        TargetFilename|contains:
            - '/PSEMHUB.war/'
            - '\PSEMHUB.war\'
            - '/PORTAL.war/'
            - '\PORTAL.war\'
    selection_psemhub_ext:
        TargetFilename|endswith:
            - '.jsp'
            - '.jspx'
            - '.exe'
            - '.dll'
    selection_meshagent_tmp:
        TargetFilename:
            - '/tmp/meshagent'
            - '/tmp/meshagent.msh'
            - '/tmp/meshagent.db'
    condition: '(selection_psemhub_dir and selection_psemhub_ext) or selection_meshagent_tmp'
falsepositives:
    - 'PeopleTools patching or redeployment rewrites PSEMHUB.war and PORTAL.war. Correlate with a change window; a patch run writes many files at once from the installer, not a handful of JSPs from the WebLogic process.'
    - 'An administrator deliberately installing MeshCentral agents. A sanctioned install does not land in /tmp under the PeopleSoft account.'
level: 'high'