ShinyHunters Returns To PeopleSoft With A One-Character WAF Bypass
===========================================================================================================
File            Role                Indicator
u.jsp           Upload servlet      2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7
Ple64.exe       SIDEEYE installer   3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3
x.jps           Web shell           48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494
tunnel.jsp      Neo-reGeorg         419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86
tunnel.jspx     Neo-reGeorg         ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07

===========================================================================================================
Network and host indicators
===========================================================================================================
Type                    Role                                            Indicator
IPv4 address            Scanner, attack controller, callback receiver   5.199.162.157
IPv4 address|           Exfiltration staging, remote management         104.219.234.138
IPv4 address and port   SIDEEYE C&C                                     162.219.30.165:3333 and :3334 
Domain name             MeshAgent infrastructure                        azurenetfiles.net
Domain name             MeshAgent infrastructure                        enroll.azuredevice.cloud
Domain name             MeshAgent infrastructure                        microsoft-entra.net
Domain name             MeshCentral infrastructure                      winmanage-me.network