ShinyHunters Extortion Gang Bypasses Web Application Firewalls Using URL-Encoding to Target Vulnerable Oracle PeopleSoft Servers

The notorious cybercrime and extortion collective known as ShinyHunters has launched a renewed, large-scale exploitation campaign targeting Oracle PeopleSoft servers worldwide. By deploying a sophisticated URL-encoding trick, the threat actors are successfully bypassing web application firewall (WAF) rules that organizations implemented to mitigate a critical remote code execution flaw. This development has left countless enterprise environments exposed, despite administrators believing they had adequately shielded their networks from ongoing threats.

Security researchers from Google’s Mandiant and Threat Intelligence Group (GTIG) revealed that the exploit modification specifically circumvents perimeter defenses designed to block access to the vulnerable PeopleSoft Environment Management Hub. As a result, the campaign has affected a diverse array of global sectors, including higher education, technology, IT services, healthcare, agriculture, transportation, and government agencies.

The renewed wave of intrusions underscores the persistent cat-and-mouse game between enterprise defenders and resourceful threat groups, highlighting the critical difference between relying on temporary perimeter workarounds and applying permanent software patches.

Chronology and Evolution of the Oracle PeopleSoft Vulnerability

The genesis of this ongoing cybersecurity crisis traces back to early June, when coordinated intelligence reports first shed light on active exploitation targeting enterprise-grade Oracle infrastructure. The timeline of events outlines a rapid escalation from an unpatched zero-day vulnerability to a widespread, multi-layered data extortion campaign:

• June 10: Security publication BleepingComputer broke the news that the ShinyHunters extortion gang was actively exploiting a zero-day vulnerability in Oracle PeopleSoft servers, successfully compromising data across approximately 100 high-profile organizations.
• June 11: Oracle moved swiftly to release an emergency software update addressing the flaw, formally tracking it as CVE-2026-35273. The vulnerability was classified as a critical unauthenticated remote code execution (RCE) bug. Simultaneously, Google’s threat intelligence division identified the threat group executing these attacks as UNC6240—widely recognized as ShinyHunters—confirming their focus on the education sector and other critical industries.
• Mid-June: Because immediate patching is often logistically challenging for large enterprises running complex ERP environments, Mandiant issued interim mitigation guidance. Security experts advised organizations unable to instantly deploy Oracle’s security update or disable the Environment Management Hub to place a strict block on external traffic targeting the vulnerable /PSEMHUB/* endpoint via web application firewalls.
• Late September: ShinyHunters publicly claimed responsibility for breaching internal systems belonging to the Federal Bureau of Investigation (FBI), asserting that they had utilized a novel PeopleSoft zero-day to compromise the FBI Jobs platform and subsequently pivot into AWS GovCloud infrastructure.
• Current Disclosures: Google Mandiant published detailed technical findings showing that ShinyHunters had modified their attack scripts to bypass standard WAF configurations, reigniting mass exploitation against organizations that relied solely on firewall rules rather than official patches.

Anatomy of the WAF Bypass Technique

The core mechanism enabling this latest surge in attacks relies on a fundamental discrepancy in how perimeter security controls and backend application servers handle URI string processing.

When security vendors and enterprise defenders analyzed the initial exploitation of CVE-2026-35273, they configured WAFs and reverse proxies to inspect incoming HTTP requests for the literal string /PSEMHUB/. If a request matched this path, the firewall would automatically drop or block the connection, protecting the underlying server from malicious payloads.

However, ShinyHunters updated their exploitation framework to leverage percent-encoding. Instead of sending a direct request to /PSEMHUB/, the threat actors encode specific characters—most notably replacing the capital letter "P" with its hexadecimal equivalent, %50. Consequently, requests are dispatched using the modified format /%50SEMHUB/.

This subtle variation exploits a parsing blind spot. Many conventional WAFs and perimeter proxies evaluate the incoming request path in its raw, literal format before performing normalization or decoding routines. Because the string does not literally contain the sequence PSEMHUB, the firewall allows the traffic to pass unhindered.

Once the packet reaches the backend Oracle WebLogic server, the application stack automatically decodes the percent-encoded %50 back into the letter ‘P’ and routes the request directly to the vulnerable Environment Management Hub endpoint. This technical loophole effectively neutralizes the protective measures implemented by system administrators, granting unauthorized access to systems previously thought to be secure.

Google Mandiant has warned that the actors are not limited to this single variation. The group can easily cycle through alternative percent-encoded representations, mixed-case permutations, or different string obfuscation techniques to continuously evade static signature-based WAF rules.

Attack Methodology and Post-Exploitation Tactics

Once ShinyHunters successfully bypasses perimeter defenses, their execution chain follows a methodical and quiet reconnaissance protocol before deploying aggressive post-exploitation tooling.

According to threat intelligence telemetry, the attackers typically initiate contact by transmitting a series of five to fifteen HTTP POST requests directed at /%50SEMHUB/hub. These payloads contain serialized Java objects designed to query the host operating system. Crucially, these initial probes execute without writing files to disk or disrupting standard service operations, allowing the threat actors to silently verify whether a specific server is vulnerable and ripe for full compromise.

Upon confirming a vulnerable environment, the attackers leverage CVE-2026-35273 to execute arbitrary commands directly in system memory or to deploy Java Server Pages (JSP) web shells. Analysts have identified several specific web shells utilized in this campaign:

• x.jsp: Deployed primarily for general command execution.
• u.jsp and u2.jsp: Utilized specifically for uploading larger files and payloads into the compromised environment.

On Microsoft Windows-based enterprise servers, the actors use these web shells to drop an executable file named Ple64.exe. To blend in with legitimate administrative tools, the binary masquerades as a signed installer for the Light Alloy media player. In reality, it installs a persistent backdoor tracked by Google as SIDEEYE. The SIDEEYE malware grants the attackers robust post-exploitation capabilities, including credential harvesting, advanced process and file management, interactive reverse shell generation, and reverse proxy functionalities.

For Linux environments, the threat actors have been observed deploying legitimate remote management software, such as MeshAgent, to maintain persistent, long-term access without raising immediate alarms. Furthermore, ShinyHunters frequently implements the open-source Neo-reGeorg tunneling toolkit via files named tunnel.jsp and tunnel.jspx. This tool enables normal HTTP and HTTPS connections to tunnel SOCKS5 proxy traffic, effectively turning the compromised PeopleSoft server into a staging point for lateral movement deep inside the victim’s internal corporate network.

The FBI Breach Claims and Public Sector Implications

The severity of the ShinyHunters campaign was further emphasized by the group’s high-profile claims regarding United States federal law enforcement infrastructure. In late September, representatives of the extortion syndicate communicated with security journalists, asserting that they had successfully penetrated FBI systems.

The collective claimed that their initial point of entry involved an advanced PeopleSoft exploit targeting the FBI Jobs platform (FBIjobs.gov). According to the group’s statements, this access facilitated lateral movement into the bureau’s AWS GovCloud environment, resulting in the alleged exfiltration of between two and three terabytes of sensitive data. This purported data cache included internal records concerning current and former personnel, job applicants, and associated administrative frameworks.

While independent cybersecurity researchers could not immediately verify the technical validity of the alleged zero-day or the exact scale of the data theft at the time, the FBI acknowledged that it initiated a formal inquiry into unauthorized activity associated with the portal.

In subsequent discussions regarding their operational tactics, ShinyHunters confirmed that they utilized the exact same URL-encoding WAF bypass technique against the FBI Jobs infrastructure, while continuing to maintain assertions that they also incorporated novel, undisclosed components in their broader intrusion strategy.

Enterprise Defense Recommendations and Remediation Strategies

In light of the widespread adoption of the WAF bypass technique by sophisticated threat actors, leading cybersecurity organizations are strongly urging enterprises to abandon reliance on temporary perimeter mitigations and pursue definitive system hardening.

Google Mandiant has outlined a comprehensive set of immediate actions for organizations operating Oracle PeopleSoft environments:

1. Prioritize Official Patching: Perimeter defenses and WAF rules should only ever be treated as temporary stopgaps. Organizations must urgently apply the official security updates provided by Oracle to definitively remediate CVE-2026-35273 at the software level.
2. Log Analysis and Threat Hunting: Security operations centers (SOCs) are advised to thoroughly comb through historical and real-time WebLogic access logs. Defenders should specifically search for incoming HTTP requests directed at /PSEMHUB/ as well as any obfuscated or encoded variants, such as /%50SEMHUB/, which serve as definitive indicators of active reconnaissance or exploitation attempts.
3. Endpoint Integrity Checks: Given the silent nature of the initial probing phase, system administrators should audit their web directories for unauthorized JSP files (such as x.jsp, u.jsp, and tunnel.jsp) and inspect running processes for suspicious executables masquerading as legitimate software binaries like Ple64.exe.
4. Network Segmentation: To limit the blast radius of potential intrusions, organizations must enforce strict internal segmentation, ensuring that enterprise resource planning (ERP) servers cannot easily communicate with or pivot into sensitive internal subnetworks via unauthorized tunneling protocols.

As cybercriminal syndicates become increasingly adept at bypassing traditional perimeter security layers through simple yet effective protocol-parsing discrepancies, the latest campaign by ShinyHunters serves as a stark reminder of the vital necessity for rigorous vulnerability management, deep log visibility, and prompt patch implementation across all enterprise software stacks.