ShinyHunters Extortion Gang Uses URL-Encoding Trick to Bypass WAF Rules and Resumes Global Oracle PeopleSoft Attacks

The notorious ShinyHunters cybercriminal and extortion collective has launched a renewed wave of widespread cyberattacks targeting vulnerable Oracle PeopleSoft servers globally. By weaponizing a clever URL-encoding bypass technique, the threat actors are successfully subverting standard web application firewall (WAF) protections designed to mitigate a critical remote code execution flaw. This development has triggered urgent warnings from elite cybersecurity researchers, including Google’s Mandiant and Threat Intelligence Group (GTIG), who note that organizations relying solely on perimeter defenses are unknowingly exposed to ongoing data theft and backdoor deployments.

The vulnerability at the center of this renewed campaign is tracked as CVE-2026-35273. The flaw affects the Environment Management Hub component of Oracle PeopleSoft, specifically residing within the PSEMHUB endpoint. According to security analysts, the vulnerability allows unauthenticated remote code execution (RCE), giving malicious actors the capability to infiltrate enterprise infrastructure without needing valid user credentials.

Security researchers track the ShinyHunters operational cell under the designation UNC6240. The group has leveraged the WAF bypass technique to target systems across multiple high-value industries, including higher education, technology, information technology services, healthcare, agriculture, transportation, and government agencies worldwide. The resurgence of these attacks underscores the sophisticated adaptability of modern extortion groups, who continuously refine their tactics to outpace defensive patches and perimeter mitigations.

Chronology of the Vulnerability and Campaign

The timeline of the CVE-2026-35273 vulnerability highlights the rapid escalation from initial exploitation to full-scale enterprise compromise.

The crisis first came to light on June 10, when security reporting revealed that the ShinyHunters extortion gang was actively exploiting an unknown zero-day vulnerability in Oracle PeopleSoft servers. At the time, early indications showed that the threat actors had successfully compromised and exfiltrated sensitive data from roughly 100 organizations.

Prompted by the emerging threat, Oracle moved swiftly. The very next day, on June 11, the software giant officially patched the zero-day flaw, designating it as CVE-2026-35273 and acknowledging its severity as an unauthenticated remote code execution vulnerability. Simultaneously, Google published telemetry confirming that UNC6240 was aggressively weaponizing the flaw, particularly targeting institutions within the education sector.

Because applying urgent software patches or completely disabling core enterprise components can take time, security firms like Mandiant provided immediate workaround guidance. Organizations incapable of immediately installing Oracle’s security updates were advised to implement web application firewall (WAF) rules or reverse proxy configurations to block external access to the vulnerable /PSEMHUB/* endpoint, effectively shielding the critical interface from the public internet.

However, threat actors routinely probe defensive workarounds for structural weaknesses. In a recent threat intelligence report, Google revealed that ShinyHunters had successfully engineered an exploit modification designed specifically to slip past literal-path WAF blocking rules. This breakthrough allowed the group to resume large-scale exploitation against servers whose administrators believed they were safely protected behind WAF configurations.

Anatomy of the WAF Bypass Technique

The mechanism behind the ShinyHunters WAF bypass relies on a classic web traffic obfuscation method: percent-encoding.

Traditional web application firewalls and reverse proxies are frequently configured with signature-based or path-matching rules. When an incoming HTTP request arrives, many security gateways inspect the literal string of the uniform resource locator (URL) path before performing full decoding operations. If a rule is written to explicitly block literal requests containing the string /PSEMHUB/, the security device evaluates the path based on those exact characters.

To circumvent this, ShinyHunters modified their exploit payloads by substituting standard characters with their percent-encoded equivalents. Instead of issuing requests directly to:

/PSEMHUB/

the attackers send requests formatted as:

/%50SEMHUB/

In this obfuscated variation, the character sequence %50 represents the standard percent-encoded hexadecimal value for the uppercase letter ‘P’.

When this encoded request hits a standard, misconfigured WAF or reverse proxy, the inspection engine may fail to recognize the pattern because it expects a literal ‘P’. Consequently, the security gateway permits the traffic to pass through to the backend server.

Once the request reaches Oracle WebLogic, the application server correctly interprets and decodes the %50 sequence back into the letter ‘P’. The server then routes the request directly to the vulnerable Environment Management Hub endpoint, successfully executing the malicious payload. Mandiant emphasizes that this dangerous disconnect between how perimeter WAFs and backend application servers handle URI normalization has left numerous enterprise operators with a false sense of security.

Furthermore, Google warns that the %50 variation is merely one iteration of this tactic. Threat actors can easily rotate through mixed-case variations, alternative percent-encoding sequences, or multi-layered encoding schemes to continuously evade static WAF signatures. Consequently, security experts stress that perimeter-based filtering must never be treated as a permanent substitute for official software patching.

Operational TTPs and Post-Exploitation Activity

Once ShinyHunters successfully bypasses perimeter security controls, their automated and manual post-exploitation framework deploys a robust suite of tools designed for persistence, data exfiltration, and lateral movement.

According to Mandiant telemetry, the exploitation lifecycle typically follows a predictable sequence:

1. Reconnaissance Probing: Prior to launching an active attack, the threat actors transmit a series of five to fifteen HTTP POST requests to /%50SEMHUB/hub. These requests contain carefully crafted serialized Java objects.
2. Silent System Profiling: On vulnerable systems, these initial probes return detailed information regarding the host operating system without writing malicious files to disk or causing service disruptions. This allows ShinyHunters to quietly inventory viable targets.
3. Memory Execution and Web Shell Deployment: Once a system is confirmed to be vulnerable, the attackers leverage the flaw to execute commands directly within system memory or deploy lightweight JavaServer Pages (JSP) web shells. Specifically, researchers have identified the use of an x.jsp shell for arbitrary command execution, alongside u.jsp and u2.jsp shells dedicated to uploading larger payloads.
4. Malware and Backdoor Installation: On compromised Windows servers, the threat actors utilize these web shells to drop an executable named Ple64.exe. This binary is designed to masquerade as a legitimate, digitally signed installer for the Light Alloy media player; however, it actually installs a sophisticated backdoor tracked by Google as SIDEEYE.
5. Capabilities of SIDEEYE: The SIDEEYE malware grants the attackers comprehensive control over the compromised environment. It facilitates credential theft, process and file management, interactive reverse shell capabilities, and full reverse proxy functionality.
6. Lateral Movement via Tunneling: To expand their footprint deeper into corporate networks, ShinyHunters frequently deploys the open-source Neo-reGeorg tunneling toolkit through tunnel.jsp and tunnel.jspx files. This toolkit allows attackers to tunnel SOCKS5 proxy traffic over standard, encrypted HTTP and HTTPS connections, effectively blending malicious traffic into normal enterprise web communications.
7. Linux Persistence: On compromised Linux-based infrastructure, Mandiant observed the threat actors installing legitimate remote management software, such as MeshAgent, to maintain long-term access and bypass standard administrative monitoring.

Broader Context: The Alleged FBI Breach and Ongoing Extortion Claims

The renewed campaign against Oracle PeopleSoft servers occurs against a backdrop of high-profile extortion claims made by the group. Prior to the widespread disclosure of the WAF bypass technique, ShinyHunters made headlines by asserting that they had successfully breached Federal Bureau of Investigation (FBI) systems.

In late September, representatives from the ShinyHunters gang contacted security journalists, claiming they had utilized a novel Oracle PeopleSoft zero-day vulnerability to compromise the FBI Jobs platform (FBIjobs.gov). The threat actors asserted that from the initial entry point, they achieved lateral movement into the bureau’s internal AWS GovCloud infrastructure.

The collective boasted that the alleged intrusion allowed them to exfiltrate between two and three terabytes of sensitive data. This purported cache included personal identifiable information (PII) belonging to current and former FBI employees, job applicants, and various internal administrative records.

While independent security researchers and media outlets were initially unable to independently verify the existence of this specific zero-day or quantify the exact volume of exfiltrated data, the FBI acknowledged that it had initiated an investigation into reported unauthorized activity affecting the FBIJobs platform. The federal agency did not explicitly confirm a systemic breach or the theft of classified data at the time.

Significantly, ShinyHunters later confirmed in communications with researchers that they employed the very same %50SEMHUB WAF bypass technique against the FBI Jobs infrastructure, though the group continues to insist that their operations also involved previously undisclosed zero-day components within the PeopleSoft ecosystem.

Remediation and Defensive Recommendations

In light of the widespread deployment of web shells and active exploitation campaigns, Google’s Mandiant and Threat Intelligence Group have issued urgent, actionable guidelines for organizations running Oracle PeopleSoft:

• Apply Official Patches Immediately: Organizations must prioritize installing the official security updates provided by Oracle to definitively remediate CVE-2026-35273. Relying on network-layer mitigations alone is no longer secure given the fluidity of WAF bypass tactics.
• Conduct Log Analysis: System administrators should immediately review Oracle WebLogic access logs for historical and ongoing requests directed toward /PSEMHUB/, as well as obfuscated variants such as /%50SEMHUB/ or other encoded character combinations. Finding these entries serves as a primary indicator of compromise or active probing.
• Audit for Unauthorized Artifacts: Security teams must proactively sweep servers for unauthorized JSP web shells (such as x.jsp, u.jsp, u2.jsp, tunnel.jsp, and tunnel.jspx), unexpected binaries like Ple64.exe, and unauthorized administrative tools like MeshAgent.
• Implement Network Segmentation: To prevent successful initial access from translating into total organizational compromise, enterprises should enforce strict internal network segmentation, limiting the ability of web servers to communicate laterally with critical domain controllers and internal data repositories.

As cybercriminal syndicates like ShinyHunters continue to weaponize application-layer obfuscation tricks, cybersecurity leaders emphasize that defense-in-depth strategies must account for input normalization discrepancies between perimeter security devices and internal application servers. Only through rigorous patching, continuous log monitoring, and aggressive threat hunting can enterprise networks effectively neutralize these persistent and evolving threats.