ShinyHunters Extortion Gang Bypasses Web Application Firewalls Using URL-Encoding to Renew Attacks on Oracle PeopleSoft Servers

The notorious cyber extortion collective known as ShinyHunters has launched a renewed and aggressive mass exploitation campaign targeting vulnerable Oracle PeopleSoft environments worldwide. By leveraging a sophisticated URL-encoding trick, the threat actors are successfully bypassing web application firewall (WAF) rules that administrators deployed as stopgap mitigations earlier this year. According to findings published by cybersecurity researchers at Google’s Mandiant and Threat Intelligence Group (GTIG), this evasion technique allows the cybercriminal syndicate to circumvent perimeter security defenses and re-establish unauthorized access to enterprise servers that have not yet applied critical vendor patches.

The campaign centers around CVE-2026-35273, a severe unauthenticated remote code execution vulnerability residing within the Oracle PeopleSoft Environment Management Hub (PSEMHUB). While Oracle issued formal security updates to resolve the flaw shortly after its disclosure, many organizations reliant on complex ERP systems found themselves unable to execute immediate patching cycles. Consequently, security teams turned to WAFs and reverse proxies to block external HTTP requests directed at the /PSEMHUB/* endpoint, believing their networks were sufficiently shielded. However, ShinyHunters has weaponized a simple yet effective encoding maneuver to bypass these literal path-matching filters, putting numerous global organizations back in the crosshairs.

Anatomy of the WAF Bypass and Exploitation Tactic

The core mechanism of the ShinyHunters WAF bypass relies on a fundamental discrepancy between how certain web application firewalls inspect incoming traffic and how backend application servers, specifically Oracle WebLogic, process it. Standard WAF configurations and network reverse proxies typically evaluate HTTP request paths in their raw, literal string format before performing any normalization or decoding steps.

In this renewed campaign, the attackers have modified their exploit payloads by substituting standard alphabetical characters with their percent-encoded equivalents. For example, instead of transmitting a request targeting the blocked endpoint via the standard literal path:

/PSEMHUB/

The threat actors send requests formatted as:

/%50SEMHUB/

In this altered string, the character sequence %50 represents the percent-encoded hexadecimal value for the uppercase letter ‘P’. Because security filters programmed to mitigate CVE-2026-35273 were written to catch the explicit literal string /PSEMHUB/, the firewall perceives the encoded variant as a distinct and benign URI path, permitting the traffic to pass unhindered.

Upon reaching the backend infrastructure, however, Oracle WebLogic processes and decodes the percent-encoded character, translating /%50 back into the literal ‘P’. The request is subsequently routed directly to the vulnerable Environment Management Hub endpoint. In their technical advisory, Mandiant researchers emphasized that this discrepancy creates a false sense of security, leaving organizations exposed despite operating under the assumption that their WAF mitigation strategies were foolproof. Furthermore, Google’s threat intelligence teams have warned that ShinyHunters is unlikely to limit its tactics to the %50 variation alone, noting that future iterations of the attack could employ mixed-case strings, double-encoding, or alternative hexadecimal permutations to continuously evade static security controls.

Chronology of the Vulnerability and Campaign

The unfolding crisis surrounding CVE-2026-35273 is the latest chapter in a fast-moving sequence of security incidents that began unfolding in early June. A chronological overview of the event details the rapid escalation from initial zero-day exploitation to sophisticated WAF evasion:

• June 10: Security researchers and incident responders at BleepingComputer first broke the news that the ShinyHunters extortion group was actively targeting enterprise Oracle PeopleSoft servers using a previously unknown zero-day exploit. Initial telemetry indicated that the attacks had successfully compromised data across roughly 100 high-profile organizations.
• June 11: Responding to active exploitation in the wild, Oracle rushed out an emergency security advisory and software patch addressing the vulnerability, officially designating it as CVE-2026-35273. The software giant confirmed that the flaw enabled unauthenticated remote code execution (RCE). Concurrently, Google publicly identified the threat actor group behind the attacks as UNC6240—widely recognized as ShinyHunters—and confirmed widespread targeting of the education sector.
• Mid-June to August: With immediate patching proving difficult for numerous enterprise environments, security vendors like Mandiant advised system administrators to implement temporary mitigating controls by blocking external internet access to the /PSEMHUB/* endpoint via perimeter WAFs and reverse proxies. Many organizations adopted this strategy as a long-term operational fix while planning maintenance windows.
• Late September: ShinyHunters publicly claimed responsibility for a massive breach impacting the United States Federal Bureau of Investigation (FBI), asserting they leveraged a novel PeopleSoft zero-day to compromise the FBI Jobs platform and pivot into AWS GovCloud infrastructure.
• Current Revelations: Google GTIG released a detailed technical report revealing that ShinyHunters had updated its exploitation tooling to bypass WAF path-matching rules using percent-encoding techniques like /%50SEMHUB/, initiating a fresh wave of global data-theft and web shell deployment attacks.

Global Impact and Multi-Sector Targeting

The secondary wave of exploitation has spared few industries. Google’s telemetry indicates that the attackers have successfully deployed malicious web shells on dozens of enterprise systems worldwide. The affected entities span a diverse array of critical sectors, including higher education, technology services, healthcare, agriculture, transportation, and government agencies.

Before committing fully to data exfiltration or system manipulation, the threat actors engage in a stealthy reconnaissance phase. Typically, the attackers transmit a series of five to fifteen HTTP POST requests directed at /%50SEMHUB/hub containing serialized Java objects. On vulnerable hosts, these specialized probes return granular operating system details without writing files to disk or triggering service interruptions, allowing ShinyHunters to quietly inventory viable targets before escalating their intrusion.

Once a server’s vulnerability is confirmed, the actors execute secondary payloads designed to establish persistent command-and-control capabilities. Investigations show that the syndicate deploys standard JSP web shells—specifically files named x.jsp for remote command execution, alongside u.jsp and u2.jsp designed to facilitate the uploading of larger secondary payloads.

On compromised Microsoft Windows-based servers, these web shells are utilized to drop an executable file designated as Ple64.exe. Although engineered to masquerade as a digitally signed installer for the legitimate Light Alloy media player, the binary installs a custom backdoor tracked by Google as SIDEEYE. The SIDEEYE malware grants the attackers broad post-exploitation capabilities, including credential harvesting, process and file management, interactive reverse shell generation, and advanced reverse proxy functionality.

Furthermore, on both Windows and Linux environments, the attackers have been observed deploying the open-source Neo-reGeorg tunneling toolkit through tunnel.jsp and tunnel.jspx files. This tool effectively encapsulates SOCKS5 proxy traffic within standard, encrypted HTTP and HTTPS web connections, allowing the compromised PeopleSoft server to serve as an operational staging ground for lateral movement deeper into the victim’s internal corporate network. On compromised Linux targets, researchers also noted the deployment of legitimate MeshAgent remote management software to ensure persistent, long-term access.

The FBI Claims and Ongoing Controversy

The resurgence of the PeopleSoft campaign follows bold claims made by ShinyHunters regarding high-profile government targets. On September 22, representatives of the extortion gang communicated with security journalists, asserting they had successfully breached internal FBI systems through an alleged Oracle PeopleSoft zero-day vulnerability.

According to the group’s statements, the breach originated on the public-facing FBI Jobs platform before actors allegedly pivoted laterally into the bureau’s AWS GovCloud storage infrastructure. ShinyHunters asserted they successfully exfiltrated between two and three terabytes of sensitive data pertaining to current and former agency personnel, job applicants, and internal administrative records. At the time of the claims, independent verification of the intrusion vector or the sheer volume of exfiltrated data remained elusive.

While the FBI formally acknowledged that it was actively investigating reports of unauthorized activity impacting the FBIjobs.gov domain, the agency declined to officially verify whether a definitive network breach had occurred or if proprietary data had been successfully stolen. In subsequent communications following the disclosure of the WAF bypass technique, ShinyHunters confirmed to researchers that they utilized percent-encoded URIs to facilitate their entry into the FBI Jobs environment, though they continue to insist that a separate, undisclosed zero-day within the same PeopleSoft component was also leveraged during the operation.

Remediation Guidance and Technical Defense Measures

In light of the sophisticated evasion techniques demonstrated by ShinyHunters, cybersecurity authorities are strongly urging organizations to abandon reliance on perimeter web application firewalls as a primary defense against CVE-2026-35273. Because WAF rules can be routinely bypassed through simple character encoding manipulation, proper software remediation remains the only definitive defense.

Mandiant and Google GTIG have issued comprehensive recommendations for system administrators and incident responders:

1. Apply Vendor Patches Immediately: Organizations must prioritize the installation of official security updates provided by Oracle to remediate CVE-2026-35273 at the application code level, neutralizing the underlying vulnerability regardless of incoming URI formatting.
2. Audit WebLogic Access Logs: Security teams should proactively review historical and real-time WebLogic access logs for anomalous HTTP requests directed at /PSEMHUB/ as well as its encoded permutations—such as /%50SEMHUB/, mixed-case variants, or alternative hexadecimal representations—to identify historical intrusion attempts or active compromises.
3. Conduct Comprehensive Endpoint Hunting: Because the threat actors frequently employ memory-resident execution and obfuscated JSP web shells (x.jsp, u.jsp, tunnel.jsp), organizations should perform thorough forensic sweeps of application directories for unauthorized or recently modified files.
4. Monitor for Secondary Artifacts: Defenders must check systems for unauthorized binaries, specifically looking for Ple64.exe, indications of the SIDEEYE backdoor, or unauthorized instances of remote management utilities like MeshAgent.
5. Harden Network Segmentation: Given the actors’ reliance on tools like Neo-reGeorg to tunnel traffic and facilitate lateral movement, internal network segmentation controls should be tightly monitored to restrict outbound connections originating from enterprise ERP application servers.

As extortion groups continue to refine their evasion tactics against legacy and enterprise software, the ongoing campaign against Oracle PeopleSoft installations serves as a stark reminder of the limitations inherent in perimeter-only security architectures. Security leaders are encouraged to maintain rigorous patch management cadences and continuously audit defensive controls to ensure robust protection against evolving threat actor methodologies.