The notorious cybercrime and extortion collective known as ShinyHunters has launched a renewed, large-scale campaign targeting vulnerable enterprise servers by deploying a sophisticated URL-encoding trick. This technical evasion technique allows the threat actors to effortlessly bypass standard web application firewall (WAF) rules implemented to mitigate a critical remote code execution flaw in Oracle PeopleSoft software. According to threat intelligence reports released by Google’s Mandiant and Threat Intelligence Group (GTIG), the exploit technique specifically targets organizations that have failed to apply official security updates, relying instead on perimeter defenses to block malicious requests to sensitive endpoints.
The resurgence of these cyberattacks highlights the persistent security gap between the issuance of vendor patches and the actual deployment of those fixes by enterprise IT departments. Security researchers have warned that relying on perimeter workarounds—such as blocking specific Uniform Resource Identifier (URI) paths at the WAF level—provides a false sense of security, particularly when threat actors actively evolve their evasion methodologies to sidestep literal string-matching security controls.
Anatomy of the WAF Bypass Technique
The core of the current exploitation wave centers on CVE-2026-35273, a critical, unauthenticated remote code execution vulnerability residing within the Oracle PeopleSoft Environment Management Hub. When the zero-day flaw initially surfaced in June, security vendors quickly advised organizations struggling to immediately patch their systems to implement defensive workarounds. Chief among these recommendations was configuring web application firewalls and reverse proxies to block all external traffic directed toward the vulnerable /PSEMHUB/* endpoint.
However, Mandiant’s latest analysis reveals that ShinyHunters—tracked within Google’s threat ecosystem under the moniker UNC6240—has successfully circumvented these defenses by weaponizing how various components handle text encoding. Rather than sending standard plaintext HTTP requests containing the literal path /PSEMHUB/, the attackers substitute characters with percent-encoded equivalents. For instance, requests are now being routed as /%50SEMHUB/, where the %50 hexadecimal sequence represents the percent-encoded capital letter "P".
The vulnerability in the defense mechanism lies in a processing discrepancy between the security filter and the underlying application server. Many commercial WAFs and perimeter proxies evaluate the literal request path before applying normalization or decoding routines. Consequently, security rules explicitly designed to intercept and block strings matching /PSEMHUB/ fail to flag the encoded alternative, allowing the payload to pass unimpeded through the perimeter.
Once the request reaches the backend Oracle WebLogic server, the environment automatically decodes the percent-encoded character back into its plaintext representation and routes it straight to the vulnerable PeopleSoft endpoint. Google’s threat intelligence division emphasizes that the %50 variation is merely one iteration; the extortion group is fully capable of leveraging mixed-case combinations, alternative percent-encoding sequences, and other obfuscation methods to evade traditional signature-based detection rules.
Chronology of the Oracle PeopleSoft Exploitation Campaign
The timeline of the CVE-2026-35273 vulnerability underscores the rapid velocity with which sophisticated threat actors operationalize zero-day bugs before enterprise defenses can fully harden.
On June 10, initial reports from cybersecurity investigators revealed that the ShinyHunters collective was actively exploiting an unpatched zero-day vulnerability in Oracle PeopleSoft environments. The early-stage attacks were characterized by unauthorized data exfiltration affecting approximately 100 high-profile organizations globally.
Swiftly responding to the emerging crisis, Oracle released an emergency out-of-band security advisory and patch on June 11, officially designating the flaw as CVE-2026-35273. The software giant confirmed that the vulnerability carried a maximum severity score, enabling unauthenticated remote code execution across standard enterprise deployments. Simultaneously, Google published telemetry confirming that UNC6240 was aggressively utilizing the flaw to compromise systems, particularly within the higher education sector.
Recognizing that comprehensive patch management across large enterprise networks often requires weeks or months of testing and change management cycles, security firms provided emergency mitigation advice. Organizations unable to immediately patch were instructed to block external visibility to the Environment Management Hub. For a brief period, these WAF rules appeared effective in stalling the automated exploitation wave.
However, the threat landscape shifted drastically in late September when ShinyHunters mounted high-profile extortion claims, asserting they had successfully breached high-security government targets using a purported new zero-day within the same PeopleSoft component. Subsequent technical investigations by Google Mandiant revealed that the group had not necessarily relied on a brand-new zero-day, but rather had refined their attack methodology to bypass existing WAF mitigations through advanced URL encoding and complex post-exploitation tooling.
Deployment of Advanced Malware and Persistence Mechanisms
The renewed mass-exploitation campaign has resulted in the successful deployment of web shells and backdoor tools across dozens of enterprise networks globally. Sectors impacted by the latest wave span multiple critical infrastructure verticals, including higher education, advanced technology, IT professional services, healthcare, agriculture, transportation, and government agencies.
According to Mandiant’s technical breakdown, the attack lifecycle typically begins with reconnaissance. Before executing full compromise routines, the threat actors transmit a brief sequence—usually between five and fifteen POST requests—directed to /%50SEMHUB/hub containing serialized Java objects. On vulnerable hosts, these requests generate operating system metadata responses without writing files to disk or triggering service disruptions, enabling ShinyHunters to silently vet whether a given server is ripe for exploitation.
Once a viable target is identified, the actors leverage the vulnerability to execute arbitrary commands directly within the system memory or to drop custom Java Server Pages (JSP) web shells. Analysts have identified three primary web shells utilized in the campaign: x.jsp, designed primarily for remote command execution, alongside u.jsp and u2.jsp, which facilitate the uploading of larger secondary payloads.
On compromised Windows-based enterprise servers, the actors leverage these initial web shells to stage an executable binary named Ple64.exe. Carefully crafted to masquerade as a digitally signed installer for the legitimate Light Alloy media player, the binary actually installs a sophisticated custom backdoor tracked by Google as SIDEEYE. This malware grants the operators comprehensive system control, including credential theft capabilities, process and file management tools, interactive reverse shell generation, and built-in reverse proxy functionalities.
Furthermore, ShinyHunters has demonstrated a reliance on multi-platform administrative tools to ensure long-term persistence and lateral movement. On Linux environments, the group has been observed installing the legitimate MeshAgent remote management framework. Across mixed operating systems, the actors frequently deploy the open-source Neo-reGeorg tunneling toolkit—via files named tunnel.jsp and tunnel.jspx—which encapsulates standard SOCKS5 proxy traffic inside routine HTTP and HTTPS web requests. This clever tunneling mechanism allows the compromised PeopleSoft server to act as a pivot point, granting the attackers deep lateral access into internal corporate networks while blending seamlessly with normal organizational web traffic.
The High-Stakes Controversy Surrounding Government and Enterprise Breaches
The gravity of the ShinyHunters campaign was amplified significantly when the group publicly claimed responsibility for breaching high-profile federal infrastructure, most notably asserting that they had successfully compromised internal FBI systems via the PeopleSoft vulnerability.
In late September, representatives from ShinyHunters contacted security researchers claiming that their remote code execution exploit had successfully penetrated the FBI Jobs platform (FBIjobs.gov). The threat actors stated they subsequently leveraged internal access to pivot into the Bureau’s Amazon Web Services (AWS) GovCloud infrastructure, exfiltrating between two and three terabytes of sensitive data pertaining to current and former personnel, employment candidates, and internal administrative records.
While independent cybersecurity analysts initially found it challenging to independently verify the scope of the alleged federal data theft, the implications sparked immediate concern among national security officials. The Federal Bureau of Investigation formally acknowledged that it was actively investigating reports of unauthorized digital activity impacting the FBIjobs.gov portal, though officials maintained a guarded stance regarding the confirmation of a core network breach or confirmed data exfiltration.
In communications with security researchers, ShinyHunters confirmed that their initial entry into the targeted government infrastructure utilized the same URL-encoding WAF bypass technique documented by Mandiant. However, the group continued to assert that a portion of their high-value access relied on previously undisclosed vulnerabilities within the broader PeopleSoft ecosystem, keeping the cybersecurity community on high alert.
Implications and Definitive Remediation Recommendations
The evolution of the ShinyHunters PeopleSoft campaign serves as a stark reminder of the limitations inherent in perimeter-only defense strategies. As threat actors rapidly adapt their techniques to circumvent signature-based rules and URI string filters, organizations can no longer rely on temporary WAF workarounds as a long-term substitute for proper vulnerability patch management.
Google Mandiant has issued urgent remediation guidelines for any enterprise utilizing Oracle PeopleSoft software. Security teams are strongly advised to perform the following critical actions immediately:
- Apply Official Vendor Patches: Organizations must prioritize the immediate application of Oracle’s official security updates addressing CVE-2026-35273, rather than depending on perimeter WAF rules that remain susceptible to encoding and normalization bypasses.
- Comprehensive Log Analysis: System administrators should conduct deep retrospective forensic analyses of WebLogic access logs. Investigations must look beyond literal searches for
/PSEMHUB/to explicitly hunt for obfuscated variants, including percent-encoded paths such as/%50SEMHUB/, mixed-case strings, and alternative URI representations indicative of reconnaissance or exploitation attempts. - Hunt for Web Shells and Unauthorized Processes: Internal networks should be thoroughly swept for unauthorized JSP files—specifically
x.jsp,u.jsp,u2.jsp,tunnel.jsp, andtunnel.jspx—as well as anomalous binary executions masquerading as legitimate software, such as thePle64.exeinstaller associated with the SIDEEYE backdoor. - Review Outbound and Lateral Traffic: Security operations centers (SOCs) should monitor internal telemetry for suspicious SOCKS5 tunneling traffic, unexpected remote management agents like MeshAgent, and unauthorized outbound connections originating from application servers.
As automated threat groups continue to weaponize application-layer evasion techniques, the cybersecurity industry faces an escalating challenge in securing complex enterprise architectures against multi-stage extortion operations.
