ShinyHunters Extortion Gang Bypasses Web Application Firewalls Using URL-Encoding to Renew Mass Exploitation of Oracle PeopleSoft Vulnerability

The notorious ShinyHunters cyber extortion syndicate has returned to the spotlight with a sophisticated evasion technique designed to sidestep perimeter security defenses. Cybersecurity researchers from Google’s Mandiant and Threat Intelligence Group (GTIG) have uncovered that the threat actors are currently leveraging a clever URL-encoding trick to circumvent web application firewall (WAF) rules implemented to mitigate the critical Oracle PeopleSoft security flaw cataloged as CVE-2026-35273. This development has effectively unlocked a gateway for the group to resume widespread, automated exploitation campaigns targeting enterprise servers worldwide that remain unpatched.

The ongoing malicious activity underscores the continuous cat-and-mouse dynamic between enterprise defenders and resourceful threat groups. By abusing discrepancies in how security proxies inspect web traffic versus how underlying application servers process it, ShinyHunters has breathed new life into an attack vector that organizations thought they had successfully locked down through compensating controls.

An Anatomy of the WAF Bypass Technique

The genesis of this current threat campaign lies in how security teams initially scrambled to defend their infrastructure following the discovery of the PeopleSoft zero-day vulnerability. When Oracle formally issued a security update on June 11 to address CVE-2026-35273—a critical bug enabling unauthenticated remote code execution (RCE)—many organizations found themselves unable to immediately deploy the patch or disable the vulnerable Environment Management Hub. As a practical alternative, security vendors including Mandiant advised administrators to implement strict perimeter controls by blocking external web access to the vulnerable endpoint: /PSEMHUB/*.

Security teams deployed WAF rules and reverse proxy configurations explicitly looking for that literal string to block malicious traffic. However, ShinyHunters—tracked by Google as UNC6240—adapted their tactics by modifying their exploit payload to utilize percent-encoding. Instead of sending standard requests to /PSEMHUB/, the attackers began routing requests through the obfuscated path /%50SEMHUB/, where %50 serves as the standard hexadecimal percent-encoded representation of the capital letter "P".

The vulnerability in defense posture stems from how different components in the enterprise stack parse incoming traffic. Many standard WAFs and reverse proxies inspect the literal request path at face value before performing a full decode operation. Consequently, rules explicitly programmed to intercept and block occurrences of /PSEMHUB/ fail to recognize the encoded variant /%50SEMHUB/, allowing the packet to sail through unchecked.

Once the traffic bypasses the perimeter WAF, it reaches Oracle WebLogic. WebLogic automatically decodes the percent-encoded character, successfully restoring the ‘P’ and accurately routing the request straight to the vulnerable endpoint. This architectural blind spot has granted the threat actor unfettered access to systems whose operators genuinely believed their perimeter defenses had neutralized the exposure. Google’s threat intelligence warns that the group is unlikely to limit itself to the %50 variation, noting that future iterations could easily incorporate mixed-case permutations or alternative percent-encoding sequences to continually evade signature-based detection.

Chronology of the PeopleSoft Exploitation Campaign

The timeline of the CVE-2026-35273 exploit cycle maps a rapid evolution from initial zero-day abuse to mass operational scaling.

On June 10, security reports first broke indicating that the ShinyHunters extortion group was actively targeting Oracle PeopleSoft servers via an unknown zero-day vulnerability. Early telemetry suggested the breach efforts successfully compromised data across roughly 100 high-profile organizations.

Just one day later, on June 11, Oracle responded by releasing an emergency advisory and software updates addressing the flaw, officially designating it as CVE-2026-35273. Simultaneously, Google published telemetry confirming that the threat collective UNC6240 was concentrating its primary offensive efforts against the global education sector, validating the initial reports from independent security researchers.

Realizing that enterprise patching cycles require weeks or months of administrative validation and deployment testing, Mandiant issued stop-gap recommendations. Organizations were urged to deploy WAF rules blocking the /PSEMHUB/* endpoint as a temporary shield.

For several months, this defense held up against casual scans. However, Google’s latest threat intelligence disclosure reveals that ShinyHunters recalibrated their offensive toolsets. By implementing the WAF bypass technique, the group transitioned from sporadic targeting to a renewed, automated mass-exploitation campaign affecting dozens of enterprise environments globally.

Methodology of the Breach: From Reconnaissance to Backdoors

The operational playbook executed by ShinyHunters once they successfully penetrate a network via the WAF bypass is both methodical and devastating. According to Mandiant’s technical breakdown, the attackers initiate the compromise through targeted reconnaissance before moving on to persistent access deployment.

Before attempting full-scale code execution, the threat actors typically dispatch a flurry of five to 15 cascading POST requests directed toward /%50SEMHUB/hub containing serialized Java objects. These probe requests are engineered to query the host operating system, returning detailed environment metadata without generating disruptive service crashes or dropping files onto the disk. This stealthy fingerprinting phase allows ShinyHunters to silently curate an inventory of viable, high-value targets.

Once a server is confirmed as vulnerable, the attackers leverage the vulnerability to execute direct in-memory commands or drop specialized JavaServer Pages (JSP) web shells. Forensics teams have identified specific web shell artifacts utilized in the campaign, including ‘x.jsp’ deployed explicitly for command execution, alongside ‘u.jsp’ and ‘u2.jsp’ utilized for staging and uploading larger malicious files.

On Windows-based enterprise servers, the attackers utilize these initial web shells to drop an executable payload named ‘Ple64.exe’. This binary is cleverly disguised to masquerade as a digitally signed Light Alloy media player installer, but upon execution, it installs a persistent, custom backdoor tracked by Google as SIDEEYE. The SIDEEYE malware functions as a Swiss Army knife for the intruders, facilitating advanced credential harvesting, fine-grained process and file management, interactive reverse shell capabilities, and fully functional reverse proxy features.

To facilitate internal pivoting and lateral movement, ShinyHunters has also been observed deploying the open-source tunneling utility Neo-reGeorg through malicious files named ‘tunnel.jsp’ and ‘tunnel.jspx’. This toolkit encapsulates standard SOCKS5 proxy traffic inside conventional, encrypted HTTP and HTTPS web connections, blending malicious communications seamlessly with normal corporate web traffic and allowing the attackers to tunnel deep into internal corporate networks from the compromised PeopleSoft foothold. Meanwhile, on compromised Linux servers, the group relies on legitimate remote management utilities like MeshAgent to maintain long-term persistence without relying solely on custom malware that might trigger endpoint detection and response (EDR) alerts.

Global Impact Across Critical Sectors

The scope of this renewed exploitation wave is vast, cutting across numerous mission-critical industries. Google reports that the latest campaign has successfully deployed web shells and established persistent footholds within dozens of systems worldwide.

The targeted sectors span a wide cross-section of the global economy, including higher education, high-technology enterprises, IT professional services, healthcare institutions, agricultural conglomerates, transportation networks, and various government agencies. Because Oracle PeopleSoft installations are typically deployed within large enterprise environments handling sensitive human resources, financial, and operational data, a compromise at the application layer poses severe risks of intellectual property theft, operational disruption, and downstream supply chain exposure.

Escalation: Claims of High-Profile Government Breaches

The technical campaign surrounding the PeopleSoft zero-day vulnerability runs parallel to high-stakes extortion claims made by the group against public sector entities. Prior to the widespread documentation of the WAF bypass technique, ShinyHunters made headlines by asserting that they had successfully breached internal Federal Bureau of Investigation (FBI) systems utilizing what they described as a novel Oracle PeopleSoft zero-day exploit.

According to statements provided by the group to security researchers on September 22, the alleged exploit granted remote code execution privileges that allowed them to compromise the official FBI Jobs platform (FBIjobs.gov). From that initial access point, the actors claimed they performed lateral movement into the bureau’s AWS GovCloud infrastructure, exfiltrating between two and three terabytes of sensitive data pertaining to current and former FBI personnel, job candidates, and internal administrative workflows.

While independent cybersecurity analysts could not immediately verify the technical validity of the claimed zero-day or the exact scale of the purported data exfiltration, official channels acknowledged the operational pressure. The FBI confirmed that it initiated a formal internal review into reported unauthorized digital activity impacting FBIjobs.gov, though law enforcement officials refrained from officially verifying whether a deep systemic breach or mass data theft had transpired.

Significantly, representatives for ShinyHunters later communicated that they successfully deployed their WAF bypass mechanism against the FBI’s infrastructure during the course of their operations, while continuing to assert that they also utilized previously unknown vulnerabilities residing within the same PeopleSoft component.

Expert Recommendations and Remediation Path

In light of the sophisticated evasion tactics deployed by UNC6240, security leaders and threat intelligence analysts emphasize that perimeter defenses alone are entirely insufficient for mitigating CVE-2026-35273.

Google and Mandiant have issued urgent directives urging organizations operating Oracle PeopleSoft environments to transition away from temporary network-level blocks and immediately apply the official vendor security updates. Relying on WAF rules to filter out literal paths like /PSEMHUB/ creates a false sense of security, as threat actors can easily adapt their payloads using percent-encoding, mixed-case strings, or alternative normalization vectors.

For defensive validation, security operations centers (SOCs) and incident response teams are advised to perform deep retrospective audits of WebLogic access logs. Systems administrators must search specifically for anomalous query patterns, looking not only for standard requests to /PSEMHUB/ but also for obfuscated and encoded variants such as /%50SEMHUB/, which serve as definitive indicators of active exploitation attempts or reconnaissance probing.

Furthermore, network defenders should inspect enterprise file systems for unauthorized JSP files—particularly variants such as x.jsp, u.jsp, and tunnel.jsp—and audit running processes for suspicious binaries masquerading as legitimate software installers like Ple64.exe.

As cyber extortion syndicates continue to weaponize application-layer quirks and bypass standard perimeter filters, organizations must adopt a defense-in-depth posture. Immediate patching, rigorous log analysis, and proactive endpoint monitoring remain the cornerstones of resilience against sophisticated threat actors operating at machine speed.