Safa Marwah
A persistent and cunning cybercrime syndicate, known as ShinyHunters, has escalated its campaign against Oracle PeopleSoft servers by deploying an advanced URL-encoding stratagem to circumvent Web Application Firewalls (WAFs) previously implemented as a stopgap against a critical remote code execution vulnerability. This tactical evolution has allowed the threat actors to reignite widespread exploitation, targeting numerous organizations that had relied on WAF rules rather than applying essential security patches.
The newly identified technique, brought to light by Google’s Mandiant and Threat Intelligence Group (GTIG), reveals that ShinyHunters is now employing percent-encoded characters within the URL path, effectively bypassing WAF rules configured to block the literal /PSEMHUB/* endpoint associated with the CVE-2026-35273 flaw. This development underscores the inherent limitations of signature-based defenses against highly adaptive adversaries and accentuates the critical need for comprehensive patching strategies.
Genesis of the Exploitation Campaign
The initial wave of these sophisticated attacks emerged earlier, on June 10, when reports confirmed that the ShinyHunters extortion collective was actively exploiting a zero-day vulnerability within Oracle PeopleSoft. This initial campaign resulted in the compromise of an estimated 100 organizations, leading to significant data theft. The urgency of the situation prompted Oracle to swiftly release a patch the following day, addressing the flaw designated as CVE-2026-35273. This vulnerability was classified as allowing unauthenticated remote code execution, a severity level that grants attackers complete control over affected systems without needing legitimate credentials.
Concurrently, Google’s security intelligence arm, tracking ShinyHunters under the designation UNC6240, independently corroborated the exploitation of CVE-2026-35273, particularly noting its impact on the education sector. In the immediate aftermath of the vulnerability disclosure and prior to the widespread application of security updates, Mandiant issued an advisory recommending that organizations unable to promptly install patches or disable the Environment Management Hub should block external access to the vulnerable /PSEMHUB/* endpoint using WAFs or reverse proxies. This advice, while offering a temporary shield, has now been demonstrably undermined by ShinyHunters’ evolving tactics.
The Ingenious WAF Bypass Mechanism
The core of ShinyHunters’ renewed offensive lies in their modification of the exploit payload to include percent-encoded characters. Instead of requesting the path literally as /PSEMHUB/, the attackers now transmit requests such as /%50SEMHUB/. The %50 sequence is the URL-encoded representation of the uppercase letter ‘P’. This seemingly minor alteration exploits a fundamental discrepancy in how various network security devices process incoming web requests.
Many WAFs and reverse proxies are designed to compare the incoming request path against their rule sets before performing URL decoding. This design choice, intended to optimize performance and prevent certain types of attacks, inadvertently creates a blind spot when an attacker crafts a request using encoded characters. Consequently, a WAF rule explicitly configured to block /PSEMHUB/ will fail to recognize and block /%50SEMHUB/ because it evaluates the raw, encoded string.
In stark contrast, the underlying Oracle WebLogic server, which hosts PeopleSoft, operates differently. Upon receiving the encoded request, WebLogic performs the necessary URL decoding, transforming /%50SEMHUB/ back into /PSEMHUB/. It then routes this decoded request to the intended, and still vulnerable, endpoint. This architectural disparity creates a critical vulnerability window, allowing threat actors to bypass seemingly robust WAF protections. As Mandiant succinctly articulated, this method "allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure."
This bypass technique is not limited to %50. Threat intelligence suggests that ShinyHunters, or other sophisticated groups, could readily adapt to employ other percent-encoded variations, mixed-case permutations (e.g., /%70semhub/ where %70 is ‘p’), or even double-encoded versions of /PSEMHUB/ to further evade detection. This necessitates a proactive and adaptive defense strategy that moves beyond simple string matching.
Resurgence of Data-Theft Operations
The efficacy of this WAF bypass has directly translated into a new wave of successful compromises. Google’s analysis indicates that the renewed attacks have led to the deployment of web shells on dozens of systems globally, impacting a diverse array of sectors including higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations. This broad targeting highlights the ubiquitous nature of Oracle PeopleSoft deployments across critical infrastructure and commercial enterprises.
Mandiant has issued urgent recommendations for organizations running Oracle PeopleSoft, emphasizing the immediate need for action beyond basic WAF configurations. The typical attack chain observed begins with a reconnaissance phase. Threat actors send a series of between five and fifteen POST requests to /%50SEMHUB/hub containing serialized Java objects. Crucially, these initial requests are designed to be non-disruptive; they do not write files to disk or interfere with service operations. Instead, they illicitly gather information about the target’s operating system, allowing ShinyHunters to quietly ascertain the system’s vulnerability status and suitability for further exploitation. This stealthy approach minimizes the risk of early detection and allows the group to prioritize their efforts on susceptible targets.
Once a system is confirmed vulnerable, the attackers proceed to the exploitation phase, leveraging the same flaw to execute commands either directly in memory or to deploy persistent JSP web shells. These web shells serve as the primary backdoor for maintaining access and facilitating subsequent malicious activities. Google’s findings detail the use of specific web shell variants: x.jsp for general command execution, and u.jsp alongside u2.jsp for more efficient uploading of larger files, presumably tools and additional malware.
Deployment of Advanced Post-Exploitation Tools
On compromised Windows servers, ShinyHunters has been observed deploying an executable named Ple64.exe. This file cunningly masquerades as a legitimate installer for the Light Alloy media player, leveraging common user trust in software installations. However, Ple64.exe is, in fact, a dropper for a sophisticated backdoor tracked by Google as SIDEEYE. SIDEEYE is a multi-functional malware designed for extensive post-exploitation activities, including:
- Credential Theft: Harvesting sensitive login information from the compromised system.
- Process and File Management: Gaining control over running processes and manipulating files on the host.
- Interactive Reverse Shells: Establishing persistent, remote command-line access to the compromised server.
- Reverse Proxy Functionality: Using the compromised server as a pivot point to route traffic and obfuscate their origins, facilitating further internal network reconnaissance and lateral movement.
Beyond SIDEEYE, the threat actors also deploy the open-source Neo-reGeorg tunneling toolkit through tunnel.jsp and tunnel.jspx files. Neo-reGeorg is a powerful tool that enables the tunneling of SOCKS5 proxy traffic over standard HTTP and HTTPS connections. This capability is critical for lateral movement, allowing ShinyHunters to use the compromised PeopleSoft server as a secure conduit to penetrate deeper into the internal network, bypassing internal network segmentation and firewall rules that might otherwise block direct access to other systems.
For Linux systems, Mandiant observed ShinyHunters leveraging legitimate remote management software, MeshAgent, to maintain persistent access. The use of legitimate tools for malicious purposes is a common tactic among advanced threat actors, as it allows them to blend in with normal network traffic and evade detection by traditional security solutions focused on known malware signatures.
Prior Claims and Broader Implications
These recent attacks occur against a backdrop of previous audacious claims by ShinyHunters. Notably, the group publicly asserted in September that they had breached FBI systems, specifically the FBI Jobs platform, using what they described as a "new Oracle PeopleSoft zero-day vulnerability." They further claimed to have achieved lateral movement into the FBI’s AWS GovCloud infrastructure and exfiltrated between 2TB and 3TB of sensitive data related to current and former FBI employees and job applicants.
While BleepingComputer, the initial reporting entity, could not independently verify the specifics of the claimed zero-day, the extent of lateral movement, or the volume of data stolen at the time, the FBI did confirm an investigation into unauthorized activity affecting FBIjobs.gov. In light of the current WAF bypass revelation, ShinyHunters has since confirmed that they indeed utilized this specific WAF bypass technique against the FBI Jobs platform. However, the group continues to assert that they also exploited an "NEW unknown vulnerability in the same PSEMHUB component," suggesting a potential layered approach to their attacks or an ongoing discovery of new weaknesses.
This evolving threat landscape highlights several critical implications for cybersecurity. Firstly, it underscores the continuous arms race between threat actors and defenders. As organizations implement mitigations, adversaries rapidly adapt their tactics to circumvent them. Secondly, it serves as a stark reminder that relying solely on perimeter defenses like WAFs, while valuable, is insufficient against determined and sophisticated attackers. A robust defense-in-depth strategy, prioritizing timely patching, comprehensive endpoint detection and response (EDR), and proactive threat hunting, is paramount. Organizations must assume compromise and implement measures for rapid detection and containment of threats that inevitably bypass initial defenses.
The persistent targeting of Oracle PeopleSoft, a widely used enterprise resource planning (ERP) system, also emphasizes the attractiveness of such platforms for data theft and broader network infiltration due to their central role in an organization’s operations and the vast amount of sensitive data they process. Organizations must shift from a reactive security posture to one that anticipates evolving threats, continuously assesses their vulnerabilities, and rigorously applies security updates as soon as they become available. Mandiant’s explicit recommendation to install the latest security updates for CVE-2026-35273 and to actively search WebLogic access logs for both literal and encoded variants of /PSEMHUB/ requests serves as an immediate call to action for all potentially affected entities.
Aura Kasih
Lisa Mariana