ShinyHunters Extortion Gang Bypasses Web Application Firewalls Using URL-Encoding to Renew Mass Exploitation of Oracle PeopleSoft Vulnerability

The notorious ShinyHunters cyber extortion syndicate has returned to the digital spotlight with a sophisticated evasion technique designed to circumvent standard perimeter defenses. According to advanced threat intelligence findings released by Google’s Mandiant and Threat Intelligence Group (GTIG), the threat actors are currently leveraging a clever URL-encoding trick to slip past Web Application Firewall (WAF) rules meant to mitigate the critical Oracle PeopleSoft security flaw cataloged as CVE-2026-35273. This development has effectively unlocked a gateway for the threat group to resume widespread, automated exploitation campaigns targeting vulnerable, unpatched enterprise servers across multiple global industries.

The re-emergence of these aggressive data-theft operations highlights the persistent cat-and-mouse game between elite threat actors and cybersecurity defenders. While numerous organizations believed they were adequately protected by implementing network-level filtering or WAF rules rather than applying immediate software patches, the latest tactic demonstrates how easily static perimeter defenses can be manipulated when application-layer parsing differs from gateway-layer filtering.

Anatomy of the WAF Bypass Technique

The root of the vulnerability lies within the Oracle PeopleSoft Environment Management Hub, specifically the /PSEMHUB/* endpoint. Following the initial disclosure and subsequent patching of CVE-2026-35273—an unauthenticated remote code execution (RCE) flaw—many system administrators who could not immediately take their servers offline to deploy official software updates relied on a standard workaround. Security vendors advised blocking external HTTP and HTTPS traffic destined for the /PSEMHUB/ path at the WAF or reverse proxy level.

However, ShinyHunters (tracked by Google under the threat cluster designation UNC6240) quickly identified a blind spot in how many commercial WAFs and perimeter proxies evaluate incoming Uniform Resource Locators. Rather than sending standard, easily detectable requests to the literal path, the attackers are now utilizing percent-encoding to mask their intent.

For instance, instead of requesting /PSEMHUB/, the malicious payloads are sent using the variation /%50SEMHUB/, where the characters %50 represent the percent-encoded hexadecimal value for the uppercase letter "P". According to Mandiant’s technical breakdown, numerous security proxies and WAF platforms evaluate the literal request path before executing normalization or decoding routines. Consequently, security rules explicitly designed to block strings containing /PSEMHUB/ fail to recognize the encoded variant, allowing the request to pass unhindered.

Once the request traverses the WAF perimeter, it reaches the Oracle WebLogic backend. WebLogic correctly decodes the percent-encoded sequence back into the letter "P" and routes the traffic directly to the vulnerable endpoint. This structural discrepancy between how the firewall perceives the packet and how the backend application processes it has rendered many virtual patching strategies completely ineffective, leaving enterprise operators with a false sense of security. Google’s threat intelligence unit warns that ShinyHunters is not restricting itself to the %50 variation alone, noting that future iterations of the campaign could incorporate mixed-case encoding, alternate percent-encoding sequences, or other semantic obfuscation methods to maintain stealth.

Chronology of a Rapidly Escalating Cyber Threat

The timeline surrounding the CVE-2026-35273 vulnerability illustrates the breakneck speed at which modern extortion syndicates operationalize newly discovered software flaws:

• June 10, 2026: Security researchers at BleepingComputer first broke the news that the ShinyHunters gang was actively exploiting an undisclosed zero-day vulnerability in Oracle PeopleSoft servers, successfully exfiltrating sensitive data from approximately 100 high-profile organizations.
• June 11, 2026: Oracle responded swiftly to the emergency, releasing an out-of-band security advisory and patch suite to fix the zero-day flaw, officially designated as CVE-2026-35273. On the same day, Google’s threat intelligence teams publicly corroborated BleepingComputer’s findings, linking the zero-day exploitation wave to the UNC6240 (ShinyHunters) collective, which was observed heavily targeting the education sector.
• Mid-to-Late June 2026: Facing zero-day exploitation, many organizations deployed interim WAF rules to block external access to the /PSEMHUB/* endpoint while scheduling official software maintenance windows.
• September 2026: ShinyHunters publicly claimed responsibility for a massive data breach affecting the Federal Bureau of Investigation (FBI), asserting they leveraged a novel PeopleSoft zero-day to penetrate the FBI Jobs platform and subsequently pivot into the bureau’s AWS GovCloud environment, allegedly stealing between 2TB and 3TB of personnel data.
• Late 2026 to Early 2027: Mandiant uncovered the WAF bypass technique utilizing percent-encoding (such as /%50SEMHUB/), confirming that ShinyHunters had adapted their operational tooling to bypass virtual patches and launch a renewed wave of mass data-theft attacks across the globe.

Global Impact and Diverse Industry Targeting

The scope of the renewed ShinyHunters campaign is sweeping, affecting organizations across multiple continents and a wide array of critical sectors. Mandiant’s telemetry indicates that the attackers have successfully deployed web shells and backdoors on dozens of systems worldwide. The targeted industries include higher education, advanced technology, IT managed services, healthcare, agriculture, transportation, and various government agencies.

The modus operandi of the threat actors follows a methodical, quiet reconnaissance phase before full compromise. Prior to executing destructive or exfiltration payloads, the attackers typically transmit a series of five to fifteen HTTP POST requests to endpoints such as /%50SEMHUB/hub. These payloads contain serialized Java objects designed to probe the target system. On vulnerable architectures, these probing requests return detailed information regarding the host operating system without writing files to disk or causing application crashes, allowing ShinyHunters to curate a database of easily exploitable targets with minimal risk of triggering alarms.

Once a host is confirmed to be vulnerable, the attackers leverage the RCE capability to execute arbitrary commands directly within system memory or to deploy persistent web shells. Investigators have identified the primary usage of an ‘x.jsp’ web shell for general command execution, alongside ‘u.jsp’ and ‘u2.jsp’ shells specifically tailored for uploading larger malicious binaries.

Malware Deployment and Lateral Movement Toolkit

On compromised Microsoft Windows servers, the threat actors utilize their deployed web shells to drop an executable file named Ple64.exe. This binary is cleverly designed to masquerade as a legitimate, digitally signed installer for the Light Alloy media player, lowering the suspicion of automated security monitoring tools. In reality, the executable installs a sophisticated backdoor tracked by Google as SIDEEYE.

The SIDEEYE malware functions as a multi-purpose Swiss Army knife for the attackers. It provides comprehensive capabilities for credential harvesting, active process and file management, interactive reverse shell generation, and reverse proxy functionality. This allows the operators to maintain persistent, encrypted communication channels back to their command-and-control (C2) infrastructure while blending in with normal enterprise network traffic.

Furthermore, ShinyHunters has been observed deploying advanced tunneling frameworks to facilitate internal reconnaissance and lateral movement. By utilizing files such as tunnel.jsp and tunnel.jspx, the group installs the open-source Neo-reGeorg tunneling toolkit. This utility enables standard SOCKS5 proxy traffic to be encapsulated within normal HTTP and HTTPS connections, effectively turning a compromised PeopleSoft server into a pivoting point to attack deeper internal network segments that were previously shielded from the public internet.

On compromised Linux environments, the threat actors have similarly moved away from simple script-based backdoors, instead installing legitimate remote management software such as MeshAgent to ensure long-term persistence and administrative control over the underlying infrastructure.

The FBI Controversy and Continuing Claims

The resurgence of ShinyHunters also brings renewed scrutiny to the group’s previous high-profile claims. In late September, representatives of the syndicate contacted security journalists, asserting they had successfully compromised FBI systems using what they maintained was a previously unknown PeopleSoft zero-day vulnerability.

According to the group’s statements, this alleged vector granted them unauthorized entry into the FBI Jobs platform, which they subsequently used as a stepping stone to infiltrate internal AWS GovCloud repositories. The threat actors boasted of exfiltrating terabytes of internal data concerning job applicants, current and former agents, and sensitive administrative files.

While independent cybersecurity researchers and media outlets were initially unable to verify the veracity of these claims, the FBI acknowledged that it had initiated a formal investigation into unauthorized cyber activity impacting FBIjobs.gov, though the bureau stopped short of officially confirming a comprehensive data breach or data exfiltration event. Representatives for ShinyHunters have since confirmed to security researchers that they utilized the exact same WAF-bypassing URL-encoding methodology against the FBI infrastructure, though they continue to insist that their operations also involved additional, unreleased zero-day flaws within the same architectural component.

Expert Recommendations and Remediation Guidelines

In light of the widespread adoption of the WAF bypass technique, cybersecurity authorities and threat intelligence experts are strongly urging organizations to abandon temporary perimeter-blocking strategies and enact permanent code-level remediations.

Google and Mandiant have issued several critical directives for IT and security operations teams:

1. Immediate Patch Deployment: Organizations running Oracle PeopleSoft must prioritize the installation of the official security updates provided by Oracle to definitively patch CVE-2026-35273 at the application layer, rather than relying on perimeter mitigations.
2. Comprehensive Log Analysis: Administrators are advised to immediately inspect historical and real-time WebLogic access logs for anomalous requests containing the literal string /PSEMHUB/ as well as any encoded or obfuscated variants, such as /%50SEMHUB/, /%70SEMHUB/, or other mixed-case permutations.
3. Web Shell Hunts: Security teams should perform thorough integrity checks and forensic sweeps of their web server directories, specifically looking for unauthorized JSP files (such as x.jsp, u.jsp, tunnel.jsp, and their variants) that could indicate an existing compromise.
4. Endpoint Monitoring: Organizations must monitor endpoint activity for the execution of suspicious binaries disguised as legitimate software installers, such as the Ple64.exe executable associated with the SIDEEYE backdoor.

As sophisticated extortion groups like ShinyHunters continue to refine their evasion techniques, the reliance on superficial perimeter defenses such as uninspected WAF rules has proven to be a high-risk gamble. True enterprise security in the face of machine-speed cyber attacks requires rigorous patch management, deep visibility into application-layer traffic logs, and continuous endpoint behavioral monitoring to detect and eradicate persistent threats before lateral movement can occur.