ShinyHunters Extortion Gang Bypasses Web Application Firewalls Using URL-Encoding to Renew Mass Exploitation of Oracle PeopleSoft Vulnerability

The notorious ShinyHunters cyber extortion syndicate has returned to the spotlight with a sophisticated evasion technique designed to sidestep perimeter security defenses. By employing a straightforward URL-encoding trick, the threat actors have successfully bypassed web application firewall (WAF) rules that were previously implemented to mitigate the critical Oracle PeopleSoft vulnerability tracked as CVE-2026-35273. This development has triggered a renewed wave of mass exploitation targeting unpatched enterprise servers globally, leaving organizations across multiple critical sectors scrambling to re-evaluate their defense-in-depth strategies.

According to threat intelligence advisories released by Google’s Mandiant and Threat Intelligence Group (GTIG), the bypass technique targets organizations that applied temporary mitigating controls rather than fully deploying official vendor patches. When the vulnerability first came to light, security teams frequently relied on WAFs and reverse proxies to block external reconnaissance and exploit attempts directed at the vulnerable Environment Management Hub endpoint. However, ShinyHunters—tracked by Google under the threat cluster designation UNC6240—has weaponized a classic parsing discrepancy between perimeter inspection engines and backend application servers to resume large-scale data-theft campaigns.

Anatomy of the WAF Bypass and Exploitation Mechanics

The core mechanism of the bypass relies on how different layers of a modern enterprise web architecture process uniform resource identifiers (URIs) containing percent-encoded characters. In the initial wave of attacks, security teams configured their WAFs to explicitly block incoming HTTP requests directed at the literal path string /PSEMHUB/. This signature-based approach effectively halted automated exploitation attempts that matched the known attack pattern.

To circumvent these rules, ShinyHunters modified their exploit scripts to replace literal characters with their percent-encoded equivalents. Instead of transmitting requests targeting /PSEMHUB/, the threat actors began sending requests utilizing /%50SEMHUB/, where the %50 sequence acts as the standard percent-encoded hexadecimal representation of the uppercase letter "P".

The vulnerability in security posture stems from a discrepancy in handling normalization. Many conventional web application firewalls and reverse proxy solutions evaluate the raw, literal request path string as it arrives at the perimeter, executing their filtering rules before performing complete URI decoding. Consequently, a security rule designed to catch the literal string /PSEMHUB/ fails to recognize /%50SEMHUB/ as an identical match, allowing the traffic to pass unhindered.

Conversely, upon receiving the request, Oracle WebLogic and the underlying PeopleSoft application infrastructure normalize and decode the path, translating the percent-encoded sequence back into the intended plaintext. This behavior routes the incoming traffic directly to the vulnerable endpoint, successfully neutralizing the intended protection provided by the WAF. Google’s Mandiant researchers emphasize that this discrepancy creates a false sense of security, as systems administrators frequently assume their perimeter mitigations have completely shielded vulnerable internal assets from external exposure.

Furthermore, security experts warn that the "%50" variation is merely one iteration of a broader evasion tactic. Threat actors possess the capability to continuously rotate their obfuscation methods, leveraging mixed-case combinations, alternative percent-encoding schemes, or double-encoding strategies to evade naive signature definitions. As a result, relying exclusively on perimeter filtering rules is no longer considered an adequate substitute for proper patch management.

Chronology of the CVE-2026-35273 Crisis

The unfolding security incident represents the latest chapter in a rapidly escalating series of events that began in early June. The timeline of discovery, mitigation, and subsequent evasion highlights the speed at which sophisticated threat groups adapt to defensive measures:

• June 10: Independent security reporting first revealed that the ShinyHunters extortion collective was actively leveraging an unknown zero-day vulnerability targeting Oracle PeopleSoft environments. Initial estimates suggested the campaign had successfully compromised and exfiltrated proprietary data from approximately one hundred major organizations.
• June 11: Oracle responded to the emerging crisis by releasing an emergency security update addressing the flaw, formally designating it as CVE-2026-35273. Technical advisories confirmed that the vulnerability permitted unauthenticated remote code execution (RCE) against vulnerable servers. On the same day, Google’s Threat Intelligence Group publicly linked the activity to the UNC6240 collective, noting heavy concentration of attacks within the global education sector.
• Mid-June: Due to the operational friction associated with immediately applying out-of-band enterprise patches or disabling core management components, numerous organizations opted for compensating controls. Security vendors, including Mandiant, recommended blocking external access to the /PSEMHUB/* endpoint at the WAF level.
• Late June to Early July: Threat actors adapted their tooling. By incorporating URL-encoding tricks to bypass literal string matching in WAF configurations, ShinyHunters initiated a secondary wave of automated scanning and exploitation against previously "mitigated" infrastructure.
• September: ShinyHunters made headlines by publicly claiming responsibility for high-profile intrusions, asserting that they had successfully leveraged PeopleSoft-related zero-day vectors to breach federal systems and infiltrate internal cloud environments.

Global Impact Across Multiple Critical Sectors

The renewed exploitation campaign has not been limited to a single industry vertical. According to telemetry gathered by Google and incident response partners, the latest wave of attacks has successfully deployed persistent access mechanisms across dozens of enterprise environments worldwide. Impacted sectors span a diverse cross-section of the global economy, including higher education, advanced technology, IT services, healthcare, agriculture, transportation, and various government instrumentalities.

The operational workflow employed by ShinyHunters during these intrusions follows a calculated, methodical pattern designed to minimize noise while maximizing data harvesting potential. Before launching full-scale exploitation, the threat actors typically dispatch a small battery of five to fifteen HTTP POST requests directed at /%50SEMHUB/hub. These payloads contain serialized Java objects engineered to elicit system responses.

On vulnerable systems, these initial probes return detailed operational data regarding the host operating system without generating disk artifacts or triggering immediate service disruptions. This reconnaissance phase allows the extortion gang to verify system vulnerability silently. Once a viable target is confirmed, the actors execute follow-up requests designed to run arbitrary commands directly within system memory or deploy lightweight JavaServer Pages (JSP) web shells.

Forensic analysis indicates that the actors frequently deploy specific web shell variants, such as x.jsp for routine command execution, alongside u.jsp and u2.jsp utilities designed for uploading larger files. On compromised Microsoft Windows servers, these interfaces have been observed facilitating the deployment of an executable designated as Ple64.exe. Masking itself as a digitally signed installer for the legitimate Light Alloy media player, this binary drops a modular backdoor tracked by security researchers as SIDEEYE.

The SIDEEYE malware functions as a versatile post-exploitation toolkit, providing the operators with robust credential-harvesting capabilities, comprehensive process and file management tools, interactive reverse shell generation, and built-in reverse proxy functionality. Additionally, operators have utilized open-source tunneling frameworks such as Neo-reGeorg—via tunnel.jsp and tunnel.jspx files—to encapsulate SOCKS5 proxy traffic inside standard HTTP and HTTPS connections. This tunneling capability allows compromised PeopleSoft servers to act as pivot points, facilitating lateral movement deeper into the victim’s internal enterprise network. For compromised Linux environments, researchers noted the deployment of legitimate remote management utilities, such as MeshAgent, to ensure long-term persistence and maintain administrative access independently of the initial web application vector.

The FBI Incident and Escalating Extortion Claims

The technical escalation involving WAF bypasses coincides with broader, highly publicized claims made by ShinyHunters regarding high-profile government breaches. In late September, representatives of the extortion syndicate contacted security journalists and researchers to assert that they had successfully penetrated systems belonging to the Federal Bureau of Investigation.

According to the group’s statements, the alleged intrusion relied on remote code execution capabilities within the PeopleSoft ecosystem to target the FBI Jobs platform (FBIjobs.gov). The actors claimed they subsequently pivoted from the initial web application entry point into internal cloud environments, specifically targeting AWS GovCloud infrastructure. Within these repositories, the collective asserted they exfiltrated between two and three terabytes of sensitive institutional data, encompassing personal identifiable information (PII) related to current and former agency personnel, active job applicants, and various internal administrative records.

While independent cybersecurity researchers and news outlets were unable to immediately verify the existence of a distinct, unpatched zero-day vulnerability separate from CVE-2026-35273 at the time of the claims, federal authorities acknowledged ongoing inquiries. The FBI confirmed that it was actively investigating reports concerning unauthorized cyber activity affecting recruitment platforms, though officials refrained from confirming the full extent of the alleged data theft or the specific intrusion vectors utilized.

Representatives for ShinyHunters subsequently maintained that while they utilized the documented WAF-bypass methodology to access recruitment portals, they also leveraged novel, undisclosed components within the broader PeopleSoft architecture to achieve their objectives—assertions that continue to be scrutinized by intelligence analysts and incident responders.

Defensive Recommendations and Remediation Guidance

In response to the evolving tactics deployed by ShinyHunters, cybersecurity authorities and major incident response firms have issued urgent operational directives to enterprises maintaining Oracle PeopleSoft deployments. Security leadership stresses that perimeter filtering and WAF rules must be treated strictly as auxiliary defense measures rather than permanent solutions.

Mandiant’s official guidance outlines several critical steps organizations must execute immediately:

1. Prioritize Patch Deployment: Organizations running vulnerable instances of Oracle PeopleSoft must expedite the installation of official security updates provided by Oracle to remediate CVE-2026-35273 at the source code level.
2. Log Analysis and Forensic Triage: Security operations centers (SOCs) are advised to conduct exhaustive historical and real-time reviews of Oracle WebLogic access logs. Investigations should specifically search for anomalous POST requests directed at /PSEMHUB/ as well as encoded variants, including variations utilizing mixed-case strings, double-encoding, and hex representations such as /%50SEMHUB/.
3. Endpoint Integrity Verification: Systems administrators must inspect web application directories for unauthorized or suspicious JSP files (x.jsp, u.jsp, tunnel.jsp, etc.), unknown binary executions (such as masqueraded installers like Ple64.exe), and unexpected persistence mechanisms.
4. Network Segmentation and Egress Monitoring: Given the actors’ reliance on tunneling tools like Neo-reGeorg and remote management agents like MeshAgent for lateral movement, organizations should enforce strict internal network segmentation and monitor outbound traffic anomalies originating from database and application servers.

Broader Implications for Enterprise Security

The resurgence of the ShinyHunters campaign via a elementary yet effective parsing bypass underscores persistent architectural challenges in modern enterprise defense. As threat actors continually refine their methodologies to exploit the semantic gaps between perimeter security controls and backend application logic, organizations face mounting pressure to abandon perimeter-dependent security models in favor of rigorous, zero-trust paradigms.

The incident demonstrates that the implementation of compensating controls, while vital for maintaining operational continuity during emergency patching cycles, introduces significant long-term risk if not accompanied by prompt vulnerability remediation. Discrepancies in how security devices and web servers interpret URI encoding remain a systemic vulnerability across the broader web application firewall ecosystem.

For the cybersecurity community, the campaign serves as a stark reminder that extortion syndicates possess the technical agility to adapt rapidly to defensive publications. As automated scanners ingest threat intelligence reports and dynamically update their payloads to test for parsing weaknesses, enterprise security teams must couple proactive threat hunting with rapid patch deployment to maintain resilience against sophisticated, financially motivated adversaries.