ShinyHunters bypasses WAF mitigations to resume mass exploitation of Oracle PeopleSoft servers

The notorious extortion syndicate known as ShinyHunters, tracked by security researchers as UNC6240, has successfully weaponized a sophisticated URL-encoding technique to circumvent web application firewall (WAF) protections. This development has effectively nullified previous mitigation efforts intended to block exploitation of the critical Oracle PeopleSoft vulnerability, CVE-2026-35273. By bypassing security filters, the threat actors have regained the ability to target unpatched enterprise servers across a diverse range of critical sectors, including government, healthcare, education, and technology.

The Mechanism of the Bypass

The core of this renewed exploitation campaign lies in the manipulation of HTTP request paths. Following the initial disclosure of the vulnerability in June 2026, many organizations—unable to immediately patch their systems—relied on WAF rules to block traffic directed at the /PSEMHUB/ endpoint, a component of the PeopleSoft Environment Management Hub.

However, Mandiant’s latest threat intelligence report highlights that the attackers have modified their exploit scripts to use percent-encoded characters. For instance, by substituting the character "P" with its URL-encoded equivalent "%50," the attackers can craft requests like /%50SEMHUB/. Many legacy WAF configurations and reverse proxies inspect the literal request string before performing any decoding. Because the string /%50SEMHUB/ does not match the block-rule for /PSEMHUB/, the firewall permits the request. Once the request reaches the backend Oracle WebLogic server, the platform decodes the URI, effectively "normalizing" the path and routing the malicious payload to the vulnerable endpoint.

This discrepancy between how security appliances interpret traffic and how the underlying application server processes it creates a "blind spot" that ShinyHunters is now aggressively leveraging. Security experts warn that this is a modular technique; the attackers are capable of switching to other variations, such as mixed-case encoding or alternative character representations, to continue evading static WAF signatures.

Chronology of the Exploitation Campaign

The timeline of this campaign reflects a persistent and adaptive threat actor.

• June 10, 2026: BleepingComputer reports on a widespread campaign by the ShinyHunters extortion group targeting Oracle PeopleSoft servers via a previously unknown zero-day vulnerability.
• June 11, 2026: Oracle officially releases a security update for the flaw, designated CVE-2026-35273. The vulnerability is confirmed to allow for unauthenticated remote code execution (RCE).
• June 11, 2026: Google’s Mandiant unit confirms that UNC6240 (ShinyHunters) is the actor behind the attacks, noting that the education sector was a primary target.
• Mid-June 2026: Following the update, Mandiant advises organizations that cannot patch immediately to implement WAF-level blocking on the /PSEMHUB/* directory.
• September 2026: ShinyHunters publicly claims to have compromised FBI systems, including the FBIJobs platform, alleging the use of a new, distinct PeopleSoft zero-day.
• Present Day: Mandiant identifies the WAF-bypass technique, noting that the group is actively using it to redeploy web shells and move laterally within enterprise networks.

Technical Implications and Attack Methodology

The current wave of attacks follows a highly standardized methodology designed to minimize the risk of discovery. Before launching a full-scale exploit, the attackers typically send a series of five to 15 POST requests to the /PSEMHUB/hub endpoint. These requests contain serialized Java objects that probe the host operating system. This reconnaissance phase allows the attackers to confirm vulnerability without triggering alarms associated with file system modifications or service disruptions.

Once a target is confirmed as vulnerable, the threat actors escalate their intrusion by deploying JSP-based web shells. Specifically, researchers have observed the use of x.jsp for command execution and u.jsp and u2.jsp for file management and data exfiltration. On Windows-based infrastructure, the attackers have been observed deploying an executable titled Ple64.exe, which masquerades as a legitimate media player installer. This binary serves as a delivery vehicle for the "SIDEEYE" backdoor, a sophisticated malware strain capable of credential theft, reverse shell generation, and process management.

To facilitate lateral movement—the ability to spread from the initially compromised server to the wider corporate environment—the group utilizes the open-source Neo-reGeorg tunneling toolkit. By using tunnel.jsp and tunnel.jspx, the attackers tunnel SOCKS5 proxy traffic over standard HTTP/HTTPS channels, effectively masking their internal network scanning as legitimate web traffic. In instances where the target environment runs on Linux, the group has been observed deploying the MeshAgent remote management software, ensuring a persistent foothold that survives reboots and credential resets.

Official Responses and Industry Impact

The scope of this campaign is global, impacting organizations across technology, agriculture, transportation, and government agencies. While the FBI has acknowledged investigating reports of unauthorized activity concerning FBIjobs.gov, the agency has stopped short of confirming a total breach or significant data theft. ShinyHunters, however, maintains that the breach of the FBI platform resulted in the theft of 2TB to 3TB of sensitive data pertaining to employees and applicants.

Oracle has strongly urged all customers to prioritize the application of the official security patches for CVE-2026-35273 rather than relying on perimeter mitigations. Mandiant has provided technical guidance for incident response teams, suggesting that organizations perform a thorough audit of their WebLogic access logs. Specifically, security teams are encouraged to search for both literal requests to /PSEMHUB/ and any encoded variants like /%50SEMHUB/, as these are definitive indicators of compromise.

Analysis of the Security Landscape

The rise of "WAF-bypass" techniques represents a maturing threat landscape where attackers are no longer relying solely on the technical flaws of software, but also on the configuration gaps within the defensive infrastructure itself. The ShinyHunters campaign demonstrates that a vulnerability is rarely truly "mitigated" by a firewall rule alone. When defense-in-depth is lacking—specifically when organizations fail to patch the underlying application—the security of the enterprise rests entirely on the accuracy of firewall regex patterns.

As AI-powered automated scanning becomes more prevalent in the threat actor’s toolkit, the speed at which these groups iterate their bypass techniques is increasing. The implication for organizations is clear: perimeter defenses are increasingly fragile against determined, adaptive adversaries. The transition from a "patch when possible" mentality to an "emergency patching" protocol is now essential for any organization operating critical infrastructure.

Furthermore, the integration of legitimate remote management tools like MeshAgent into the attack chain highlights a shift toward "living off the land." By using software that security tools typically permit, attackers can blend into the background noise of a busy enterprise network, making detection significantly more difficult for Security Operations Centers (SOCs).

Moving forward, the primary recommendation from the global cybersecurity community remains the same: treat the WAF as a temporary stop-gap, not a long-term solution. Until the underlying vulnerability is remediated through vendor-supplied patches, the attack surface remains exposed to even the most rudimentary encoding variations. Organizations must also implement robust egress filtering to detect the SOCKS5 tunneling activity associated with the Neo-reGeorg toolkit, as this is often the most significant indicator that an attacker is attempting to move laterally through the internal network.