Modern enterprise cybersecurity relies heavily on defense-in-depth strategies, yet adversaries continually discover innovative avenues to subvert perimeter controls. The notorious extortion collective known as ShinyHunters has demonstrated this reality once again through a sophisticated web application firewall (WAF) evasion method. By leveraging simple percent-encoding tactics, the threat group has successfully revitalized widespread exploitation campaigns targeting unpatched Oracle PeopleSoft deployments worldwide. Cybersecurity researchers tracking the actor indicate that this technique highlights a persistent vulnerability in how security devices parse incoming HTTP request paths compared to backend application servers.
The roots of this ongoing campaign trace back to early summer when threat intelligence analysts first detected active exploitation targeting enterprise resource planning architecture. At the time, attackers leveraged an unauthenticated remote code execution vulnerability—subsequently cataloged by Oracle as CVE-2026-35273—to compromise environments across more than one hundred distinct organizations. The vulnerability centers on the Environment Management Hub component, specifically the exposed /PSEMHUB/* endpoint. Recognizing the severity of the zero-day flaw, Oracle rapidly developed and deployed security updates to eradicate the underlying weakness.
In the wake of the initial disclosure, incident response teams and threat intelligence organizations advised enterprises unable to immediately apply official software patches to implement compensatory controls. Specifically, security engineers recommended configuring perimeter WAFs and reverse proxies to block external requests directed at the vulnerable /PSEMHUB/ path. While this mitigation strategy temporarily halted incoming exploitation attempts for organizations struggling with patch deployment cycles, it ultimately provided a false sense of security. Sophisticated extortion actors quickly identified the architectural discrepancy that would allow them to bypass these filtering mechanisms entirely.
According to technical analysis published by Google’s Mandiant and Threat Intelligence Group—which tracks the adversarial collective under the designation UNC6240—the group modified its exploitation payload to circumvent literal string matching rules implemented on perimeter defenses. Many legacy and standard WAF configurations inspect the incoming URI string precisely as it arrives from the client, evaluating the literal sequence of characters before normalization or decoding routines take place. When administrators draft rules to intercept and block any URI containing the string /PSEMHUB/, a request that deviates from those exact characters sails past the defensive filter unchecked.
To exploit this operational blind spot, ShinyHunters began substituting standard characters within the URI path with their percent-encoded equivalents. For example, rather than transmitting a request to /PSEMHUB/, the malicious infrastructure issues requests formatted as /%50SEMHUB/. In this sequence, the %50 hexadecimal value represents the precise ASCII encoding for the uppercase letter ‘P’. When this obfuscated request reaches the perimeter defense, the WAF fails to match the literal blocklist rule because it encounters the percentage sign and numerical characters instead of the expected alphabetical string, allowing the traffic to pass unhindered.
The critical breakdown occurs further down the request handling pipeline. Once the percent-encoded traffic traverses the WAF and arrives at the backend Oracle WebLogic server, the application stack normalizes the URI. WebLogic automatically decodes the percent-encoded characters, translating /%50SEMHUB/ back into its intended form before routing the execution flow to the underlying servlet and vulnerable endpoint. Consequently, the enterprise boundary defense assumes the transaction is benign, while the internal application processes the malicious payload as if no security filter stood in the way.
Security researchers emphasize that this discrepancy between how perimeter appliances and backend application servers handle URI decoding represents a systemic architectural challenge. Threat intelligence providers warn that organizations cannot safely assume that blocking specific paths at the WAF level provides reliable protection against determined adversaries. ShinyHunters is not constrained to a single encoding variation; analysts caution that the group can easily cycle through alternative permutations, including mixed-case variants, double-encoding, or other hexadecimal representations to continually evade signature-based detection mechanisms.
The consequences of these bypassed defenses have manifested as a severe wave of data-theft intrusions across multiple critical sectors. Organizations operating within higher education, global technology, professional IT services, healthcare, agriculture, transportation, and government agencies have found themselves targeted by the renewed campaign. Before executing full-scale compromise routines, the malicious actors typically probe prospective targets by transmitting a controlled series of HTTP POST requests containing serialized Java objects directly to the obfuscated endpoint.
These initial reconnaissance probes interact with vulnerable systems by querying the underlying operating system environment. Because these investigative requests execute without writing unauthorized files to the disk or disrupting normal operational services, the threat actors can quietly catalog viable targets with minimal risk of triggering standard behavioral alarms. Once an environment confirms vulnerability, the collective escalates its tactics, deploying in-memory command execution routines and custom Java Server Pages web shells to cement persistent access within the network infrastructure.
Forensic investigations into the post-exploitation phases of these attacks reveal a methodical approach to maintaining foothold stability. Operators commonly deploy specific JSP web shells—designated as x.jsp for arbitrary command execution alongside u.jsp and u2.jsp for handling larger file uploads. On compromised Microsoft Windows environments, these initial entry vectors facilitate the deployment of a secondary executable named Ple64.exe. To blend in with legitimate administrative tools, this binary masquerades as a signed installer for the Light Alloy media player, ultimately dropping a sophisticated backdoor tracked by threat intelligence analysts as SIDEEYE.
The SIDEEYE malware functions as an expansive Swiss Army knife for the intrusion operators, providing capabilities that include credential harvesting, comprehensive file and process management, interactive reverse shell generation, and robust reverse proxy functionality. In parallel with custom backdoors, the actors routinely introduce open-source tunneling utilities such as the Neo-reGeorg framework through files labeled tunnel.jsp and tunnel.jspx. This tunneling capability enables operators to route SOCKS5 proxy traffic seamlessly over standard encrypted HTTP and HTTPS channels, transforming the compromised PeopleSoft server into a launchpad for lateral movement deeper into internal corporate segments. On Linux-based deployments, researchers have similarly documented the abuse of legitimate remote management utilities like MeshAgent to ensure persistent, out-of-band administrative access.
The severity of these campaigns gained international attention following assertions by ShinyHunters regarding high-profile compromises. The extortion group publicly claimed responsibility for breaching prominent federal infrastructure, specifically asserting that they utilized a zero-day exploit targeting Oracle PeopleSoft architecture to penetrate the FBI Jobs platform. According to statements from the actors, this initial entry facilitated lateral movement into cloud-hosted environments, culminating in the alleged exfiltration of massive volumes of data concerning agency personnel and applicants. While federal authorities confirmed ongoing investigations into unauthorized cyber activity impacting recruitment portals, independent verification of the precise initial vector and data volumes remained constrained. However, threat intelligence confirmations indicate that the group heavily relies on evasion frameworks of this nature to punch through defensive perimeters during high-stakes enterprise campaigns.
Mitigating the risks posed by sophisticated WAF bypass techniques requires a fundamental shift in defensive engineering priorities. Industry experts and incident response authorities strongly urge organizations to treat perimeter filtering merely as a temporary auxiliary measure rather than a substitute for proper software patching. System administrators operating Oracle PeopleSoft environments must expedite the application of official vendor patches to neutralize CVE-2026-35273 at the source code level. Furthermore, security operations centers should conduct rigorous historical log analysis across WebLogic access logs, specifically querying for historical and ongoing patterns containing both literal references to /PSEMHUB/ and obfuscated variants like /%50SEMHUB/. Only through a combination of rapid patch management, deep visibility into application-layer routing, and proactive threat hunting can enterprises effectively defend against adaptive extortion syndicates exploiting the gap between network defenses and application parsing logic.
