The ShinyHunters extortion group has reportedly adapted its attacks against vulnerable Oracle PeopleSoft servers by using URL encoding to evade some web application firewall (WAF) rules, according to Google’s Mandiant and Threat Intelligence Group.
The activity concerns CVE-2026-35273, an Oracle PeopleSoft vulnerability that Oracle patched in June and described as an unauthenticated remote code execution issue. Security researchers previously linked the flaw’s exploitation to ShinyHunters, which Google tracks as UNC6240. Organizations that had not yet applied Oracle’s update were advised to restrict access to the affected Environment Management Hub endpoint, commonly identified as /PSEMHUB/.
Encoded requests can defeat literal path rules
Mandiant said the attackers are substituting an encoded character in the path, such as using /%50SEMHUB/ rather than the plain-text endpoint. In URL encoding, %50 represents the letter “P.”
This can create a gap when a WAF or reverse proxy evaluates the request before decoding the URL, while the downstream Oracle WebLogic server decodes and processes it. A control that blocks only the exact visible /PSEMHUB/ string may therefore fail to stop encoded or otherwise modified versions of the request.
Google cautioned that attackers could use other encodings and path variations, meaning organizations should not treat a single blocking rule as a complete mitigation. Applying Oracle’s security update remains the recommended defense.
Web shells and tunneling tools observed
In the recent campaign, Mandiant observed compromises affecting organizations in sectors including higher education, healthcare, technology, transportation, agriculture, government and IT services. Attackers first sent a series of POST requests containing serialized Java objects, apparently to determine whether a target could be exploited.
Following successful exploitation, the group was seen executing commands in memory and deploying JSP web shells. Researchers identified shells used for command execution, file uploads and HTTP-based tunneling. On Windows systems, the attackers also deployed a program masquerading as a Light Alloy media player installer that installed the SIDEEYE backdoor, which can support credential theft, file and process operations, reverse shells and proxy capabilities.
- Install Oracle’s update for CVE-2026-35273 as soon as possible.
- Review WebLogic logs for both standard and encoded requests targeting the PSEMHUB path.
- Investigate unexpected JSP files, tunneling utilities, remote-management tools and suspicious outbound connections.
ShinyHunters has also made separate claims involving an alleged FBI-related PeopleSoft intrusion. Those assertions, including claims of an additional unknown vulnerability, have not been independently verified.