ShinyHunters Evades WAF Defenses with URL-Encoding Trick
The ShinyHunters extortion gang has adapted its exploitation of Oracle PeopleSoft systems by using a URL-encoding bypass technique to circumvent web application firewall (WAF) protections put in place after the disclosure of CVE-2026-35273. This vulnerability, initially reported as a zero-day in June 2026, allows unauthenticated remote code execution via the Environment Management Hub (PSEMHUB) component.
According to a new report from Google's Mandiant and Threat Intelligence Group (GTIG), threat actors are now sending requests with percent-encoded characters in the path — such as '/%50SEMHUB/' instead of '/PSEMHUB/' — to evade detection by security tools that inspect raw request paths before decoding. The '%50' sequence represents the URL-encoded form of the letter 'P'. While many WAFs and reverse proxies compare the literal, undecoded path against blocklists, Oracle WebLogic automatically decodes the sequence and routes the request to the vulnerable endpoint, effectively bypassing the WAF rule.
How the Bypass Works
Mandiant explains that this technique allows attackers to reach the PSEMHUB endpoint on systems where administrators believed WAF rules had mitigated the risk. By encoding just the first character of the path, the exploit avoids literal string matches while still being processed correctly by the backend application. Google warns that ShinyHunters may vary this approach, using other percent-encoded sequences, mixed-case variations, or alternative obfuscation methods to bypass signature-based defenses.
Attack Chain and Post-Exploitation Activities
Before full exploitation, ShinyHunters typically sends between five and 15 POST requests to paths like '/%50SEMHUB/hub' containing serialized Java objects. These probes return system information — such as the host operating system — without writing files or disrupting service, enabling attackers to quietly assess vulnerability. If the system is deemed exploitable, the gang proceeds to execute arbitrary commands in memory or deploy web shells for persistent access.
Google reports that the attackers deploy specific JSP-based web shells: 'x.jsp' for command execution, and 'u.jsp' and 'u2.jsp' for file upload capabilities. On compromised Windows systems, these shells have been used to drop an executable named 'Ple64.exe', which masquerades as a signed Light Alloy media player installer but actually installs a backdoor tracked by Google as SIDEEYE. This malware supports credential theft, process and file management, interactive reverse shells, and reverse proxy functionality.
Additionally, ShinyHunters has deployed the open-source Neo-reGeorg tunneling toolkit via 'tunnel.jsp' and 'tunnel.jspx' files, enabling SOCKS5 proxy traffic to be tunnelled over HTTP and HTTPS. This allows attackers to use the compromised PeopleSoft server as a pivot point for lateral movement into internal networks. Mandiant also observed the use of the legitimate MeshAgent remote management tool to maintain access to Linux-based systems.
Impact and Targeted Sectors
The renewed wave of attacks has resulted in web shell deployment on dozens of systems across multiple sectors worldwide, including higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations. Mandiant notes that many of these systems had not applied the June security update for CVE-2026-35273 and instead relied solely on WAF rules to block access to the vulnerable endpoint — a strategy now defeated by the encoding bypass.
Connection to Alleged FBI Breach
These developments follow ShinyHunters’ earlier claim in September 2026 that it had breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability. The group told BleepingComputer on September 22 that the flaw allowed remote code execution and was used to access the FBI Jobs platform, then move laterally into the FBI’s AWS GovCloud environment, allegedly resulting in the theft of 2TB to 3TB of data related to employees, applicants, and internal systems.
While the FBI confirmed it was investigating unauthorized activity affecting FBIjobs.gov, it did not confirm a breach or data theft. ShinyHunters has since told BleepingComputer that the WAF bypass technique described in the Mandiant report was used against the FBI Jobs system, though the group maintains that it also exploited a separate, previously unknown vulnerability in the PSEMHUB component.
Recommendations for Defense
Mandiant strongly advises organizations running Oracle PeopleSoft to prioritize applying the official security update for CVE-2026-35273, as WAF-based mitigations can be bypassed through encoding techniques. As a complementary measure, administrators should review WebLogic access logs for requests to both '/PSEMHUB/' and known encoded variants such as '/%50SEMHUB/', '%50' being just one example of possible obfuscation.
The vendor emphasizes that relying on network-level controls alone is insufficient against adaptive threat actors. Patching remains the most effective defense against exploitation of this flaw.
Source: BleepingComputer