The ShinyHunters extortion gang has found a way around a common mitigation for a critical Oracle PeopleSoft vulnerability, allowing it to resume large-scale exploitation of servers that administrators believed were protected. Google’s Mandiant and Threat Intelligence Group (GTIG), which track the actor as UNC6240, say the group is now using URL encoding to bypass web application firewall (WAF) rules built to block access to the vulnerable PSEMHUB endpoint.

The underlying flaw, CVE-2026-35273, was disclosed and patched by Oracle in June after Mandiant and BleepingComputer reported that ShinyHunters had exploited it as a zero-day to steal data from around 100 organizations. The bug allows unauthenticated remote code execution. Organizations unable to immediately patch were advised to block external access to the PSEMHUB endpoint using WAF rules.

According to Mandiant, ShinyHunters has now modified its exploit to request encoded variants of the path, such as substituting the letter ‘P’ with its percent-encoded form ‘%50’, turning ‘/PSEMHUB/’ into ‘/%50SEMHUB/’. Many WAFs and reverse proxies evaluate the literal request path before decoding it, so encoded requests slip past filters, while Oracle WebLogic decodes the string and routes it to the vulnerable endpoint anyway. Google warns the attackers may also rotate through other percent-encoded or mixed-case variants to evade detection.

Attack chain and new malware

Mandiant says the attackers typically send several POST requests containing serialized Java objects to the encoded endpoint to quietly fingerprint whether a target is exploitable before acting. Once confirmed vulnerable, they deploy JSP web shells, including ‘x.jsp’ for command execution and ‘u.jsp’/’u2.jsp’ for file uploads.

On compromised Windows hosts, the group has deployed an executable disguised as a signed media player installer that actually installs a newly tracked backdoor called SIDEEYE, used for credential theft, file management, reverse shells, and proxying. Attackers also deployed the open-source Neo-reGeorg tunneling toolkit and legitimate MeshAgent software to maintain persistence and move laterally into internal networks.

Google says the new wave has hit dozens of organizations across higher education, technology, IT services, healthcare, agriculture, transportation, and government sectors.

FBI claims

The campaign follows ShinyHunters’ claim to have breached FBI systems, including the FBI Jobs platform and AWS GovCloud infrastructure, allegedly stealing 2 to 3 terabytes of data. The FBI confirmed it is investigating unauthorized activity on FBIjobs.gov but has not confirmed a breach or data theft. ShinyHunters has since confirmed to BleepingComputer it used the WAF bypass technique against FBI Jobs, while still claiming a separate, unverified zero-day in the same component.

Mandiant urges organizations to patch immediately rather than rely on WAF rules, and to search WebLogic access logs for requests to ‘/PSEMHUB/’ and encoded variants like ‘/%50SEMHUB/’ to detect exploitation attempts.