ShinyHunters Bypass WAF Protections to Continue Oracle PeopleSoft Attacks
Security researchers have uncovered ongoing exploitation of a critical Oracle PeopleSoft vulnerability, with threat actors leveraging URL encoding to circumvent web application firewall (WAF) protections.
Bypassing WAF Protections Through URL Encoding
The attackers modified exploit techniques by altering the URL path to evade detection. Specifically, they replaced the “/PSEMHUB/” directory with “/%50SEMHUB/”, where “P” is encoded as its hexadecimal equivalent. Many WAF and reverse-proxy systems inspect URLs before decoding, allowing this obfuscation to bypass existing rules. Once the request reaches the WebLogic server, the path is decoded, enabling the attack to proceed undetected.
Mandiant and the Google Threat Intelligence Group (GTIG) identified this method in a renewed campaign. The attack vector has been linked to multiple sectors, including higher education, healthcare, government, and technology.
Deployment of Web Shells and SIDEEYE Backdoor
Following successful exploitation, attackers deployed JSP-based web shells such as x.jsp and u.jsp within the PeopleSoft application directory. The x.jsp shell provides command execution capabilities, while u.jsp facilitates the upload of larger files in 150 KB increments to bypass HTTP request size restrictions. On Windows systems, the threat actors uploaded a 5.2 MB file named Ple64.exe, a trojanized installer for the Light Alloy media player. This file, signed with a valid certificate, delivers the SIDEEYE backdoor.
SIDEEYE is designed to extract credentials from browsers and desktop applications, manage system files and processes, and establish reverse-shell and reverse-proxy access. Additional tools used in the campaign include the open-source Neo-reGeorg tunneling utility and legitimate MeshAgent remote management software to maintain persistent access.
Contextual Attacks and Previous Incidents
This campaign follows earlier reports of ShinyHunters exploiting Oracle PeopleSoft vulnerabilities. In June 2026, Mandiant and GTIG identified over 100 organizations with exposed PeopleSoft systems, with 68% located in higher education institutions across the United States. Recent findings also align with claims by ShinyHunters, who stated they used an Oracle PeopleSoft zero-day to infiltrate the FBI’s job application portal. The group reported lateral movement into FBI systems, including AWS GovCloud infrastructure. However, no direct connection has been established between this incident and the CVE-2026-35273 vulnerability described in the latest analysis.
Mitigation Recommendations
Mandiant advises organizations to prioritize applying Oracle’s security patch rather than relying on WAF rules for protection. Additional steps include:
- Disabling the Environment Management Hub where feasible
- Reviewing WebLogic logs for anomalous requests involving encoded or standard /PSEMHUB/ paths
- Scanning PeopleSoft application directories for unauthorized JSP files or executable components
- Revoking credentials accessible from compromised systems
The ongoing exploitation highlights the risks of unpatched software and the effectiveness of URL encoding techniques in evading traditional security measures. Enterprises are urged to conduct thorough system audits and implement proactive threat detection strategies.
About Author
English