Full Report
The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. [...]
Analysis Summary
# Incident Report: WAF Bypass Exploitation of Oracle PeopleSoft (CVE-2026-35273)
## Executive Summary
The ShinyHunters extortion gang (tracked as UNC6240) is actively bypassing Web Application Firewall (WAF) mitigations for a critical Oracle PeopleSoft vulnerability (CVE-2026-35273). By using URL-encoding tricks (e.g., `/%50SEMHUB/`), attackers circumvent literal-string WAF rules to achieve Unauthenticated Remote Code Execution (RCE). The campaign has impacted dozens of organizations across multiple sectors, resulting in web shell deployment and data exfiltration.
## Incident Details
- **Discovery Date:** September 26, 2026 (Public reporting of WAF bypass)
- **Incident Date:** Ongoing; initial zero-day activity began June 10, 2026
- **Affected Organization:** Multiple; including claims against FBIjobs.gov
- **Sector:** Higher Education, Technology, Healthcare, Government, Agriculture, and Transportation
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** June 2026 (Initial Zero-Day); September 2026 (Resumed via WAF bypass)
- **Vector:** Exploitation of CVE-2026-35273 (Oracle PeopleSoft Environment Management Hub)
- **Details:** Attackers send 5–15 POST requests containing serialized Java objects to the `/PSEMHUB/hub` endpoint (or encoded variants) to probe for vulnerability and host OS information.
### Lateral Movement
- Attackers utilize the **Neo-reGeorg** tunneling toolkit via `tunnel.jsp` files to establish SOCKS5 proxies, allowing them to tunnel traffic into the internal network.
- Use of **MeshAgent** remote management software to maintain control over compromised Linux systems.
### Data Exfiltration/Impact
- Large-scale data theft; ShinyHunters claimed theft of 2TB–3TB of data in specific instances (e.g., FBIjobs.gov).
- Deployment of JSP web shells (`x.jsp`) for persistent command execution.
### Detection & Response
- **Discovery:** Identified by Google Mandiant and Threat Intelligence Group (GTIG) via analysis of exploitation patterns and WAF bypass techniques.
- **Response:** Security researchers advised organizations to move beyond WAF mitigations and apply official Oracle patches.
## Attack Methodology
- **Initial Access:** RCE via CVE-2026-35273 (Oracle PeopleSoft PSEMHUB).
- **Persistence:** JSP web shells (`x.jsp`) and MeshAgent remote management software.
- **Defense Evasion:** URL/Percent-encoding (e.g., `/%50SEMHUB/`) to bypass WAF rules looking for literal strings.
- **Discovery:** Initial POST requests with serialized Java objects to gather OS metadata.
- **Lateral Movement:** Neo-reGeorg toolkit for SOCKS5 tunneling.
- **Exfiltration:** Large-scale data theft from compromised PeopleSoft servers and connected internal environments.
- **Impact:** Unauthenticated RCE leading to full system compromise and data extortion.
## Impact Assessment
- **Financial:** High (Extortion-based threat actor).
- **Data Breach:** High; sensitive employee and applicant data stolen from multiple sectors.
- **Operational:** Deployment of unauthorized management tools and web shells on production servers.
- **Reputational:** Significant public impact, particularly concerning government and Fortune 500 targets.
## Indicators of Compromise
- **Network:**
- POST requests to `hxxps[://]<host>/%50SEMHUB/hub`
- POST requests to `hxxps[://]<host>/PSEMHUB/hub`
- **Files:**
- `x.jsp` (Web shell)
- `tunnel.jsp` / `tunnel.jspx` (Neo-reGeorg)
- `MeshAgent` binaries
- **Behavioral:**
- Presence of SOCKS5 proxy traffic tunneled over HTTP/HTTPS.
- Serialized Java objects sent to PSEMHUB endpoints from unknown external IPs.
## Response Actions
- **Containment:** Organizations advised to block all external access to PSEMHUB endpoints if patching is delayed.
- **Eradication:** Delete identified web shells and unauthorized remote management agents (MeshAgent).
- **Recovery:** Full restoration from clean backups if web shell deployment is confirmed.
## Lessons Learned
- **WAF Limitations:** WAFs are not a substitute for patching; literal string matching is easily bypassed by encoding (Percent-encoding, mixed-case).
- **Patch Prioritization:** Zero-day vulnerabilities in public-facing enterprise software (Oracle PeopleSoft) must be patched immediately rather than relying on temporary mitigations.
## Recommendations
- **Immediate Patching:** Apply the Oracle security update for CVE-2026-35273 immediately.
- **Log Review:** Audit Oracle WebLogic access logs for any variants of `/PSEMHUB/` or `/%50SEMHUB/`.
- **Hardening:** Disable the Environment Management Hub if it is not required for business operations.
- **Egress Filtering:** Restrict outbound traffic from web servers to prevent tunneling toolkits like Neo-reGeorg from communicating with C2 servers.