The Fraud Scheme & Investigation Details

The notorious ShinyHunters extortion gang has resurfaced, employing a sophisticated technique to bypass security measures protecting vulnerable Oracle PeopleSoft systems. By exploiting a known vulnerability, CVE-2026-35273, which allows for unauthenticated remote code execution, ShinyHunters is now circumventing Web Application Firewalls (WAFs) that were put in place to block access to the affected PSEMHUB endpoint. This WAF bypass is achieved through URL encoding, specifically by replacing the letter 'P' in '/PSEMHUB/' with its percent-encoded equivalent '%50'. Many WAFs fail to decode these encoded characters before applying their rules, allowing the malicious request to reach the vulnerable PeopleSoft component. This tactic enables ShinyHunters to continue their widespread exploitation of unpatched systems, leading to significant data theft and the deployment of advanced malware.

Scope of Victims & Financial Losses

  • The renewed exploitation campaign has led to the compromise of dozens of systems globally across various sectors, including higher education, technology, IT services, healthcare, agriculture, transportation, and government.
  • On compromised Windows servers, ShinyHunters deploys the SIDEEYE malware, which is capable of stealing credentials, managing files and processes, establishing reverse shells, and enabling reverse proxy functionality.
  • The attackers also utilize the Neo-reGeorg tunneling toolkit to establish SOCKS5 proxies, allowing them to move laterally within compromised internal networks.
  • In some instances, ShinyHunters has been observed using legitimate remote management software like MeshAgent to maintain persistent access to compromised Linux systems.
  • While specific financial losses are not detailed, the group's history of data theft and extortion suggests significant potential for financial and reputational damage to affected organizations.

Key Takeaways & Prevention

The ongoing exploitation of Oracle PeopleSoft by ShinyHunters underscores the critical importance of timely security patching. Relying solely on WAFs for protection against known vulnerabilities is insufficient, as demonstrated by the group's ability to bypass these defenses. Organizations running Oracle PeopleSoft must prioritize the immediate application of security updates provided by Oracle to address CVE-2026-35273. Furthermore, it is crucial to monitor WebLogic access logs for any signs of exploitation, including requests to '/PSEMHUB/' and its encoded variants like '/%50SEMHUB/'. Proactive security hygiene, including regular vulnerability scanning and prompt patching, remains the most effective defense against such persistent threats.