The Return of the ShinyHunters Campaign

The notorious data extortion group known as ShinyHunters has intensified its activities, finding a method to bypass security mitigations previously implemented against a critical zero-day vulnerability in Oracle's software. By circumventing these protections, the group has resumed exploitation of the flaw and significantly broadened its targeting scope to include a diverse array of global organizations.


Exploiting the PSEMHUB Vulnerability

In June 2026, researchers identified a Java deserialization vulnerability within the Oracle PeopleSoft Environment Management Hub (PSEMHUB) servlet. This flaw (CVE-2026-35273) allows attackers to achieve remote code execution (RCE) via web shell deployment or fileless command execution. Oracle PeopleSoft is widely utilized by governments, large corporations, and educational institutions to manage critical business operations such as human resources and finance.

The vulnerability, which carries a critical severity score of 9.8/10, was initially exploited to target higher education facilities for data theft and extortion. While Oracle released a patch on June 10, 2026, many organizations initially relied on temporary mitigation measures instead of full updates.


WAF Bypass Tactics

According to reports from Mandiant and Google’s Threat Intelligence Group (GTIG), the threat actor—tracked as UNC6240—has evolved its tactics to defeat existing Web Application Firewall (WAF) rules. These rules were designed to block access to the vulnerable PSEMHUB endpoint.

"The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/," researchers noted. This technique exploits a discrepancy between how WAFs and application servers process paths. Because the WAF often checks the literal string before decoding, but the application server decodes the request before routing it, the malicious traffic successfully reaches the vulnerable servlet.


Broadening the Scope and Recommended Actions

While the initial campaign focused on the education sector, current intelligence indicates the group is now targeting dozens of systems globally, spanning industries such as agriculture, IT services, healthcare, transportation, and government sectors. To secure their environments, security experts recommend several critical steps:

  • Apply Official Patches: The original security update remains effective. Organizations are strongly advised to apply the patch for CVE-2026-35273 immediately, as it addresses the underlying flaw regardless of WAF bypasses.
  • Service Hardening: Disable the Environment Management Hub (EMHub) service in multi-server configurations or remove the PSEMHUB application entirely in single-server environments.
  • Forensic Investigation: Search WebLogic access logs for requests to /PSEMHUB/ or any percent-encoded variants. Inspect application directories for unauthorized files that may indicate a web shell.
  • Credential Hygiene: Rotate all credentials accessible to the PeopleSoft application service account and monitor outbound network traffic for suspicious activity.