One Encoded Character: How ShinyHunters Walked Back Through the PeopleSoft Door You Thought You Closed

SecTower Threat Advisory

In June we wrote about the ShinyHunters campaign against Oracle PeopleSoft, and the advice everyone gave, ourselves included, was clear: patch, and if you cannot patch immediately, block the vulnerable endpoint at your web application firewall. Many organizations did exactly the second thing. They added a WAF rule to block requests to the PeopleSoft Environment Management Hub, breathed out, and moved the patch to the next maintenance window.

ShinyHunters anticipated that. In late September, Mandiant disclosed a renewed mass-exploitation campaign that defeats those WAF rules with a change so small it fits in a single character. If your mitigation for the June vulnerability was a WAF rule rather than the patch, you should assume that rule is no longer protecting you, and you should read on.

The one-character bypass

The original exploit targeted the path /PSEMHUB/. Defenders wrote WAF and reverse-proxy rules to block any request containing that string. Reasonable, and for a few weeks, effective.

The attackers simply URL-encoded the first letter. They now request /%50SEMHUB/ instead of /PSEMHUB/. The encoded sequence %50 is just the letter P written in a form a browser or server decodes on the fly. Here is the catch that makes it work: most WAF and proxy rules inspect the raw request path before it is decoded, so they compare against the literal text /%50SEMHUB/ and see no match. The PeopleSoft application server, sitting behind them, decodes the path, recognizes /PSEMHUB/, and routes the request to the vulnerable component exactly as before. The filter and the application disagree about what the request says, and the attacker lives in that disagreement.

It is the oldest trick in the web-security book, and it worked at scale against production systems in 2026. The lesson is not that the defenders were careless. The lesson is that string-matching on a raw path is fragile by design, and that a determined actor will reach for the simplest evasion that works before anything exotic.

This is now a much broader campaign

The June wave was overwhelmingly aimed at colleges and universities. This one is not. Mandiant reports web shells deployed on dozens of systems worldwide across higher education, technology, IT services, healthcare, agriculture, transportation, and government. The same vulnerability, a wider net, and a target list that now looks like a cross-section of the economy rather than one sector.

If you discounted the June reporting because you are not a university, that reasoning no longer holds.

What they do once inside

The post-exploitation toolkit grew more capable and more deliberately evasive than what we saw in June.

The attackers now use two slim JSP web shells planted in the PeopleSoft web directory. The primary one accepts commands hex-encoded in the request body rather than in plain text, detects whether it is running on Windows or Linux, and reconstructs the Linux shell path from individual character codes specifically to dodge signature-based detection. The second shell handles uploading larger files in chunks, slipping past request-size limits. In load-balanced environments they deploy copies across nodes, so finding one web shell does not mean you have found them all.

Two details deserve particular attention from defenders.

First, they added a fileless execution mode. In this mode the attacker sends a request, the server runs the command, and the output comes straight back in the HTTP response. Nothing is written to disk. If your detection strategy for this campaign was built around spotting new files appearing in the PeopleSoft directory, which was sound advice in June, this method sails straight past it. The only reliable signal is a command shell being spawned by the web server's Java process, which requires process-level visibility on the host.

Second, on compromised Windows servers they deployed a multi-stage backdoor Mandiant tracks as SIDEEYE, delivered inside a trojanized installer disguised as a media player and signed with a legitimate Extended Validation certificate. A valid code-signing signature is exactly the kind of thing that buys an attacker trust and quiet. The certificate's revocation has been requested, but the technique is a reminder that a signature is not a clean bill of health. The backdoor steals browser and application credentials, manages files and processes, and opens an interactive reverse shell, communicating with its control server over raw network connections rather than ordinary web traffic.

They also staged open-source tunneling software to pivot deeper into victim networks, and continued using remote-management tooling pointed at domains built to look like Microsoft cloud services.

What SecTower recommends

The headline action is the same one it was in June, and the new campaign exists precisely because it was so often deferred.

Patch, and treat the WAF rule as a speed bump, not a fix. Apply Oracle's security alert for CVE-2026-35273. A path-blocking rule was always a stopgap, and this campaign proves it can be stepped over. If you are running a PeopleTools version with no patch available, the path forward is upgrading to a supported release.

If you must rely on perimeter blocking, block the decoded path, not the string. Configure your WAF or proxy to normalize and decode the request path before matching, and block on the result. Assume the attacker will try percent-encoding, mixed case, and other non-standard spellings of the same path, and make sure every variant collapses to the same blocked target. A rule that only knows the literal characters PSEMHUB is not enough.

Reduce the attack surface at the source. In multi-server deployments, disable the Environment Management Hub service. In single-server deployments, remove the hub application entirely, following Oracle's guidance. These are administrative, system-to-system components; restricting them does not disrupt normal end-user PeopleSoft sessions.

Hunt on the host, not just at the perimeter. Because of the fileless execution method, file-based detection alone will miss real intrusions. Watch for command shells spawned by the web server's Java process, especially ones that go on to run encoding, download, or network utilities. Scan the PeopleSoft web directories for unexpected script and executable files across every node behind a load balancer, not only the first host you check.

Assume compromise may predate your patch, and rotate credentials. Any credentials reachable from the PeopleSoft web tier, including database connection strings and integration credentials, should be rotated on hosts where you find evidence of a web shell. Prioritize systems where the web server runs with the highest privileges.

Prepare for extortion. This actor steals data and threatens to publish it unless paid. Hunt for large archive files and data-transfer activity leaving the PeopleSoft tier, watch database logs for bulk exports of HR, payroll, and records tables, and have your communications and legal response ready in case of contact.

How SecTower can help

Our detection engineering team has already updated our PeopleSoft content for this campaign. That includes detections that decode the request path before matching, so the encoded-bypass variant is caught rather than missed; host-based detections for the fileless execution method that file-monitoring alone overlooks; coverage for the new web shells, the SIDEEYE backdoor, and the tunneling tooling; and an indicator set refreshed with the September infrastructure, with provenance tracked against primary reporting.

If you run Oracle PeopleSoft, or depend on vendors who do, and you want help confirming whether a WAF rule left you exposed, hunting for intrusions that may predate your patch, or operationalizing detections for this renewed campaign, reach out to the SecTower team. In June the gap between disclosure and exploitation was the problem. This time the gap was between a mitigation and a real fix, and the attackers were waiting in it.

References

This advisory reflects the threat landscape as of publication. Indicators and guidance evolve; consult the linked primary sources for the latest details.