The FBI Says a Contractor Missed One Patch. ShinyHunters Is Still Walking Through That Door, Now Spelled /%50SEMHUB/. We Built a Trap for It Today.
Two weeks ago we scored ShinyHunters' 2026 claims and found that 13 of 14 break-ins held up while almost everything else they said did not. Since then the FBI has said how the group got into its jobs portal, arrested another suspect, and watched the group keep exploiting the same PeopleSoft flaw with a small trick that slips past the most common stopgap. Here is what changed, what is confirmed versus only reported, and what we did about our own blind spot this morning.
How they got into the FBI
ShinyHunters claimed in September that it had breached the FBI's jobs portal and taken data on nearly all FBI agents and applicants. On October 6 the FBI said the breach happened on a platform run by an outside organization, because a contractor failed to apply a security patch that had been issued specifically for that platform. The FBI removed the contractor. A Reuters analysis of a data sample found extensive personal information, including details of sensitive roles and medical and psychiatric records.
The FBI did not name the platform or the company. Two Reuters sources said they were Oracle PeopleSoft and Accenture. That fits ShinyHunters' own claim that it used CVE-2026-35273, the PeopleSoft Environment Management Hub flaw it has exploited since late May, the one we told everyone to patch in June.
The arrests, separated into what is confirmed and what is not
Confirmed: Dutch police arrested a 24-year-old in Amsterdam on September 15, whom the FBI calls an alleged leader. On October 9 FBI Director Kash Patel announced the arrest of "another suspected co-conspirator." The FBI says the group has breached more than 140 organizations and collected at least $70 million in extortion payments.
Reported, not confirmed: according to the New York Times and CBS, the October 9 suspect is a Canadian citizen arrested in Pennsylvania. KrebsOnSecurity, working from court records, identified a 54-year-old former managing director of a ransomware-negotiation firm, charged with conspiracy to extort and interference with commerce by threats. The complaint is sealed, the FBI has not confirmed the identity, and no evidence linking that person to ShinyHunters has been made public. Reuters sources also describe a teenage suspect arrested in Jordan around September 29 who is cooperating. We are not naming individuals the FBI has not named, and we will update this post when charges are public.
None of this has slowed the group. The FBI itself says other suspected members remain free.
The trick: one letter, percent-encoded
Organizations that could not patch were told to block the vulnerable PSEMHUB endpoint at their web application firewall. ShinyHunters adapted. Instead of requesting /PSEMHUB/, it requests /%50SEMHUB/, where %50 is the encoded form of the letter P. Many firewalls and reverse proxies compare the literal request path before decoding it, so a rule written for /PSEMHUB/ never fires. Oracle WebLogic decodes the path and routes the request to the vulnerable endpoint anyway. Google's Mandiant and Threat Intelligence Group, which track this campaign as UNC6240, report web shells on dozens of systems across higher education, technology, healthcare, transportation and government.
The firewall rule was always a stopgap. A server with Oracle's June patch applied is not exposed through this trick.
What to do
Patch PeopleSoft for CVE-2026-35273 if you have not. Where you can, disable the Environment Management Hub service, or remove the PSEMHUB application on single-server installs.
Then hunt, because a blocked-looking log does not mean nothing got through. Search your web server and WebLogic logs for both /PSEMHUB/ and %50SEMHUB, and for other encoded spellings of the path. Look for unexpected JSP or executable files in PeopleSoft directories. If any server answered those requests, rotate every credential it could reach. And check your firewall rules for the same blind spot on other paths: a rule that matches before decoding can be walked around the same way.
What our data shows, and the trap we built today
Our feed carries 29 indicators attributed to ShinyHunters. Twenty-one come from one third-party feed, and only three are our own observations, including the PeopleSoft-campaign infrastructure we checked by DNS on October 8. The recent news, from the arrests to the FBI breach to the bypass, published no new network indicators.
We also checked our own edge for the attack itself. Since September 1, across 22,348 edge blocks, 51,071 decoy hits and 1,487 origin requests, we saw zero PeopleSoft-shaped probes. That zero tells you nothing, because we do not run PeopleSoft and had no decoy for it, so a scanner hunting PeopleSoft had no reason to linger on us.
So this morning we shipped Edge Shield 2.8.0. Our edge now answers /PSEMHUB/, /PSIGW/ and the PeopleSoft portal paths /psp/ and /psc/ with a decoy sign-in page. It matches both the raw and the decoded path, so the /%50SEMHUB/ spelling lands in the trap too, and encoded hits are flagged separately so we can measure the bypass variant on its own. Anything that probes it becomes an indicator in our feed with the product tagged. We will report what it catches, including if it catches nothing.
One bookkeeping fix: Google's name for this campaign, UNC6240, was not in our ShinyHunters profile, which only listed the older UNC6040. It is now, so a search under either name finds the same actor.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=shinyhunters-fbi-missed-patch-psemhub-encoded-waf-bypass-trap
Comments