ShinyHunters expands PeopleSoft attacks with firewall bypass

Google's Mandiant and Threat Intelligence Group report a renewed ShinyHunters campaign exploiting an Oracle PeopleSoft flaw across several sectors. The attackers have placed web shells on dozens of systems globally, expanding beyond the academic institutions targeted in June. The attackers changed the request path by encoding one character, allowing traffic to pass firewall rules that look for the literal path while PeopleSoft still routes it to the vulnerable component. Google says some targeted organizations had blocked that path but had not patched the flaw. It recommends applying Oracle's security alert and restricting access to the administrative service.