I am not sure about this exploit but what can be done is you can send a Class type over the wire. It contains Java bytecode and when de-serialized it will use

I am not sure about this exploit but what can be done is you can send a Class type over the wire. It contains Java bytecode and when de-serialized it will use some ClassLoader to construct the Class instance. While doing that the static intializer of that class will be executed. This probably is not what is going on here but is a possibility.