On the night of September 18, the dark web produced something rare: one criminal group publicly extorting another. ShinyHunters broke into the Tor leak site Clop uses to shame its victims, replaced it with its own branding, and posted a ransom demand addressed to Clop.

Clop is the group behind the MOVEit, GoAnywhere, and Oracle E-Business Suite mass-exploitation campaigns. It built its reputation on unpatched enterprise software. It lost its own site to unpatched software too.

That story leads the September 2026 Cyber Threat Intelligence Report from Cynet’s CyOps team. Below is the short version, along with the rest of what security teams and MSPs should know from the month.

How ShinyHunters Got Into Clop’s Leak Site

The entry point was mundane. Clop’s leak site ran on Grav, a flat-file PHP content management system, and was still on version 1.7.43. ShinyHunters abused CVE-2026-42608 (CVSS 9.1), a path traversal flaw in Grav’s form upload handling that lets an unauthenticated attacker write files anywhere the web server can.

Grav had fixed the bug in its 2.0 branch back in April but left the 1.7 branch exposed. Their first move was a small text file uploaded to Clop’s server: “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES.” BleepingComputer confirmed the file was being served from Clop’s infrastructure. Hours later the whole site was defaced. Grav backported a fix to 1.7.53.4 on September 24, so any organization still running Grav 1.7 should patch now. The exploit path is public.

ShinyHunters then did to Clop what Clop does to everyone else. A “Note to Cl0p” listing demanded an eight-figure payment with a 72-hour deadline, a public apology, and a threat to publish which companies quietly paid Clop during its Oracle E-Business Suite campaign, how much, and to which Bitcoin addresses.

The feud dates back to October 2025, when Clop mass-exploited Oracle E-Business Suite, including the zero-day CVE-2025-61882. ShinyHunters claims that exploit was originally theirs.

The ending was quieter than the opening act promised. Clop moved to a new onion address, told BleepingComputer the hijacked server “contained nothing but content,” and then its listing vanished from ShinyHunters’ site without explanation. As of September 28, no list of Clop’s paying victims had been published.

ShinyHunters Picked a Bigger Fight

By the time Clop’s listing disappeared, ShinyHunters had moved on to the FBI. On September 21, the Bureau’s recruiting portal, apply.fbijobs.gov, was defaced with the same Umbreon ASCII art used on Clop’s site and a headline reading “THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS.”

The group claims it used an Oracle PeopleSoft zero-day to get in, then moved into FBI-managed AWS GovCloud infrastructure and took 2 to 3 TB of data covering agents and applicants, including medical and drug-test records. Some outlets tie the breach to CVE-2026-35273, a PeopleSoft flaw ShinyHunters already used against more than 100 organizations, mostly universities, between May 27 and June 9. The group insists it is a new bug. No public technical evidence settles which.

The FBI has confirmed an investigation, not a breach of its core systems, and says it is working with the third-party providers behind the jobs portal. Partial samples have been verified by 404 Media and Reuters. ShinyHunters’ stated motive is a May FBI public service announcement about the group, which it gave the Bureau one week to “correct or simply REMOVE.”

Cynet has tracked ShinyHunters for years, from the Ticketmaster and Santander breaches to ShinySp1d3r. This month makes one point plainly: data handed to a ransomware gang never becomes safe. As Dark Reading put it, Clop’s victims now have to wonder who else holds their records. A gang’s negotiation files are one breach away from someone else’s leak site.

The Rest of September’s Headlines

Most of the month’s major incidents came down to one exposed credential or one unprotected API.

• ShinyHunters also hit Florida’s DMV. Florida confirmed its DAVID driver database was breached using credentials belonging to a single Plant City Police Department user, stored on a personal device. ShinyHunters claimed more than 200,000 records.
• CenterPoint Energy confirmed customer data theft. An attacker claimed 7.49 million records, pulled by iterating through IDs on a public API that allegedly had no rate limiting or WAF in front of it.
• Brevo’s CDN pushed ClickFix lures to customer sites. A hardcoded Cloudflare API key with full account permissions let attackers rewrite Brevo forms, widgets, and SDK loaders at the edge on September 14. Sansec estimated up to 100,000 sites were affected. We covered how ClickFix keeps evolving in ClickFix Reloaded.
• Microsoft disrupted EvilTokens. The device-code phishing service compromised more than 12,000 Microsoft inboxes across over 10,000 organizations, bypassing MFA by abusing the legitimate OAuth device flow. Two suspected administrators were arrested in the UK.
• Australia arrested two alleged TeamPCP members. The group is tied to supply-chain attacks on Trivy, LiteLLM, and other developer tools, more than 1,000 compromised organizations, and roughly 500,000 stolen credentials.
• Veradigm disclosed a patient data breach after attackers used a vendor’s stolen credentials against a customer-service API. The Gentlemen ransomware group claimed 3.5 million records.

Ransomware: 789 Victims, The Gentlemen on Top

Ransomware groups claimed 789 victims in September. The Gentlemen led with 102, well ahead of Qilin at 74 and Storm at 37. The United States was the most targeted country and manufacturing the most targeted sector.

Vulnerabilities: An F5 Zero-Day and Two MSP Tools

The CyOps team reviewed nine critical and high-severity CVEs this month, including a perfect 10.0 in SonicWall SMA1000 and another in Adobe Commerce. MSPs should look first at N-central (CVE-2026-86218, pre-auth RCE, 9.8) and ScreenConnect (CVE-2026-84869, 9.9). Remote management tools give an attacker reach into every client environment at once.

This month’s spotlight is CVE-2026-94127 [EDITOR: link to F5 topic blog], a heap overflow in F5 BIG-IP APM that attackers exploited before a patch existed. CISA added it to the KEV catalog, and more than 14,000 devices were exposed at disclosure.

Three New Malware Families

• Majinahanashi Ransomware. A Japanese-branded locker with Russian-style rules: it exits on machines in CIS countries and hasn’t posted a single victim in the US, UK, Canada, or Australia. Its standout trick is throttling security agents off the network while leaving them running and looking healthy. [EDITOR: link to Majinahanashi topic blog]
• Kynix (Nexar) Stealer. Open-source code on GitHub, a Chrome App-Bound Encryption bypass, and exfiltration through Discord webhooks and Gofile. [EDITOR: link to Kynix topic blog]
• Zawoo Ransomware. A double-extortion operation that surfaced in late August and has claimed 22 victims, half of them German companies. It kills Office, database, and backup processes before encrypting so nothing is left locked.

Get the Full Report

The September 2026 CTI Report includes full static and dynamic analysis of all three malware families, MITRE ATT&CK mappings, patch details for every CVE reviewed, and how Cynet detects and prevents each threat. Missed last month? Read our August 2026 recap.