The dark web witnessed an unusual confrontation on the night of September 18, when one cybercriminal organization publicly attempted to extort another. ShinyHunters gained unauthorized access to the Tor-based leak website operated by Clop, a ransomware group known for publicly exposing its victims. The attackers replaced the website’s original content with ShinyHunters branding and published a ransom demand directed at Clop.
Clop previously carried out widespread exploitation campaigns involving MOVEit, GoAnywhere, and Oracle E-Business Suite. The group established its reputation by exploiting vulnerabilities in enterprise applications that organizations had failed to patch. Ironically, an unpatched software vulnerability also enabled the compromise of Clop’s own infrastructure.
This incident is the leading story in Cynet’s CyOps team’s September 2026 Cyber Threat Intelligence Report. The following overview covers the incident and other significant developments from September relevant to cybersecurity teams and managed service providers (MSPs).
How ShinyHunters Compromised Clop’s Leak Website
The initial access vector was relatively straightforward. Clop’s website relied on Grav, a flat-file content management system developed in PHP, and continued operating on version 1.7.43. ShinyHunters exploited CVE-2026-42608, a path traversal vulnerability affecting Grav’s file-upload processing functionality. Rated 9.1 on the CVSS scale, the flaw allows an unauthenticated attacker to write files to arbitrary locations accessible to the web server.
Although Grav addressed the vulnerability in its 2.0 software branch in April, the older 1.7 branch remained vulnerable. ShinyHunters initially demonstrated access by uploading a small text file to Clop’s server containing the message: “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES.” BleepingComputer verified that the file was accessible through Clop’s infrastructure. Several hours afterward, the attackers replaced the content of the entire website. On September 24, Grav released version 1.7.53.4, which backported the security fix to the affected branch. Organizations continuing to use Grav 1.7 should apply this update immediately, particularly because the exploitation method is publicly available.
After compromising the website, ShinyHunters employed the same extortion tactics commonly associated with Clop. The attackers created a listing titled “Note to Cl0p” and demanded a ransom amount in the eight-figure range, with payment required within 72 hours. They also demanded a public apology. In addition, ShinyHunters threatened to disclose the identities of organizations that had privately paid Clop following its Oracle E-Business Suite exploitation campaign. The threatened disclosure included individual payment amounts and the Bitcoin addresses used for those transactions.
The conflict reportedly originated in October 2025, following Clop’s large-scale attacks against Oracle E-Business Suite installations. Those attacks involved the exploitation of CVE-2025-61882, which was a zero-day vulnerability at the time. ShinyHunters maintains that the exploit originally belonged to its operators.
Despite the aggressive demands, the confrontation ended without the anticipated public disclosure. Clop relocated its operation to another onion address and informed BleepingComputer that the compromised server “contained nothing but content.” Subsequently, the listing targeting Clop disappeared from ShinyHunters’ website without any explanation. By September 28, the threatened database identifying organizations that had paid Clop remained unpublished.
ShinyHunters Escalates Its Campaign Against the FBI
While the listing concerning Clop was disappearing, ShinyHunters had already shifted its attention to a considerably more prominent target: the Federal Bureau of Investigation (FBI). On September 21, the FBI recruitment website, apply.fbijobs.gov, was defaced. The compromised page displayed the same Umbreon ASCII artwork previously observed on Clop’s website, accompanied by the statement “THIS SITE HAS BEEN SEIZED BY SHINYHUNTERS.”
ShinyHunters alleges that the intrusion began with the exploitation of a previously unknown vulnerability in Oracle PeopleSoft. According to the group, the attackers subsequently gained access to FBI-managed infrastructure hosted in AWS GovCloud and extracted between 2 and 3 TB of information. The allegedly stolen records concern FBI personnel and job applicants and reportedly include medical information and drug-testing results. Certain media reports associate the incident with CVE-2026-35273, a PeopleSoft vulnerability previously exploited by ShinyHunters against more than 100 organizations, primarily universities, between May 27 and June 9. However, the group insists that this intrusion involved a different, previously undisclosed vulnerability. Publicly available technical evidence has not established which explanation is accurate.
The FBI confirmed that an investigation was underway but did not acknowledge a compromise of its core systems. The Bureau also stated that it was cooperating with the third-party service providers responsible for the recruitment portal. Journalists from 404 Media and Reuters independently authenticated portions of the leaked samples. ShinyHunters attributed its actions to an FBI public service announcement issued about the group in May. The attackers demanded that the Bureau either amend or remove the announcement within one week.
ShinyHunters has been monitored by Cynet over several years, including activity associated with the Ticketmaster and Santander data breaches and the ShinySp1d3r operation. The September developments highlight an important consequence of ransomware-related data theft: information surrendered to an extortion group cannot be considered permanently secure. As Dark Reading highlighted, organizations previously targeted by Clop now face additional uncertainty over who may possess their confidential information. Files containing extortion negotiations and payment records can become the subject of another data leak if the criminal group storing them is compromised.
Other Significant Cybersecurity Incidents in September
A recurring factor across several major incidents during September was the exploitation of a single compromised credential or an inadequately protected application programming interface (API).
- ShinyHunters also compromised Florida’s DMV database. Florida authorities confirmed unauthorized access to the Driver and Vehicle Information Database (DAVID). The intrusion involved credentials belonging to one employee of the Plant City Police Department, which had been stored on a personal device. ShinyHunters claimed to have obtained more than 200,000 records.
- CenterPoint Energy acknowledged the theft of customer information. The company confirmed a data security incident after an attacker claimed to have extracted 7.49 million records. The reported method involved systematically changing identifiers in a publicly accessible API. According to the allegations, the endpoint lacked rate limiting and protection from a web application firewall (WAF).
- A compromise of Brevo’s CDN delivered ClickFix content through customer websites. On September 14, attackers exploited a hardcoded Cloudflare API key that provided unrestricted account-level permissions. This access allowed them to modify Brevo forms, embedded widgets, and SDK loading components at the network edge, distributing malicious ClickFix prompts to websites using those resources. Security company Sansec estimated that as many as 100,000 websites could have been affected. The continuing evolution of this technique is examined in Cynet’s ClickFix Reloaded analysis.
- Microsoft dismantled the EvilTokens phishing operation. The disrupted service specialized in device-code phishing and had compromised more than 12,000 Microsoft email accounts across over 10,000 organizations. EvilTokens exploited the legitimate OAuth device authorization process to circumvent multifactor authentication (MFA). British law enforcement also arrested two individuals suspected of administering the service.
- Australian authorities detained two suspected members of TeamPCP. The arrests concerned a group associated with software supply-chain compromises affecting Trivy, LiteLLM, and additional developer tools. The operation has been linked to more than 1,000 compromised organizations and the theft of approximately 500,000 credentials.
- Veradigm reported unauthorized access to patient information. According to the company’s disclosure, attackers used credentials stolen from a vendor to access a customer-support API. The Gentlemen ransomware operation claimed responsibility for stealing approximately 3.5 million records.
September Ransomware Activity: 789 Reported Victims, Led by The Gentlemen
Ransomware operations publicly claimed a total of 789 victims throughout September. The Gentlemen was the most active group, accounting for 102 reported victims. Qilin ranked second with 74, followed by Storm with 37. Geographically, the United States recorded the highest concentration of ransomware victims. Manufacturing was the industry most frequently targeted during the reporting period.
Critical Vulnerabilities: F5 Zero-Day Exploitation and Risks to MSP Platforms
During September, Cynet’s CyOps analysts examined nine vulnerabilities classified as high or critical severity. The reviewed issues included two vulnerabilities with the maximum CVSS score of 10.0, affecting SonicWall SMA1000 and Adobe Commerce.
Two other vulnerabilities are particularly important for managed service providers: CVE-2026-86218 in N-central, an unauthenticated remote code execution vulnerability with a CVSS score of 9.8, and CVE-2026-84869 in ScreenConnect, rated 9.9. Compromising a remote administration platform can allow threat actors to extend their access across multiple customer environments through a single management system.
The vulnerability receiving particular attention in September was CVE-2026-94127, a heap overflow affecting F5 BIG-IP APM. Threat actors exploited the weakness as a zero-day, before a security update became available. The Cybersecurity and Infrastructure Security Agency (CISA) subsequently included it in its Known Exploited Vulnerabilities (KEV) catalog. At the time of public disclosure, more than 14,000 potentially exposed devices were identified.
Three Emerging Malware Threats
- Majinahanashi Ransomware. This ransomware family presents itself with Japanese branding but follows operational restrictions commonly associated with Russian-speaking cybercriminal groups. It terminates execution on systems located in Commonwealth of Independent States (CIS) countries. No victims in the United States, United Kingdom, Canada, or Australia have appeared on its leak site. A particularly distinctive capability involves restricting security agents’ network connectivity without stopping their processes. Consequently, affected security tools may continue running and appear operational despite losing communication with their management infrastructure.
- Kynix (Nexar) Stealer. This information-stealing malware has publicly available source code hosted on GitHub. Its capabilities include bypassing Google Chrome’s App-Bound Encryption protections and transferring stolen information through Discord webhooks and the Gofile file-sharing service.
- Zawoo Ransomware. Emerging in late August, Zawoo operates according to a double-extortion model. The group has claimed 22 victims, approximately half of which are organizations based in Germany. Before encrypting data, the malware terminates processes associated with Microsoft Office, databases, and backup applications. This preparation prevents active processes from maintaining file locks that could interfere with encryption.
