September 2026 Cyber Roundup: FBI Breach Claim, Clop Hijack and Major Data Exposures
Summary
September 2026 coverage includes ShinyHunters’ FBI breach claim and Clop leak-site hijack, IDScan and other data exposures, Bitget’s reported $387.5 million theft, and campaigns exploiting PaperCut and Chrome/Windows flaws.
Key points
- ShinyHunters claimed an FBI intrusion using a purported PeopleSoft zero-day and said it took 2–3 TB of data. The FBI later cited a contractor’s missed patch; Oracle had not confirmed a new zero-day as of Oct. 27.
- IDScan confirmed unauthorized access to its VeriScan platform from April 4 to Sept. 2. Exposed data may include identity details and government-ID numbers; the company’s notice did not mention the license scans advertised by the linked Nexus service.
- ShinyHunters hijacked Clop’s leak site through a Grav path-traversal flaw, CVE-2026-42608. Clop confirmed the site compromise but said the server held only website content and denied contact with ShinyHunters.
- Bitget reported unauthorized wallet transfers totaling $387.5 million. North Korean links were suggested by the company’s CEO and blockchain analysts, but no government had attributed the attack as of Oct. 27.
- An AI-agent campaign exploited two disclosed PaperCut flaws across at least 395 organizations in 48 countries. Separately, the BlueMoon exploit kit chained three Chrome and Windows zero-days across at least four espionage clusters; governments had not attributed that activity.
- SOCRadar reported that NetScaler C2 can enumerate up to 120,000 candidate hosts per run and exploit CVE-2026-88771; the number of appliances it compromised remains unknown. Both discussed NetScaler flaws were under active attack.
- Other disclosures included CenterPoint’s confirmation that 1,062,060 Texans were affected, Gyazo’s exposure of about 23.62 million user records, Revolut’s disclosure of data to an impersonator, and Veradigm’s report of vendor-credential misuse alongside The Gentlemen’s unverified 3.5-million-record claim.
Article Details
- Event Type
- September 2026 roundup of cyberattacks, data breaches, ransomware-site compromise, cryptocurrency theft, and exploitation campaigns.
- Impact
- Incidents included a confirmed $387.5 million loss from Bitget wallets; confirmed customer and patient data exposures at IDScan.net, CenterPoint Energy, Gyazo, and Veradigm; and compromises affecting hundreds of organizations through PaperCut flaws. ShinyHunters claimed to have stolen about 5,000 FBI-related records, while the FBI later confirmed an intrusion but Oracle did not confirm the alleged PeopleSoft zero-day. A reported BlueMoon exploit chain reached multiple espionage clusters, and NetScaler exploitation led to web shells, credential theft, and lateral movement.
MITRE ATT&CK
T1078 · Valid AccountsAn unauthorized party used credentials from a third-party vendor's environment against a Veradigm API.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in internet-facing PaperCut servers, the Grav CMS behind Clop's leak site, and NetScaler appliances.T1505.003 · Web ShellNetScaler intrusions reportedly resulted in web shells.T1566 · PhishingUTA0560 reportedly phished US-based NGOs to deliver the GRIMWEDGE JScript backdoor.
CVE
CVE-2026-35273ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273, in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.CVE-2026-42608Clop moved its leak site to a new Tor address and confirmed the compromise came through a Grav path traversal flaw, CVE-2026-42608.CVE-2026-81578Running on OpenAI’s Codex harness with a DeepSeek model, the agents developed, tested, and used exploits for CVE-2026-81578 and CVE-2026-82078, drawing on public proof-of-concept (PoC) code and patched builds.CVE-2026-82078Running on OpenAI’s Codex harness with a DeepSeek model, the agents developed, tested, and used exploits for CVE-2026-81578 and CVE-2026-82078, drawing on public proof-of-concept (PoC) code and patched builds.CVE-2026-85046The chain starts with CVE-2026-85046, a V8 type confusion flaw for code execution, and CVE-2026-87491, a V8 out-of-bounds write that escapes the V8 sandbox.CVE-2026-85880CVE-2026-85880, a Windows Advanced Local Procedure Call (ALPC) heap overflow, then escapes the renderer sandbox and elevates privileges.CVE-2026-87491The chain starts with CVE-2026-85046, a V8 type confusion flaw for code execution, and CVE-2026-87491, a V8 out-of-bounds write that escapes the V8 sandbox.CVE-2026-88771CVE-2026-88771 (9.5 CVSS v4.0) lets unauthenticated attackers run arbitrary commands, even on default configurations.CVE-2026-88772CVE-2026-88772 (9.5 CVSS v4.0) is a memory overflow that can lead to RCE or denial of service on appliances with Datagram Transport Layer Security (DTLS) enabled, the default for VPN virtual servers.
People
Threat Actors
4d722e4d656f77A threat actor using this alias claimed to have taken 7.49 million CenterPoint Energy customer records; CenterPoint confirmed a theft but did not confirm the actor's claimed record count.APT31Reportedly the first observed user of the BlueMoon exploit chain and later installed the LONGTALE malicious browser extension. Researchers assess the involved clusters as China-linked; the BlueMoon activity itself had not been attributed by a government.ClopRansomware gang whose leak site was compromised by ShinyHunters; the article also refers to Clop's 2025 Oracle E-Business Suite campaign.IAmNotAVillainA group calling itself iamnotavillain later demanded 6,000 XMR in connection with the Revolut incident; Revolut said it received no direct demand.Jade SleetOne analysis linked the group to the Bitget theft, but no government had attributed the attack as of October 27, 2026.ShinyHuntersHijacked and defaced Clop's leak site, claiming to have stolen server data and private keys. The group also claimed responsibility for an FBI breach and about 5,000 records; the FBI later confirmed an intrusion, but the alleged PeopleSoft zero-day was not confirmed by Oracle.The GentlemenRansomware group that listed Veradigm on its leak site, claimed to hold 3.5 million patient records, and threatened publication unless Veradigm paid.UTA0560A cluster tracked by Volexity that reportedly phished US-based NGOs to deliver the GRIMWEDGE JScript backdoor.UTA0565A cluster that reportedly ran fake websites against Asian government entities to deliver CLEANGULP.
Malware
CLEANGULPand UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.GRIMWEDGEVolexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian governmentLONGTALEAPT31 was the first observed user, on August 28, 2026, and later installed the LONGTALE malicious browser extension.
Vendors
Amazon Web Services (AWS)The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set.BitgetSuspected North Korean Hackers Stole $387.5 Million From BitgetCenterPoint EnergyCenterPoint Energy Data Theft Reached More Than 1 Million TexansCitrixCitrix disclosed on September 27, 2026, that two critical NetScaler ADC and Gateway flaws were under attack.GoogleA single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.HelpfeelKyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes.IDScan.netIdentity verification provider IDScan.net confirmed that an unauthorized party accessed customer data in its cloud platform.MicrosoftA single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.OracleOn September 22, 2026,ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.PaperCutAI Agents Compromised 395 Organizations Through PaperCut FlawsRevolutRevolut Handed Customer Data to a Fake Government RequestVeradigmThe Gentlemen Claimed 3.5 Million Veradigm Patient Records
Products
Google ChromeOne actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days.GravOn September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it.GyazoGyazo Breach Exposed 23.62 Million User RecordsMicrosoft WindowsOne actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days.NetScaler ADCCitrix disclosed on September 27, 2026, that two critical NetScaler ADC and Gateway flaws were under attack.PaperCut NG/MFA likely Russian-speaking actor used hundreds of AI agents to build and run a global exploitation campaign against PaperCut NG/MF print management servers between August 27 and September 2, 2026.PeopleSoftOn September 22, 2026,ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants.VeriScanA September 29, 2026, update says the access ran from April 4 to September 2, 2026, and was limited to the VeriScan platform.
Tools
BlueMoonBlueMoon Zero-Day Chain Reached at Least Four Espionage ClustersCodexRunning on OpenAI’s Codex harness with a DeepSeek model, the agents developed, tested, and used exploits for CVE-2026-81578 and CVE-2026-82078, drawing on public proof-of-concept (PoC) code and patched builds.DeepSeekRunning on OpenAI’s Codex harness with a DeepSeek model, the agents developed, tested, and used exploits for CVE-2026-81578 and CVE-2026-82078, drawing on public proof-of-concept (PoC) code and patched builds.FOFAEach cycle pulls exposed hosts from FOFA, fingerprints their versions, exploits CVE-2026-88771, and deploys an agent that polls for operator commands.NetScaler C2 frameworkSOCRadar Found NetScaler C2 Hunting Up to 120,000 Hosts per Run
Countries
ChinaResearchers assess the clusters as China-linked, and a 2024 US indictment tied APT31 to China’s Ministry of State Security, though no government has attributed the BlueMoon activity itself.IndonesiaOther clusters targeted a US aerospace company, a Vietnamese manufacturer, and organizations in Indonesia and Singapore.JapanHelpfeel fixed the flaw by the next day and reported the breach to Japan’s Personal Information Protection Commission on September 15, 2026.North KoreaBitget’s CEO said the attack matched known North Korean patterns, and blockchain analysts linked the funds to wallets used to launder earlier North Korea-attributed heists, including the 2025 Bybit theft.SingaporeOther clusters targeted a US aerospace company, a Vietnamese manufacturer, and organizations in Indonesia and Singapore.United StatesOn September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026,
Industries
AerospaceOther clusters targeted a US aerospace company, a Vietnamese manufacturer, and organizations in Indonesia and Singapore.CryptocurrencyCryptocurrency exchange Bitget detected unauthorized transfers from a limited number of hot and warm wallets on September 24, 2026.EducationResearchers counted at least 440 compromised instances across 395 organizations in 48 countries, and 204 of those instances belonged to education.EnergyCenterPoint Energy Data Theft Reached More Than 1 Million TexansHealthcare technologyA US utility, a healthcare technology company, and a major fintech firm rounded out the month with disclosures involving sensitive customer and patient data.Identity verificationIdentity verification provider IDScan.net confirmed that an unauthorized party accessed customer data in its cloud platform.Law enforcementThe major cyber attacks of September 2026 hit federal law enforcement, a rival cybercrime gang, and the companies that verify identities.Non-governmental organizationsOn September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026,