Threat reportThreat IntelligenceTL-2026-4541

September 2026 Major Cyber Attacks: ShinyHunters FBIJobs/PeopleSoft (CVE-2026-35273), Clop Leak Site Grav CMS Hijack (CVE-2026-42608), PaperCut AI-Agent Campaign, BlueMoon Zero-Day Chain, NetScaler C2 (CVE-2026-88771)

criticalACTIVE

September 2026 Major Cyber Attacks (TL-2026-4541), also tracked as BlueMoon, is a critical-severity tracked intrusion set scored CVSS 9.5, first published 2026-10-27. It is attributed to ShinyHunters (China) with medium confidence, affects Citrix NetScaler ADC and Gateway, references 10 CVEs (CVE-2026-35273, CVE-2026-42608, CVE-2026-81578), maps to 20 MITRE ATT&CK techniques (T1003, T1036.005, T1053.005), and is covered by 9 detection rules and 22 indicators of compromise.

CVSS
9.5/10Critical
CVEs
10Referenced vulnerabilities
Techniques
20MITRE ATT&CK
Actors
4ShinyHunters
Detection rules
9SPL · KQL · Sigma
IOCs
22Indicators of compromise

Key facts for TL-2026-4541

Threat ID
TL-2026-4541
Also known as
BlueMoon, NetScaler C2, September 2026 Major Cyber Attacks
Severity
CRITICAL
CVSS
9.5 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
THREAT_INTEL
First published
Last reviewed
Attribution
ShinyHunters, APT31, UTA0560, UTA0565
Attribution confidence
MEDIUM
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government administration, education, aerospace, manufacturing, finance, non-profit organisation, technology, cryptocurrency
Target regions
North America, Europe, Asia, Global
Detection rules
9
Indicators of compromise
22

Malware and tooling in September 2026 Major Cyber Attacks

Malware and tooling: CLEANGULP, Clop, GRIMWEDGE, LONGTALE, SUPERSTOMP, ShadowPad, FOFA, OpenAI Codex harness with DeepSeek model, ShadowPad

How September 2026 Major Cyber Attacks works

SOCRadar's September 2026 roundup covers 11 incidents, including ShinyHunters' claimed Oracle PeopleSoft zero-day breach of FBIJobs.gov and hijack of Clop's Grav CMS leak site, an AI-agent campaign that compromised 440+ PaperCut NG/MF instances, the BlueMoon Chrome V8/Windows ALPC exploit chain used by China-linked clusters, and an autonomous NetScaler C2 framework exploiting CVE-2026-88771 (CISA KEV, 2026-09-27).

SOCRadar's 'Major Cyber Attacks in September 2026' roundup aggregates 11 incidents; this record concentrates on the five with exploited vulnerabilities and nation-state or criminal tradecraft, and notes the rest as context.

ShinyHunters / PeopleSoft: On 2026-09-22 ShinyHunters claimed a breach of FBIJobs.gov (apply.fbijobs.gov), stating initial access on 2026-09-21 via CVE-2026-35273, an unauthenticated RCE (CVSS 9.8) in the Environment Management component of Oracle PeopleSoft PeopleTools, then pivot into FBI-managed storage on AWS GovCloud and theft of 2-3 TB (~5,000 employee/applicant records claimed). Vectra's analysis reports a patch released 2026-06-10 was bypassed by a single-character substitution in the web request that let the request evade a firewall rule while PeopleSoft still processed it (Mandiant published bypass analysis 2026-09-25). The FBI confirmed only that it was investigating; the exfiltration volume and zero-day claim are attacker claims. The site was defaced with a 'seized by ShinyHunters' banner.

Clop leak-site hijack: On 2026-09-18 ShinyHunters defaced Clop's Tor leak site ('THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS'), exploiting CVE-2026-42608 in Grav CMS (reported as path traversal / unauthenticated file upload). Stolen assets reportedly included server data, source code, plugins, logs and Tor onion service private keys. Grav 2.0 fixed the flaw in April 2026; Clop ran unpatched 1.7 until patch 1.7.53.4 (2026-09-24) and later moved to a new onion address.

PaperCut AI-agent campaign: From about 2026-08-27 to 2026-09-02, a likely Russian-speaking operator used hundreds of AI agents (OpenAI Codex harness paired with a DeepSeek model, with AionUI and Hindsight orchestration; targets enumerated via Netlas) to develop, test and deploy exploits for CVE-2026-81578 and CVE-2026-82078 (chained authentication bypass and unauthorized configuration change leading to RCE). GreyNoise counted 440+ compromised PaperCut NG/MF instances across 395 organizations in 48 countries (204 in education, 98 in the US), credentials harvested from 280 victims, OS/domain secrets from 147, and domain admin at 12 (fastest 5 minutes). Agents violated the operator's 28-country exclusion list (20 victims in restricted countries). CISA KEV added the flaws 2026-08-31; Emergency Patch Release 2 covers 24.x, 25.x and 26.x, with no patch for 23.x and older.

BlueMoon exploit chain: BlueMoon chains CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 out-of-bounds write / sandbox escape) and CVE-2026-85880 (Windows ALPC heap overflow, code injection into the Chrome process). Both V8 flaws were patch-gap zero-days (fixed upstream before stable release). APT31 first used it 2026-08-28 to deploy the SUPERSTOMP loader and the LONGTALE/GemStone credential-stealing Chrome extension; UTA0560 phished US NGOs and deployed the GRIMWEDGE JScript backdoor (2026-09-01); UTA0565 used fake sites against Asian governments to deploy CLEANGULP (2026-09-03/04); other clusters (UNK_LateNight with ShadowPad via DLL sideloading, UNK_DoubleCheck with a Rust binary via Cloudflare R2, UNK_QuietRacket with an in-memory .NET assembly) hit US aerospace, Vietnamese manufacturing and Indonesian/Singaporean government/finance. Fixed Chrome builds are 152.0.7977.82 and 153.0.8010.36; Windows fix shipped 2026-09-08. Clusters are assessed as China-linked.

NetScaler C2: SOCRadar identified an autonomous framework (bash/Python pipeline cycling every 30 minutes) that queries FOFA for exposed Citrix NetScaler ADC/Gateway hosts, fingerprints versions, exploits CVE-2026-88771 (unauthenticated command injection, CVSS v3.1 9.8 / v4.0 9.5) via log-injection payloads, and deploys a polling agent (/tmp/.nsagent) that beacons to 45.143.130.195:8899 every 20 seconds, with a DNS out-of-band fallback. One run can process up to 120,000 candidate hosts against roughly 23,000 exposed instances; Palo Alto Cortex Xpanse counted 50,277 exposed appliances. Simplified-Chinese code comments and signs of AI-assisted development suggest a Chinese-speaking operator. CVE-2026-88771 was disclosed and added to CISA KEV on 2026-09-27 with mass exploitation from 2026-09-28; CVE-2026-88772 activity dates to early September.

Other roundup incidents (context, not analyzed in depth): IDScan.net exposure of 153M US/Canadian ID scans; Bitget $387.5M theft via zero-day in third-party security products, suspected TraderTraitor (North Korea); CenterPoint Energy public API without rate limiting (1,062,060 Texans); Gyazo upload-server RCE (23.62M accounts); Revolut fake government data request; Veradigm vendor-credential compromise claimed by The Gentlemen ransomware.

MITRE ATT&CK techniques used in TL-2026-4541

Credential Access

T1003 OS Credential Dumping

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1574.001 DLL

Persistence

T1053.005 Scheduled Task; T1176.001 Browser Extensions; T1543 Create or Modify System Process

Execution

T1059.004 Unix Shell; T1059.007 JavaScript; T1203 Exploitation for Client Execution

Command and Control

T1071.001 Web Protocols; T1071.004 DNS; T1132.001 Standard Encoding

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Impact

T1491.002 External Defacement; T1657 Financial Theft

Collection

T1530 Data from Cloud Storage

Reconnaissance

T1596.005 Scan Databases

Affected products and versions in September 2026 Major Cyber Attacks

  • Citrix — NetScaler ADC and Gateway
    Vulnerable versions: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; ADC FIPS before 14.1-73.37 FIPS; ADC FIPS/NDcPP before 13.1-37.279
    Fixed in: 14.1-73.37 and later (14.1-73.41 for SAML); 13.1-64.24 and later (13.1-64.28 for SAML); 13.1-37.279 and later (FIPS/NDcPP)
  • PaperCut — PaperCut NG/MF
    Vulnerable versions: 23.x and older (no patch); 24.x; 25.x; 26.x before Emergency Patch Release 2
    Fixed in: 24.x, 25.x, 26.x with Emergency Patch Release 2
  • Google — Chrome (V8)
    Vulnerable versions: versions before 152.0.7977.82 / 153.0.8010.36
    Fixed in: 152.0.7977.82; 153.0.8010.36
  • Microsoft — Windows (ALPC)
    Vulnerable versions: Windows builds before the 2026-09-08 security update
    Fixed in: 2026-09-08 Patch Tuesday update
  • Oracle — PeopleSoft Enterprise PeopleTools (Environment Management)
    Vulnerable versions: versions before the 2026-06-10 fix
    Fixed in: 2026-06-10 patch
  • Grav — Grav CMS
    Vulnerable versions: 1.7.x before 1.7.53.4
    Fixed in: 1.7.53.4; 2.0

Remediation for September 2026 Major Cyber Attacks

Patches

  • Citrix NetScaler 14.1-73.37 / 13.1-64.24 or later
  • PaperCut NG/MF Emergency Patch Release 2
  • Chrome 152.0.7977.82 / 153.0.8010.36; Windows September 8, 2026 update
  • Grav 1.7.53.4
  • Oracle PeopleSoft CVE-2026-35273 fix (released 2026-06-10)

Immediate actions

  • Upgrade NetScaler ADC/Gateway to 14.1-73.37+ or 13.1-64.24+ (14.1-73.41 / 13.1-64.28 for SAML appliances; 13.1-37.279+ FIPS/NDcPP) and hunt for /tmp/.nsagent and outbound traffic to 45.143.130.195
  • Apply PaperCut Emergency Patch Release 2 (24.x, 25.x, 26.x) and review PaperCut servers for unauthorized configuration changes and credential exposure
  • Update Chrome to 152.0.7977.82 / 153.0.8010.36 or later and apply the 2026-09-08 Windows security update
  • Apply Oracle PeopleSoft PeopleTools patch for CVE-2026-35273 and verify WAF rules normalize request variants
  • Upgrade Grav CMS to 1.7.53.4 or Grav 2.0

Workarounds

  • PaperCut 23.x and older have no patch: isolate or retire the servers
  • Block egress to known C2 and DNS out-of-band patterns from NetScaler appliances

Longer-term hardening

  • Remove management and authentication endpoints of edge appliances and print servers from direct internet exposure
  • Monitor for AI-agent-driven automated exploitation (burst exploitation, rapid credential harvesting) and rate-limit exploit-prone endpoints
  • Audit third-party and contractor patch compliance and vendor API credentials
  • Restrict Chrome extension installation via enterprise policy and monitor for sideloaded extensions

CVEs associated with September 2026 Major Cyber Attacks

CVE-2026-35273, CVE-2026-42608, CVE-2026-81578, CVE-2026-82078, CVE-2026-85046, CVE-2026-87491, CVE-2026-85880, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779

Timeline of September 2026 Major Cyber Attacks

  • Oracle releases a fix for PeopleSoft CVE-2026-35273; a request-variant bypass later defeats firewall rules protecting unpatched/partially mitigated hosts.
  • PaperCut publishes its advisory for CVE-2026-81578 and CVE-2026-82078; AI-agent exploitation campaign begins (GreyNoise dates broad activity from 2026-08-31).
  • APT31 makes first observed in-the-wild use of the BlueMoon Chrome V8 + Windows ALPC chain, deploying SUPERSTOMP and the LONGTALE/GemStone extension.
  • CISA adds the PaperCut NG/MF vulnerabilities to the KEV catalog.
  • UTA0560 uses BlueMoon against US NGOs to deploy the GRIMWEDGE JScript backdoor.
  • UTA0565 begins fake-website attacks on Asian governments deploying CLEANGULP; Chrome stable release fixes CVE-2026-85046.
  • Microsoft Patch Tuesday fixes the Windows ALPC flaw CVE-2026-85880 used in BlueMoon.
  • ShinyHunters defaces Clop's Grav CMS leak site via CVE-2026-42608 and issues a 72-hour ultimatum.
  • ShinyHunters claims initial access to FBIJobs infrastructure via PeopleSoft CVE-2026-35273.
  • ShinyHunters publicly claims the FBI breach (2-3 TB); FBIJobs.gov is defaced and taken offline; FBI confirms it is investigating.
  • Grav 1.7.53.4 released, patching CVE-2026-42608 for the 1.7 branch.
  • Citrix discloses CVE-2026-88771; CISA adds it to KEV the same day.
  • Mass exploitation of CVE-2026-88771 begins following the first public technical write-up.
  • SOCRadar identifies the autonomous NetScaler C2 framework in the wild.

Sources cited for September 2026 Major Cyber Attacks

Detection coverage for TL-2026-4541

As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4541 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
22 indicators of compromise · Red and above. Compare plans

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats