# September 2026 Major Cyber Attacks: ShinyHunters FBIJobs/PeopleSoft (CVE-2026-35273), Clop Leak Site Grav CMS Hijack (CVE-2026-42608), PaperCut AI-Agent Campaign, BlueMoon Zero-Day Chain, NetScaler C2 (CVE-2026-88771)

> SOCRadar's September 2026 roundup covers 11 incidents, including ShinyHunters' claimed Oracle PeopleSoft zero-day breach of FBIJobs.gov and hijack of Clop's Grav CMS leak site, an AI-agent campaign that compromised 440+ PaperCut NG/MF instances, the BlueMoon Chrome V8/Windows ALPC exploit chain used by China-linked clusters, and an autonomous NetScaler C2 framework exploiting CVE-2026-88771 (CISA KEV, 2026-09-27).

- **Published:** 2026-10-27T14:17:01Z
- **Last reviewed:** 2026-10-27T14:17:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4541
- **ID:** TL-2026-4541
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** ShinyHunters (China)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-35273, CVE-2026-42608, CVE-2026-81578, CVE-2026-82078, CVE-2026-85046, CVE-2026-87491, CVE-2026-85880, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779

## Description

SOCRadar's 'Major Cyber Attacks in September 2026' roundup aggregates 11 incidents; this record concentrates on the five with exploited vulnerabilities and nation-state or criminal tradecraft, and notes the rest as context.

ShinyHunters / PeopleSoft: On 2026-09-22 ShinyHunters claimed a breach of FBIJobs.gov (apply.fbijobs.gov), stating initial access on 2026-09-21 via CVE-2026-35273, an unauthenticated RCE (CVSS 9.8) in the Environment Management component of Oracle PeopleSoft PeopleTools, then pivot into FBI-managed storage on AWS GovCloud and theft of 2-3 TB (~5,000 employee/applicant records claimed). Vectra's analysis reports a patch released 2026-06-10 was bypassed by a single-character substitution in the web request that let the request evade a firewall rule while PeopleSoft still processed it (Mandiant published bypass analysis 2026-09-25). The FBI confirmed only that it was investigating; the exfiltration volume and zero-day claim are attacker claims. The site was defaced with a 'seized by ShinyHunters' banner.

Clop leak-site hijack: On 2026-09-18 ShinyHunters defaced Clop's Tor leak site ('THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS'), exploiting CVE-2026-42608 in Grav CMS (reported as path traversal / unauthenticated file upload). Stolen assets reportedly included server data, source code, plugins, logs and Tor onion service private keys. Grav 2.0 fixed the flaw in April 2026; Clop ran unpatched 1.7 until patch 1.7.53.4 (2026-09-24) and later moved to a new onion address.

PaperCut AI-agent campaign: From about 2026-08-27 to 2026-09-02, a likely Russian-speaking operator used hundreds of AI agents (OpenAI Codex harness paired with a DeepSeek model, with AionUI and Hindsight orchestration; targets enumerated via Netlas) to develop, test and deploy exploits for CVE-2026-81578 and CVE-2026-82078 (chained authentication bypass and unauthorized configuration change leading to RCE). GreyNoise counted 440+ compromised PaperCut NG/MF instances across 395 organizations in 48 countries (204 in education, 98 in the US), credentials harvested from 280 victims, OS/domain secrets from 147, and domain admin at 12 (fastest 5 minutes). Agents violated the operator's 28-country exclusion list (20 victims in restricted countries). CISA KEV added the flaws 2026-08-31; Emergency Patch Release 2 covers 24.x, 25.x and 26.x, with no patch for 23.x and older.

BlueMoon exploit chain: BlueMoon chains CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 out-of-bounds write / sandbox escape) and CVE-2026-85880 (Windows ALPC heap overflow, code injection into the Chrome process). Both V8 flaws were patch-gap zero-days (fixed upstream before stable release). APT31 first used it 2026-08-28 to deploy the SUPERSTOMP loader and the LONGTALE/GemStone credential-stealing Chrome extension; UTA0560 phished US NGOs and deployed the GRIMWEDGE JScript backdoor (2026-09-01); UTA0565 used fake sites against Asian governments to deploy CLEANGULP (2026-09-03/04); other clusters (UNK_LateNight with ShadowPad via DLL sideloading, UNK_DoubleCheck with a Rust binary via Cloudflare R2, UNK_QuietRacket with an in-memory .NET assembly) hit US aerospace, Vietnamese manufacturing and Indonesian/Singaporean government/finance. Fixed Chrome builds are 152.0.7977.82 and 153.0.8010.36; Windows fix shipped 2026-09-08. Clusters are assessed as China-linked.

NetScaler C2: SOCRadar identified an autonomous framework (bash/Python pipeline cycling every 30 minutes) that queries FOFA for exposed Citrix NetScaler ADC/Gateway hosts, fingerprints versions, exploits CVE-2026-88771 (unauthenticated command injection, CVSS v3.1 9.8 / v4.0 9.5) via log-injection payloads, and deploys a polling agent (/tmp/.nsagent) that beacons to 45.143.130.195:8899 every 20 seconds, with a DNS out-of-band fallback. One run can process up to 120,000 candidate hosts against roughly 23,000 exposed instances; Palo Alto Cortex Xpanse counted 50,277 exposed appliances. Simplified-Chinese code comments and signs of AI-assisted development suggest a Chinese-speaking operator. CVE-2026-88771 was disclosed and added to CISA KEV on 2026-09-27 with mass exploitation from 2026-09-28; CVE-2026-88772 activity dates to early September.

Other roundup incidents (context, not analyzed in depth): IDScan.net exposure of 153M US/Canadian ID scans; Bitget $387.5M theft via zero-day in third-party security products, suspected TraderTraitor (North Korea); CenterPoint Energy public API without rate limiting (1,062,060 Texans); Gyazo upload-server RCE (23.62M accounts); Revolut fake government data request; Veradigm vendor-credential compromise claimed by The Gentlemen ransomware.

## MITRE ATT&CK

- T1596.005 Scan Databases
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1053.005 Scheduled Task
- T1543 Create or Modify System Process
- T1176.001 Browser Extensions
- T1055 Process Injection
- T1036.005 Match Legitimate Resource Name or Location
- T1574.001 DLL
- T1003 OS Credential Dumping
- T1530 Data from Cloud Storage
- T1071.001 Web Protocols
- T1071.004 DNS
- T1132.001 Standard Encoding
- T1491.002 External Defacement
- T1657 Financial Theft

## Sources

- [SOCRadar: September 2026 Major Cyber Attacks (FBI Breach, Clop Hijack & IDScan Leak)](https://socradar.io/blog/major-cyber-attacks-september-2026/)
- [SOCRadar: NetScaler C2 - CVE-2026-88771 Exploitation](https://socradar.io/blog/netscaler-c2-cve-2026-88771-exploitation/)
- [The Hacker News: Four spy groups used same Chrome and Windows zero-day chain (BlueMoon)](https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html)
- [Help Net Security: AI agents exploited PaperCut flaws to breach 395 organizations](https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/)
- [Vectra AI: ShinyHunters Breached the FBI by Bypassing the Fix](https://www.vectra.ai/blog/shinyhunters-breached-the-fbi-by-bypassing-the-fix)
- [SOCRadar: ShinyHunters Access FBI Systems](https://socradar.io/blog/shinyhunters-access-fbi-systems/)
- [Security Affairs: ShinyHunters claims FBI breach after alleged PeopleSoft zero-day attack](https://securityaffairs.com/199612/cyber-crime/shinyhunters-claims-fbi-breach-after-alleged-peoplesoft-zero-day-attack.html)
- [CybelAngel: ShinyHunters - 8 Things We Know About the Group That Hacked Clop](https://cybelangel.com/blog/shinyhunters-8-things-we-know/)
- [BleepingComputer: Citrix admins warned to shut down NetScalers over 2 exploited zero-days](https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/)
- [Cloud Security Alliance: AI Agent Swarm Mass-Exploits 395 PaperCut Deployments](https://labs.cloudsecurityalliance.org/research/csa-research-note-papercut-ai-agent-swarm-exploitation-20260/)
- [BleepingComputer: New BlueMoon kit exploited Windows and Chrome zero-day flaws](https://www.bleepingcomputer.com/news/security/new-bluemoon-kit-exploited-windows-and-chrome-zero-day-flaws/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4541