Official company update
September 2026 Cyberthreat Intel Report: ShinyHunters Hacked Clop, Then Went After the FBI
Publisher preview
On the night of September 18, the dark web produced something rare: one criminal group publicly extorting another. ShinyHunters broke into the Tor leak site Clop uses to shame its victims, replaced it with its own branding, and posted a ransom demand addressed to Clop. Clop is the group behind the MOVEit, GoAnywhere, and Oracle E-Business Suite mass-exploitation campaigns. It built its reputation on unpatched enterprise software. It lost its own site to unpatched software too. That story leads the September 2026 Cyber Threat Intelligence Report from Cynet’s CyOps team. Below is the short version, along with the rest of what security teams and MSPs should know from the month. The entry point was mundane. Clop’s leak site ran on Grav, a flat-file PHP content management system, and was still on version 1.7.43. ShinyHunters abused CVE-2026-42608 (CVSS 9.1), a path traversal flaw in Grav’s form upload handling that lets an unauthenticated attacker write files anywhere the web server can.
A saved ApplyDjinn digest is not available for this story yet.
This preview is supplied by the publisher. The complete publication remains at its original source.
Request a correction or removalApplyDjinn context
What else is visible for Cynet Security?
These are observations in our catalog around the company, not claims made by the article. A publication does not establish why hiring, search interest, or share prices moved.
Current roles
3
30-day current-market scope
Company stories · 30d
6
6 official · 0 independent
Attention records · 7d
0
0 Google · 0 Polymarket
Coverage mix
Attention sources
No matching record in this window.
Open roles
3
Technical roles
0 of 3
Observed hiring change
-10 roles
Hiring and market history
Daily vacancy snapshots show this company’s observed hiring; no standalone public ticker is assigned.
Vacancy history
Current role mix
0 technical · 3 other
0% of currently observed roles are technical.
Vacancy history uses saved daily snapshots through 2026-11-01. News counts are dated publications; attention counts are matched records, not search volume or prediction probabilities.