Threat Intel Report - September 2026

Executive summary

September 2026 was characterized by a combination of ransomware activity, exploitation of internet-facing vulnerabilities, supply-chain compromise, data breaches, credential and session abuse, and politically motivated distributed denial-of-service (DDoS) campaigns. The landscape showed continued convergence between financially motivated cybercrime, hacktivism, and targeted data exploitation, with organizations across government, finance, technology, healthcare, education, and critical infrastructure remaining exposed.

The global threat overview identified government, finance, technology, education, and NGOs among the most targeted sectors. The leading risk categories were ransomware, vulnerability exploitation, data breach, phishing, and supply-chain compromise. Qilin, Akira, TheGentlemen, Storm, and Krybit were among the most active malware families observed.

The vulnerability landscape remained equally concerning. September included actively exploited vulnerabilities affecting Check Point Management Server, Citrix NetScaler, Cisco Secure Email Gateway, FortiMail, GitLab, Microsoft Exchange Server, Node.js ecosystem components, and other enterprise technologies. Of particular concern were flaws enabling unauthenticated remote access, arbitrary command execution, privilege escalation, session hijacking, and security-control bypass.

The overall threat assessment for September is HIGH.

Notable campaigns and events

ShinyHunters claims an FBI intrusion

The extortion group ShinyHunters claimed to have compromised US Federal Bureau of Investigation systems and accessed sensitive information about FBI personnel and job applicants. It claimed access to Criminal Justice, Human Resources, and Medlink services and alleged it holds data on nearly all FBI agents and job applicants. To support the claim, it reportedly defaced a subdomain of the FBI's jobs website with a message saying the site had been seized, and later the page showed a maintenance notice. The group claimed 2 to 3 TB of data and provided a sample allegedly containing personal information of about 5,000 FBI employees. The authenticity and origin of the full dataset had not been independently confirmed, although reports indicated parts of the sample appeared authentic.

Attack technique: ShinyHunters claimed it gained access by exploiting a zero-day in Oracle PeopleSoft and then reached multiple FBI services. It used the alleged stolen data as leverage, threatening disclosure and demanding that the FBI retract or correct an earlier threat report about the group.

Gyazo data breach

Gyazo, the image-sharing service operated by Japanese software company Helpfeel, disclosed a major breach attributed to ShinyHunters' recent victims. Attackers exploited a vulnerability in the image upload server to gain access and run malicious commands. The intrusion was identified on September 11, 2026 and access was blocked the next day. It exposed a database of about 23.62 million user records, including names or nicknames, email addresses, password hashes, user, device, and session IDs, X integration tokens, Google SSO email addresses, profile information, and subscription and billing status. About 490 million image metadata records were also exposed, mostly for images uploaded in or before January 2019, and metadata from a further 2.4 million images was accessed through specific searches. Metadata may include upload IP addresses, user agents, EXIF location data, OCR text, and hashed passphrases for private images, some of which could help reconstruct image URLs and access images without authorization.

Helpfeel said payment card information was not exposed, that it blocked the access routes and fixed the vulnerability, and that the investigation was ongoing. Users were advised to change passwords, especially where reused, and to watch for phishing. Public disclosure came on September 16, 2026, about five days after the attack.

Brevo supply-chain attack

Attackers compromised a long-lived, full-privilege Cloudflare API key that had been hardcoded in Brevo's application source code. They created a malicious Cloudflare Worker that modified Brevo-hosted JavaScript for Forms, Conversations, and SDK components, potentially affecting more than 100,000 websites. Visitors were redirected to fake Cloudflare verification pages that used the ClickFix technique to trick them into running malicious commands. On WordPress sites, the attack also tried to install a disguised "Web Media Optimizer" plugin capable of persistence, JavaScript injection, and administrator session generation, targeting logged-in administrators. Brevo stated that its core application, APIs, email infrastructure, and customer data were unaffected.

RipperSec DDoS campaign against Israel Cart

A coordinated DDoS campaign hit Israel Cart, an Israeli e-commerce platform, attributed to the Southeast Asian hacktivist collective RipperSec under the #OpZionistV2 campaign. First reported on September 2, 2026, it subjected the platform's web infrastructure on AWS to sustained application-layer request floods. The site became intermittently or completely inaccessible from multiple monitoring locations, with timeouts, severe packet loss, socket exhaustion, and repeated 502 and 504 errors. Allied hacktivist channels amplified the campaign: RBL Leviathan Ghost reportedly directed the DDOSTEAMRBL bot cluster at the target, and The Comrade's Group added traffic using the MegaMedusa stress-testing framework.

TheGarudaEye DDoS against the Qatar Football Association

The hacktivist collective TheGarudaEye disrupted the Qatar Football Association's public website for more than three hours with coordinated Layer 7 HTTP flood waves, producing 504 and Cloudflare 525 errors. The group claimed the attack under "GLOBAL CYBER ATTACK #0131," first announcing three hours and later extending the claimed window to 15 hours. QFA administrators reportedly stopped the public-facing web application as an emergency measure. The incident was assessed as an external Layer 7 DDoS with no data exfiltrated, no database breach, and no leaked administrative credentials. It is part of the group's broader campaigns against Gulf-region digital infrastructure.

Citya Immobilier data breach claim

A forum post offered an alleged dataset from Citya Immobilier, a French real-estate management company, claiming about 2.2 million records and 50,000 building access codes (digicodes). If authentic, the data combines identity and contact information with property records and building access details, so it could support phishing, impersonation, and fraud, and could create physical-security risk if any access codes remain valid. The listing does not explain how the data was obtained or when. The source report notes its figures are based on a headline because the full article could not be retrieved. Authenticity, the actor, and the method of compromise remain unverified.

Alleged Transfast payment SMS records

An actor posting as Marx advertised 11.8 million payment-related SMS records associated with Transfast, along with access to a portal. If the records contain identifiable customer or transaction information, they could enable convincing financial impersonation and smishing campaigns. The report stresses that the evidence shown is a messaging provider's portal serving the payment company and that nothing in the post indicates a compromise of Mastercard's own payment systems. A screenshot demonstrates a session rather than persistent access, no acquisition route is given, and the account is days old. Neither company has publicly addressed the claim.

Kuwaiti national security agency employee data listing

A threat actor using the alias 0cx00iq offered for sale a dataset the actor says contains personal information about employees of Kuwait's National Security Agency, priced at about $3,500 (negotiable), with a heavily watermarked sample. The actor says the data is current as of June 2026. If verified, it could expose individuals to physical targeting, surveillance, coercion, blackmail, and identity fraud, and give adversaries a way to identify intelligence personnel. Sample records and contact details are excluded here. Authenticity is unverified and Kuwaiti authorities have not commented.

US Department of Defense DMDC breach

A breach involving the Defense Manpower Data Center (DMDC) reportedly exposed personal and employment information of about 3.05 million people, including 2.76 million living individuals and 294,000 deceased individuals. A vulnerability in a file-sharing system allowed unauthorized users to access files containing unencrypted personally identifiable information between October 2025 and July 16, 2026, when it was discovered. The data included Social Security numbers, names, dates of birth, contact details, and military occupational information. Notifications began in September. Officials reported no evidence of misuse at disclosure. DMDC patched the vulnerability and restored the system. The initial intrusion method, the attackers, and the extent of exfiltration remain undisclosed, with no confirmed attribution.

Target verticals: government, defense, military, public sector, and federal personnel administration

DragonForce ransomware cartel

DragonForce has evolved into a centralized ransomware-as-a-service operation with an aggressive white-label affiliate model. It uses modified legacy source code and advanced evasion tactics, averages about 65 victims per month, and has updated VMware ESXi lockers targeting versions 5 through 8. It emerged in 2023, is financially motivated, and operates globally using data theft, encryption, and extortion. Known aliases include DragonForce Ransomware Cartel and RansomBay.

Targeting profile: professional services, manufacturing, technology, retail and e-commerce, and healthcare. Professional services and manufacturing are the two largest sectors by victim count, followed by technology. The United States accounts for the most tracked victims, followed by the UK, Germany, Canada, and Italy.

TTPs: user execution, indicator removal through file deletion, impairing defenses by disabling or modifying tools, file and directory discovery, and data encrypted for impact.

DragonForce's risk comes not only from its payload but from the scale of its affiliate model, which spans many industries and jurisdictions.

Alleged Saudi military hospital data claim

An actor using the handle "UWAYS" claims unauthorized access to systems of Prince Sultan Military Medical City (also referenced as Riyadh Military Hospital), and says it obtained data on thousands of Saudi military personnel along with patient and staff records, treatment information, and identity documents. Screenshots reportedly show a patient referral table, hospital and laboratory listings, a staff roster, identity document thumbnails, and administrative interfaces. One dashboard references a different hospital in Madinah than the one named in the claim. The access, source, authenticity, completeness, and scope are unverified. Individual names, patient identifiers, and contact details are not repeated in the source report.

Vulnerability and exploit intelligence

Open source and enterprise applications

Software supply-chain failures remained a major threat: over 72% of organizations discovered high-risk vulnerabilities in transitive open-source dependencies.

Microsoft September 2026 security updates

Microsoft's September updates address a broad range of vulnerabilities across Windows and other products, with out-of-band updates for Remote Desktop Services and other Windows components. Microsoft also expanded VEX reporting to all Microsoft-assigned CVEs, which helps organizations assess exposure and prioritize remediation.

Enterprise network and infrastructure

MITRE ATT&CK mapping

Recommendations

Cloud and identity security

• Enforce phishing-resistant MFA for privileged, VPN, cloud, and externally accessible accounts.
• Rotate and secure API keys using centralized secrets management and periodic credential rotation.
• Apply least-privilege access across cloud IAM, service accounts, APIs, and third-party integrations.
• Restrict cloud and SaaS administration to trusted networks or approved access paths where possible.
• Audit third-party integrations by keeping an inventory of OAuth apps, API integrations, and service principals.
• Centralize cloud audit logging for authentication, IAM changes, API activity, administrative actions, and data access.

Infrastructure and vulnerability management

• Prioritize actively exploited vulnerabilities affecting Check Point, Citrix NetScaler, Cisco Secure Email Gateway, FortiMail, and other products.
• Maintain an accurate internet-facing asset inventory covering VPNs, firewalls, email gateways, applications, APIs, and remote-access infrastructure, and audit it periodically.
• Use risk-based prioritization based on exploitation status, CISA KEV, CVSS, exposure, exploit availability, and business criticality.
• Establish an emergency zero-day patching process with predefined remediation, compensating controls, isolation, and validation.
• Restrict management interfaces to authorized administrative networks and secure access paths.
• Strengthen software supply-chain security.
• Harden web applications and APIs with secure coding, WAF, input validation, strong authentication, and regular penetration testing.

Email and endpoint protection

• Strengthen phishing and ClickFix protection through targeted awareness on fake CAPTCHA, browser verification, and malicious command prompts.
• Monitor suspicious command execution involving PowerShell, CMD, scripting engines, and LOLBins launched from browsers, Office, or downloaded files.
• Enable behavioral ransomware detection for mass file changes, encryption, shadow-copy deletion, and security-tool tampering.
• Protect EDR controls against unauthorized disabling, modification, or service termination.
• Strengthen email authentication with SPF, DKIM, and enforced DMARC policies.
• Maintain endpoint isolation procedures for rapid containment of ransomware, credential theft, and malware incidents.
• Run modern phishing simulations that include ClickFix and other current social-engineering techniques.

Appendix

Threat actors observed

Malware families observed

Methodology

Collection period

September 2026

Data source

Prepared by the EnCyb Cyber Threat Intelligence team as a monthly overview of significant incidents, threat actor activity, and security developments, with a focus on events linked to geopolitical tension and emerging threats. The source report is marked TLP:GREEN.

Limitations

Many incidents are based on threat-actor claims published on leak sites, dark web forums, or Telegram channels, or on media reports, and several remain unverified or unconfirmed by the affected organizations. One dataset figure in the source report is taken from a headline because the full article could not be retrieved. Attribution is as reported and may change.

Frequently asked questions

Which threat actors were most active in September 2026?

ShinyHunters and DragonForce led the financially motivated activity. Hacktivist groups including RipperSec and TheGarudaEye ran DDoS campaigns against Israeli and Gulf-region targets, and several actors offered stolen data for sale on underground forums.

Which sectors were targeted most in September 2026?

The top five targeted sectors were government, finance, technology, education, and NGOs.

What are the most important defensive actions from this report?

Patch actively exploited Check Point, Citrix NetScaler, Cisco Secure Email Gateway, and FortiMail flaws first, enforce phishing-resistant MFA, rotate and centrally manage API keys, inventory third-party integrations, and detect ClickFix-style command execution launched from browsers.