What happened in cyber in the last 24 hours — verified, graded, and stripped of hype. Sources named after each item. Confirmed facts and unverified claims are labeled throughout.
One of 2026’s biggest breaches isn’t a single company — it’s Clop’s mass extortion of Oracle E-Business Suite customers through the zero-day CVE-2025-61882 (CVSS 9.8), which the gang has been exploiting since last summer. The public victim list has grown into the dozens — by some counts past a hundred — spanning consumer brands, banks, universities and industrials. Our collection surfaced a batch of those Clop listings this week; they remain unverified leak-site claims until each company confirms.
The twist. Clop is having a bad week of its own: a rival crew, ShinyHunters, hijacked and defaced Clop’s own leak site on September 18, threatening to expose which victims paid, how much, and the crypto wallets that took the money. Thieves robbing thieves — and if it’s real, a rare window into ransom economics.
A financially motivated, Russian-speaking crew active as TA505 since ~2014 (also tracked as Graceful Spider / FIN11 / Lace Tempest); the Clop ransomware itself dates to 2019. They rarely bother encrypting anymore. Their signature is one move, run at scale: find a zero-day in a widely-used enterprise file-transfer or business application, quietly steal data from everyone running it, then extort the victims in public waves on their leak site.
In the MOVEit campaign alone, CISA put the fallout in the thousands of organizations. The lesson for a defender: your risk from Clop isn’t your own patching — it’s whatever enterprise file-transfer or ERP software you (or your vendors) run.
A Chinese-speaking operator wired together off-the-shelf AI agent frameworks (Strix, Cairn, Hermes) with DeepSeek, Kimi, and an older Claude model, and pointed them at online retailers. In a five-day burst (Sept 10–15) the agents ran at ~100 targets and compromised at least 27; across the broader campaign they injected payment skimmers and stole roughly 600,000 credit cards (about 79% American) — at an operator-measured cost of about $25 per target. Victims reportedly include a Fortune 500 hospitality firm and a major US airline. This is the swarm economics we’ve been tracking, applied to plain e-commerce fraud.
CISA added four actively-exploited flaws on September 22, federal deadline September 25 — Friday. The headline:
Arista VeloCloud Orchestrator — CVE-2026-93952CVSS 10.0
An unauthenticated attacker who can reach the VCO web interface (and holds an Edge cert’s public half) gets privileged access to the SD-WAN control plane. Actively exploited; fixed in 5.2.3.16 / 6.4.2.8 (6.1.x and 7.0.x still awaiting a patch).
Also added Sep 22: F5 BIG-IP APM (CVE-2026-94127) and two Check Point flaws (CVE-2026-93616, CVE-2026-85102) — all under active exploitation.
If you run VeloCloud SD-WAN, patch or restrict the orchestrator now. This is edge network gear — the box that controls your branch connectivity.
Our collection logged 113 organizations posted to ransomware leak sites in 48 hours — well above the usual pace, with Clop’s Oracle EBS victims heavy in the listings — and about 253 over the past week. Clop led (23 this week), then Qilin (21) and TheGentlemen (18). Unverified leak-site claims, tracked as they post.
After two quiet weeks, a fresh SEC Item 1.05 material-cybersecurity 8-K posted: Astrana Health (Nasdaq: ASTH) filed on September 23, disclosing a social-engineering attack — attackers impersonated staff and spoofed the company’s own phone number to get in. It’s the filing that means a company judged a cyber incident material to investors.
Chinese coverage this week highlights Shanghai’s Pudong district releasing 11 “AI + government services” (AI+政务) high-value scenarios — the state pressing AI into public administration, the same “intelligent era” framing that ran through last week’s national cyber-security week. Machine-translated, not yet source-graded; raw signal.
Clop doesn’t breach you directly — it breaches the software you and your vendors run. Want to know which of those exposures put you in the next wave? Monadnock Cyber produces a formal, intelligence-grade Am I a Target? assessment — who would target you, how, when, and the indicators to watch. Request one at monadnockcyber[.]ai.
Do today: patch Arista VeloCloud (CVSS 10.0) before Friday, and check whether you or your vendors run Oracle E-Business Suite — that is the door Clop is walking through. The through-line of the day is scale: one crew extorting dozens of companies off a single Oracle zero-day, and an AI-agent operator skimming hundreds of thousands of cards for pocket change. Different tools, same lesson — the attacker’s cost keeps falling, so the exposure you leave standing gets found faster. Leak-site names remain claims until confirmed; the Oracle EBS vector and the AI campaign are verified.
Comments
Post a Comment