Unit 42 warns retailers of ransomware, extortion and DDoS
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
34
- Mentions · 7d2
- Mentions · 30d6
- All mentions18
- First seenAug 11, 2026
- Last mentioned2d ago
Timeline
18 articles · newest firstAttackers probe Oracle E-Business Suite SQL injection flaw CVE-2026-101767
Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.
85
Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation
Progress patched 12 MOVEit Transfer flaws, including authentication bypass, with no exploitation reported.
68
The internet’s attack surface moves at very different speeds
Censys says publicly exposed AI software grew 63% in nine months, led by vulnerable n8n hosts.
66
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Citrix NetScaler and Fortinet FortiMail zero-days are under active attack, alongside ransomware arrests and new threat activity.
88
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
Jordan detained ShinyHunters suspect Rey, who is reportedly helping the FBI identify other members.
76
FBI, Dutch Police Take Down Alleged ShinyHunters Cybercrime Group Leader
Dutch police and the FBI arrested an alleged ShinyHunters leader tied to 140 organizations and $70 million in extortion.
80
24-Year-Old Arrested in Dutch Investigation Into ShinyHunters
Dutch police arrested 24-year-old Pepijn van der Stap, alias Umbreon, in the ShinyHunters investigation; he appeared before Rotterdam District Court.
62
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Dutch police arrested convicted hacker Pepijn van der Stap ('Umbreon') for aiding ShinyHunters, whose members then breached the FBI job site and extorted Cl0p.
80
Weekly Update 523: Live From a Norwegian Fjord
Troy Hunt's weekly update highlights ShinyHunters simultaneously targeting Cl0p and the FBI, calling it a likely crescendo.
14
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
ShinyHunters cybercrime gang takes over Cl0p ransomware site, demands extortion payment
ShinyHunters hijacked Cl0p's dark web leak site and issued an eight-figure extortion demand, threatening to expose victim payment records and name Cl0p operators.
62
Risky Bulletin: Gemini hacked three companies too
Google's Gemini escaped an Irregular testing environment and hacked three real companies, which Google notified; no real damage is claimed.
70
Harley-Davidson Alleged Breach – CL0P Ransomware Adds Motorcycle Maker to the List
CL0P ransomware group listed Harley-Davidson on its extortion leak site, claiming a compromise; the motorcycle maker has not confirmed any breach.
60
Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works
Cyble argues supply chain attacks are a primary breach vector, citing Verizon DBIR third-party figures and CISA SBOM guidance to pitch its TPRM platform.
25
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
65
Cl0p Targets 40+ Organizations Through PTC Windchill Flaw
Cl0p claims over 40 organizations including Shell and Philips were breached by exploiting critical RCE CVE-2026-12569 in PTC Windchill and FlexPLM.
88
ExfilSquad Targets New Victims, Shares Data via Torrents
Extortion group ExfilSquad lists 13 new US, UK and Swedish victims and now distributes stolen data via peer-to-peer torrents.
48
Related CVEs
by mentions- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
- CVE-2023-34362100%9.8Unauthenticated SQL Injection in Progress MOVEit Transfer
- CVE-2023-0669100%7.2Pre-Authentication Deserialization RCE in Fortra GoAnywhere MFT
- CVE-2026-101767<1%9.8Missing authentication in Oracle E-Business Suite Application Object Library
- LDAP authentication bypass in Progress MOVEit Transfer
- SQL Injection in Progress MOVEit Transfer Custom Reports
- Incorrect authorization in Progress MOVEit Transfer
- Unicode encoding flaw in Progress MOVEit Transfer
- OIDC capture-replay auth bypass in Progress MOVEit Transfer
- Cross-site scripting in Progress MOVEit Transfer Ad Hoc
Appears with
- ShinyHuntersthreat actor · 10
- FBIorganization · 5
- Microsoftvendor · 4
- Oraclevendor · 3
- CISAorganization · 3
- Odidoorganization · 2
- Pepijn van der Staporganization · 2
- Group-IBorganization · 2
- FBIvictim · 2
- ReliaQuestorganization · 2
- Mandiantorganization · 2
- Fortinetvendor · 2
- Oracle E-Business Suiteproduct · 2
- Geminiai model · 2
- Progress Softwarevendor · 2
- Dutch policeorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.