This week’s cybersecurity weekly report covers a stretch that felt less like a normal news cycle and more like a stress test of the whole industry’s assumptions about who the attackers are. Three storylines dominated this week’s cybersecurity news. North Korea’s WaterPlum operation was formally exposed as a 30,000-device fake-recruiting machine that funneled crypto back to Pyongyang.
A rival extortion crew called ShinyHunters broke into and defaced the Clop ransomware gang’s own leak site. And independent researchers demonstrated that a single malicious browser extension could hijack the AI assistants built into five of the world’s most popular browsers.
Underneath all of that sat a quieter, heavier problem: a record-setting Microsoft patch load from earlier in the month kept working its way through enterprise patch queues, a maximum-severity GitLab flaw kept getting probed by opportunistic scanners, and the FBI quietly took down one of the internet’s longest-running DDoS-for-hire platforms.
The cybersecurity threats this week ranged from nation-state crypto theft to a rival gang’s public shakedown of a ransomware operation, and the cybersecurity incidents this week reinforced a theme this publication has tracked all year: speed, not sophistication, is what separates a contained flaw from a mass-exploitation event.
CyberInfos’ internal threat desk assessed the global threat posture at Level 3, Elevated for this weekly cybersecurity news cycle. That rating reflects active exploitation of multiple internet-facing management tools, GitLab, ConnectWise ScreenConnect, and MikroTik RouterOS among them, alongside a genuinely novel escalation in AI-agent-driven attacks. It is not the result of any single catastrophic event.
Major Incidents in This Week’s Cybersecurity News
Among the cybersecurity incidents this week, four stood out for scale, novelty, or the sheer audacity of the target chosen. Anyone scanning the cybersecurity news this week for a single defining moment will find it hard to pick just one.
1. ShinyHunters Hacks Clop’s Own Data Leak Site
On the night of September 18-19, the extortion group ShinyHunters broke into and defaced the dark-web leak site run by the Clop ransomware operation: the page Clop uses to name and pressure its victims. According to reporting confirmed by BleepingComputer, ShinyHunters first uploaded a small taunting text file through what it described as an unauthenticated file-upload flaw in Grav CMS, the software running Clop’s site. The group returned hours later to fully deface the page with ASCII art of its Umbreon mascot.
ShinyHunters told reporters it had obtained the leak site’s source code, Grav plugins, system logs, and, most consequentially, the private cryptographic keys for Clop’s Tor onion service. It said it intended to extort Clop within 72 hours. The feud reportedly traces back to threats allegedly made against ShinyHunters during Clop’s earlier Oracle E-Business Suite extortion campaign. [Read more]
ANALYST INSIGHT: A rival crew rooting a ransomware gang’s own infrastructure is unusual, but the underlying flaw is not. An unpatched, self-hosted CMS exposed to the open internet is exactly the class of bug this week’s other major incidents also exploited. Attackers, regardless of which side of the extortion economy they sit on, are still winning through basic exposure and patch-lag, not novel tradecraft.
2. WaterPlum (North Korea) Confirmed to Have Infected 30,000 Devices
A joint advisory published September 18 by the FBI, Japan’s National Police Agency, Australian authorities, and Germany’s BND/BfV confirmed that the North Korean group WaterPlum, also tracked as Contagious Interview, infected at least 30,000 devices across more than 100 countries between December 2025 and July 2026.
The campaign drained more than 7,000 cryptocurrency wallets and moved roughly $10.71 million in crypto to the DPRK. Victims, mostly software developers and IT freelancers, were lured through fake recruiting interviews on job platforms and told to run “test” code that installed the group’s BeaverTail, InvisibleFerret, OtterCookie, and OtterCandy malware families. Investigators noted operators used AI face-swap tools to impersonate legitimate interviewers on video calls. [Read more]
3. IDScan Breach Fallout Continues as Lawsuits Mount
Identity-verification provider IDScan.net, whose systems were the confirmed source of a dark-web database exposing more than 153 million U.S. and Canadian driver’s license scans, continued to face fallout this week. First reported by journalist Brian Krebs on September 1 and confirmed by the company on September 4, the breach has since drawn multiple class-action filings in Louisiana courts.
Both the FBI and the Pentagon have acknowledged active investigations after a senior U.S. defense official’s license reportedly turned up in the leaked “Nexus” database. IDScan says its investigation into the cloud-storage compromise remains ongoing. [Read more]
4. AI-Agent Swarm Attack Against PaperCut Servers Still Being Unpacked
Disclosed by GreyNoise and Blackpoint Cyber on September 9, the campaign that used hundreds of autonomous AI agents to exploit two PaperCut NG/MF print-management flaws (CVE-2026-81578 and CVE-2026-82078) continued to generate fresh technical analysis this week as identity-security researchers dug into what happened. The single attacker’s agents compromised 440 servers at 395 organizations in 48 countries.
Eleven organizations were breached within 26 seconds of the campaign’s start, and the attacker reached full domain-administrator access at 12 organizations, in one case in under seven minutes. Education institutions accounted for 204 of the victims. [Read more]
ANALYST INSIGHT: These four incidents share a pattern worth naming. None of them required a genuinely new exploitation technique. What they required was speed, AI-accelerated in the PaperCut case and simply opportunistic in the others, applied against infrastructure organizations assumed was either obscure enough or trusted enough not to need urgent attention. That assumption is now the thing to fix.
New Vulnerabilities & Patches
Several high-value flaws defined this week’s patch priorities for this cybersecurity weekly report, layered on top of an already unusually heavy September for defenders. If your team only reads one section of this week’s cybersecurity news this week, make it this one.
[CVE] CVE-2026-85706 | GitLab | CE/EE | CVSS: 10.0 | Exploited: Yes
A path-traversal and missing-authentication flaw in GitLab’s repository commits API let unauthenticated attackers read arbitrary files from self-managed GitLab servers, including SSH keys, database credentials, and CI/CD variables. GitLab patched it September 10. watchTowr observed internet-wide probing beginning roughly 20 hours later, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 11 with a federal remediation deadline of September 14, placing that deadline squarely inside this reporting week.
[PATCH] Upgrade self-managed GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 immediately; rotate any credentials stored in exposed configuration files.
[CVE] CVE-2026-84869 | ConnectWise | ScreenConnect | CVSS: 9.9 | Exploited: Yes
A missing-authorization flaw in the ScreenConnect client allowed files to be transferred and executed during an active remote session without host confirmation. Huntress documented exploitation dating back to August 20, describing a four-stage VBScript chain that let compromised ScreenConnect clients propagate the payload to other connected systems in worm-like fashion. CISA’s KEV deadline of September 14 for this flaw also fell inside this week’s window, making it one of the two vulnerabilities driving this week’s cybersecurity news the hardest.
[PATCH] Update to ScreenConnect 26.6.5 or later; disable the TransferFiles permission as an interim mitigation and audit logs for RunFiles/RanFiles entries.
[CVE] CVE-2026-67276 / CVE-2026-86060 | MikroTik | RouterOS | CVSS: 9.2 (each) | Exploited: Yes
CERT Polska and Bishop Fox detailed “MikroTrick,” a chain combining an SSH public-key validation flaw with a username-parsing privilege-escalation bug. Together, they let an attacker with no credentials seize full administrative control of any internet-exposed RouterOS device. CERT Polska traced active use of the chain back to at least September 2, and Bishop Fox found persistence artifacts in the wild, including a hidden “ops” account, on compromised routers.
[PATCH] Update to RouterOS 7.24.2, 7.23.4, or 6.49.21; block SSH access from untrusted networks and check device logs for a "Flagged" indicator of compromise.
Microsoft’s September Patch Tuesday: Continuing Fallout
Microsoft’s September 9 release remains relevant to this week’s cybersecurity threats this week for one simple reason: scale. Somewhere between 966 and 974 CVEs, depending on counting methodology, made it the largest single-month release in company history, and many enterprise patch cycles were still working through it during this reporting period.
The release included two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC, plus 20 vulnerabilities researchers classified as wormable across components including DNS Server, DHCP Server, and Active Directory. A CVSS 9.8 DNS remote-code-execution flaw, CVE-2026-69730, drew particular attention: Zero Day Initiative researchers compared it to the historic SigRed bug.
PRIORITY ACTION: Treat the two actively exploited Microsoft zero-days and the GitLab and ScreenConnect flaws as immediate priorities if not already remediated. All four are confirmed exploited, and both GitLab and ScreenConnect passed their federal KEV deadlines this week.
Ransomware Activity
Ransomware coverage in most weekly cybersecurity news roundups follows a predictable rhythm of new victim announcements. This week broke that rhythm entirely.
Clop Extortion Campaign Draws Retaliation From a Rival Gang
The most unusual ransomware-adjacent story in this week’s cybersecurity news wasn’t a new victim announcement. It was Clop itself getting hacked. ShinyHunters’ defacement of Clop’s leak site, detailed above, exposed how thin the operational security often is behind even established extortion brands.
Clop was reportedly running its public-facing infrastructure on an outdated, self-hosted CMS with an unpatched file-upload vulnerability: the same category of basic exposure that ransomware affiliates routinely exploit against their own victims.
Where Extortion Groups Are Turning Next
Beyond the Clop incident, this week’s reporting reinforced two broader patterns security teams have tracked through 2026 as part of the ongoing weekly cybersecurity news cycle. Extortion groups increasingly skip encryption altogether in favor of pure data-theft-and-leak models.
And turf disputes between rival crews, echoing earlier incidents like DragonForce’s defacement of BlackLock and Mamona, and the mutual leak-site hacks between 0APT and KryBit, are becoming a recurring feature of the cybercrime ecosystem rather than a novelty.
ANALYST INSIGHT: Infighting among extortion crews doesn’t reduce the threat to enterprises. If anything, a rival gang obtaining Clop’s onion-service keys and victim data raises the odds that already-stolen corporate data resurfaces through a second, unrelated extortion attempt.
Threat Intelligence
This section of the weekly cybersecurity news roundup covers three campaigns that reveal how differently offense is being resourced right now: from a single independent researcher to a state intelligence apparatus.
BragJack: One Extension, Five Hijacked AI Browser Assistants
Security researcher Gal Weizman of Forever Security published BragJack on September 16, a proof-of-concept technique in which a single malicious browser extension hijacks the built-in AI assistants in Chrome (Gemini), Microsoft Edge (Copilot), Opera Neon, Perplexity Comet, and the Claude in Chrome extension.
The attack abuses Chromium’s declarativeNetRequest API, the same mechanism ad blockers use, to intercept and redirect traffic. It then uses a technique Weizman calls “Prompt Forcing” to feed the hijacked assistant instructions directly, rather than relying on hidden prompt-injection payloads.
Demonstrated impacts included reading local files, capturing screenshots, and forcing an agent to summarize a victim’s email and exfiltrate it to an attacker-controlled address. Google and Microsoft issued CVEs, CVE-2026-0628 and CVE-2026-55945 respectively, and paid over $20,000 combined in bounties. No in-the-wild exploitation has been reported, and all affected vendors have shipped fixes.
[TTP] Malicious Browser Extension Abuse (ATT&CK ID: T1176.001) - extension abuses a legitimate API (declarativeNetRequest) to reach privileged AI-agent messaging channels
WaterPlum’s Technical Playbook
Beyond the headline device-infection numbers covered under Major Incidents, this week’s joint advisory detailed WaterPlum’s malware family lineup and infrastructure. The group’s toolkit spans BeaverTail, JavaScript malware hidden in malicious npm packages, InvisibleFerret, a Python backdoor, and the newer OtterCookie/OtterCandy combination that blends remote-access and information-stealing capability.
Investigators linked WaterPlum’s infrastructure to North Korea’s broader IT-worker fraud schemes, noting shared IP addresses tied to “laptop farms” used to disguise North Korean operators as legitimate remote freelancers.
[IOC] Malware family | BeaverTail | JavaScript loader distributed via trojanized npm packages during fake technical interviews
China-Linked GRIMWEDGE Campaign Targets NGOs
Volexity researchers, tracking a cluster designated UTA0560, reported a Chinese state-linked spear-phishing campaign that chained recently patched Chrome and Windows vulnerabilities to deliver a JavaScript backdoor dubbed GRIMWEDGE. The activity targeted multiple non-governmental organizations beginning September 1.
It’s a useful reminder that civil-society and advocacy groups remain priority targets among the cybersecurity threats this week, even amid more headline-grabbing corporate incidents. It’s a quieter story than the others in this section, but one every weekly cybersecurity news brief covering nation-state activity should still carry.
Industry News
The policy and enforcement side of this week’s cybersecurity news moved on three fronts: new EU regulation, an FBI takedown, and a ransomware sentencing.
EU’s 24-Hour Breach Reporting Rule Takes Hold
A new provision of the EU Cyber Resilience Act, which came into force September 11, began reshaping how connected-device makers behave this week. Manufacturers of products sold in the EU, everything from baby monitors and smartwatches to routers, VPNs, and operating systems, must now report actively exploited vulnerabilities to ENISA within 24 hours, followed by a fuller notification within 72 hours and a final report within 14 days of a fix becoming available.
Non-compliance can draw fines of up to €15 million. Legal and compliance teams spent this week helping manufacturers stand up the reporting processes the rule requires, a slower-moving but consequential thread in this week’s cybersecurity news. [Read more]
FBI Dismantles NightmareStresser DDoS-for-Hire Platform
On September 15, the FBI, working with Canada’s Royal Canadian Mounted Police, seized the domains behind NightmareStresser, described by the Department of Justice as one of the longest-running DDoS-for-hire “booter” services. The service was allegedly responsible for hundreds of thousands of attacks against schools, government agencies, and gaming platforms since 2022.
The takedown is part of the ongoing Operation PowerOFF, an international law-enforcement effort that has now charged twelve defendants and seized more than 100 domains tied to booter services over the past eight years: a rare bit of good news in an otherwise dense week of cybersecurity threats this week. [Read more]
Conti Ransomware Operator Sentenced
A Ukrainian national, Oleksii Oleksiyovych Lytvynenko, arrested in Ireland in 2023, was sentenced this week to four years in prison for his role in Conti ransomware extortion activity tied to roughly $150 million in victim payments.
It’s a reminder that international law-enforcement cooperation against ransomware affiliates, however slow, continues to produce convictions years after the Conti brand itself went dark. It’s the kind of item that rarely tops a cybersecurity weekly report but matters to anyone tracking whether ransomware actually carries consequences for the people behind it.
Tool Updates
Patch management tooling and the vendors behind this week’s cybersecurity incidents this week both moved quickly, which is worth acknowledging alongside the criticism above.
PaperCut NG/MF: Following its emergency patches in late August, PaperCut shipped consolidated maintenance releases (26.0.5, 25.0.13, and 24.1.10) on September 10 to permanently replace the earlier stopgap fixes for CVE-2026-81578 and CVE-2026-82078. Organizations still running unpatched instances after the AI-agent swarm campaign should treat any PaperCut server as potentially compromised, not merely vulnerable, and prioritize credential rotation over patching alone.
GitLab and ConnectWise ScreenConnect: Both vendors’ emergency releases, GitLab 19.3.2/19.2.6/19.1.8 and ScreenConnect 26.6.5, remain the operative fixes for this week’s two federally mandated KEV deadlines. Teams that have not confirmed client-side update propagation, particularly for ScreenConnect’s distributed host agents, should verify rather than assume patch completion.
CISA Known Exploited Vulnerabilities Catalog: The catalog saw unusually heavy activity this week, adding GitLab, ScreenConnect, MikroTik RouterOS, and JFrog Artifactory entries in quick succession. That pace reflects both genuinely rising exploitation and CISA’s continued push to compress the time between disclosure and mandated federal remediation. Anyone building an internal weekly cybersecurity news brief for their own organization should treat the KEV catalog, not vendor blog posts alone, as the authoritative source for patch prioritization.
Looking Ahead
The cybersecurity weekly report closes each edition by naming what to watch, and this week’s cybersecurity threats this week point toward three things worth tracking into next week.
First, the federal remediation deadlines for both the GitLab and ConnectWise ScreenConnect flaws fell within this reporting window. Private-sector organizations that used the same September 14 date as their own internal benchmark should now shift focus to verifying, not just applying, those patches across every affected instance. Second, ShinyHunters’ 72-hour extortion deadline against Clop, set on September 19, will resolve in the days immediately following this cybersecurity weekly report.
Whether Clop pays, retaliates, or simply rebuilds its infrastructure elsewhere will say something about how seriously ransomware operators take threats from within their own ecosystem. Third, expect continued fallout from the BragJack disclosure as other browser and AI-agent vendors audit their own extension-to-agent messaging boundaries for the same class of privilege-crossing flaw, a topic likely to dominate next week’s cybersecurity news this week as well.
UPCOMING EVENTS: SecurityWeek’s 2026 Attack Surface Management Summit ran September 16, with the organization’s Zero Trust Summit and CodeSecCon following in mid-October: both worth a slot on the calendar for anyone who found this cybersecurity weekly report useful.
[WATCH]: The single most important unresolved thread heading into next week is the Clop-ShinyHunters standoff. If ShinyHunters follows through on using stolen onion-service keys and server data to disrupt or expose Clop’s own victim list, it could inadvertently surface additional stolen corporate data that Clop itself never fully leaked. That would mean organizations that negotiated with or were previously named by Clop may not be finished dealing with this incident, even though the current headlines describe the ransomware gang as the victim rather than the attacker. We’ll track it in next week’s cybersecurity incidents this week coverage.
