Summary

September reshaped the cybersecurity landscape, with 20 zero-day vulnerabilities actively exploited. One of the most notable threats came from ShinyHunters (UNC6240), which renewed its mass exploitation of a critical Oracle PeopleSoft PeopleTools flaw, CVE-2026-35273. The attackers bypass WAF rules by URL-encoding a single character in the PSEMHUB path, letting them reach systems that were never patched. Once inside, they deploy web shells, the SIDEEYE backdoor, Neo-reGeorg tunnels, and MeshAgent. Victims span higher education, healthcare, government, and other sectors worldwide, and the goal is data theft and extortion. Organizations should patch immediately and should not rely on WAF rules alone.

Additionally, Google patched CVE-2026-87491, an out-of-bounds write flaw in the V8 JavaScript and WebAssembly engine used by Chrome and other Chromium-based browsers. The fix reached the Chromium source tree weeks before the stable Chrome release, which gave attackers a patch-gap window to weaponize the flaw. The attacks are tied to a shared exploit kit called BlueMoon, which chains this flaw with a second V8 flaw (CVE-2026-85046) and a Windows kernel privilege escalation flaw (CVE-2026-85880) to compromise a computer with a single click. BlueMoon was first seen on August 28, 2026, and was used by multiple China-aligned actors. The attacks have delivered the GRIMWEDGE JScript backdoor, the SUPERSTOMP loader, the ShadowPad backdoor, and Rust-based loaders.

Moreover, NeedyMantis is a modular backdoor used by the China-based actor Storm-3069 to keep long-term access to networks it has already breached. Its targets include telecommunications, education, healthcare, nonprofit, and government organizations. It is delivered through DLL sideloading inside bundles of legitimate software such as Poedit, curl, Vim, and TightVNC. With risks like these growing, strong defensive measures are more important than ever.

Insights

Threat distribution

Celebrity Vulnerabilities

Vulnerability Details: Vulnerabilities Summary

Attack Details: Attacks Summary

Actor Details: Adversaries Summary

Targeted Products, Countries and Industries

Targeted products spanned network security appliances (SonicWall SMA 1000, Check Point, F5 BIG-IP APM, Cisco, Citrix NetScaler), Google Chrome, e-commerce and CMS platforms (Adobe Commerce, Magento, WordPress), PostgreSQL, Windows and Apple operating systems, endpoint security drivers (Microsoft Malware Protection Engine, Topaz Antifraud, K7 Security), RMM and remote support tools (N-able N-central, ConnectWise ScreenConnect), DevOps and repository platforms (GitLab, JFrog Artifactory), TrueConf Server, PaperCut, Acronis Backup, Zyxel and Arista infrastructure, and Oracle PeopleSoft PeopleTools 8.61 and 8.62.

Most targeted countries

Activity was also recorded across the United States, Egypt, Singapore, France, Brazil, Thailand, Italy, South Korea, Turkey, Taiwan, Colombia, India, the Philippines, Spain, Portugal, Argentina, Saudi Arabia, China, Greece, Vietnam, Japan, Israel, the United Kingdom, Australia and many additional countries, 195 in total.

Most targeted industries

55 industries were targeted in total, with Agriculture shown as the least targeted.

Top 5 Takeaways

1. 01
   Zero-days

   In September 2026, 20 zero-day vulnerabilities surfaced across products from PaperCut, SonicWall, Google Chrome, Adobe, Microsoft Windows, N-able, Cisco, Check Point, F5, Arista, Citrix, Apple, and Oracle.
2. 02
   New malware

   Newly identified malware active in September included a broad mix of backdoors and RATs. Key discoveries were NodeRabbit, PollCat, Retrograde/MiniFast, and SIDEEYE, each representing distinct capabilities ranging from stealthy persistence and credential theft to large-scale compromise.
3. 03
   Top countries

   Cyberattacks concentrated heavily on Germany, Mexico, the United Arab Emirates, South Africa, and Canada, which absorbed most of the hostile activity. Espionage operations and financially motivated intrusions drove the surge.
4. 04
   Top industries

   Government, Finance, Education, Technology, and Retail sectors absorbed the bulk of targeted activity, with ransomware operations, data theft, and espionage campaigns driving operational disruption.
5. 05
   Leading actors

   Activity during the period was dominated by TA412, UTA0560, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket, ShinyHunters, and Storm-3069, all well-resourced groups known for sustained, high-impact operations.

Recommendations

Security teams: This digest can be used as a guide to help security teams prioritize the 36 significant vulnerabilities and block the indicators related to the 12 active threat actors, 31 active malware, and 209 potential MITRE TTPs.

Uni5 users: This is an actionable threat digest for HivePro Uni5 customers, who can get comprehensive insights into their threat exposure and take action easily through the HivePro Uni5 dashboard by running a scan to discover the assets impacted by the 36 significant vulnerabilities, and testing the efficacy of their security controls by simulating the attacks related to active threat actors, active malware, and potential MITRE TTPs in Breach and Attack Simulation (BAS).

Top Indicators of Compromise (IoCs)

A comprehensive list of IOCs for all tracked attacks is available on the Uni5Xposure platform.

Top MITRE ATT&CK TTPs

209 MITRE ATT&CK techniques were observed across the month; the 25 most frequent are listed above.