Threat Intelligence Analyst: 2026-09-22

1. ShinyHunters cybercrime gang takes over Cl0p ransomware site, demands extortion payment

   The Record, 2026-09-21. Read, 3 min.

   According to material posted on the site over the weekend, the ShinyHunters extortion group hijacked the dark web leak site Cl0p uses to name its victims, defaced it with a seizure banner, and posted an unspecified eight-figure demand that it said would rise every 24 hours. ShinyHunters said the feud stems from Cl0p’s unauthorized use of the Oracle E-Business Suite vulnerability and threats against one of its members, and by Monday the defaced site had been replaced by a message apparently from Cl0p.

   Why it matters for this role: You track adversaries and their relationships, and this infighting, where ShinyHunters seized Cl0p’s leak site and threatened to expose who paid and how much, is intelligence on both groups worth folding into your reporting.

2. Exvicy: A copycat of the ErrTraffic malware distribution framework

   Sekoia, 2026-09-21. Read, 19 min.

   Sekoia’s Threat Detection and Research team describes Exvicy, a ClickFix malware-distribution framework sold as a service and advertised on Exploit.IN since 26 May 2026, whose pages impersonate a Cloudflare Turnstile challenge and are delivered through compromised WordPress sites. It assesses with high confidence that Exvicy is a copycat of ErrTraffic, reusing its injected JavaScript and nearly identical C2 workflows while its ClickFix lure differs (Turnstile and Win+R, not reCAPTCHA and Win+X), and says its telemetry shows hosts in multiple customer environments contacting Exvicy C2 servers.

   Why it matters for this role: Your job is to attribute and connect, so Sekoia’s high-confidence finding that Exvicy is an ErrTraffic copycat reusing its code gives you a concrete link between two ClickFix operations to carry into tracking.

Threat Intelligence Analyst