Multiple Ransomware Attacks Target Companies in September 2026

Redpacketsecurity

Multiple Ransomware Attacks Target Companies in September 2026

First seen 15 Sep 2026, 02:22 UTC • •36.9

Article Content

1 / 5

Browse articles

ThreatCluster •September 16, 2026 at 01:24 UTC

•ShadowByt3$ claims to have compromised HandyTrac, demanding negotiation within 72 hours.
•IAH6477 alleges a significant data breach at Veritiv, with 1.9 TiB of data reportedly involved.
•Anubis listed Better Accounting Solutions as a victim, but details on the breach are scarce.

On September 15, 2026, the ransomware group ShadowByt3$ claimed to have compromised HandyTrac, a company in Greystar Litchfield Park, AZ, alleging access to sensitive data including employee credentials and financial records. The group demanded negotiation within 72 hours to avoid publishing the data. On the same day, another group, IAH6477, listed Veritiv as a victim, claiming to have obtained approximately 1.9 TiB of data, but did not specify the nature of the data or any ransom demand. Additionally, on September 14, 2026, the Anubis group listed Better Accounting Solutions as a victim, describing a data breach without providing details on the data or ransom. All incidents remain unverified pending independent corroboration.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 55d ago How this analysis works

Timeline

2026-09-14

Better Accounting Solutions listed as ransomware victim

The Anubis group claimed a data breach affecting Better Accounting Solutions without providing specific details.

2026-09-15

ShadowByt3$ claims breach of HandyTrac

The group alleged access to sensitive information and demanded negotiation within 72 hours to prevent data publication.

2026-09-15

IAH6477 lists Veritiv as a victim

The group claimed to have obtained approximately 1.9 TiB of data from Veritiv, with no details on the data types or ransom.

More articles in this cluster (4)

Threat Graph

7 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
Ransomware
T1567 - Exfiltration Over Web Service

Organization (3)

Better Accounting Solutions
HandyTrac
Veritiv

Threat Actor (1)

anubis

Relationships

anubis uses Data Breach
anubis uses Ransomware
anubis uses T1567 - Exfiltration Over Web Service
anubis targets Better Accounting Solutions
anubis targets HandyTrac
anubis targets Veritiv

Following this threat?

Track anubis and Better Accounting Solutions in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

Critical RCE and LPE Vulnerabilities in Quest Foglight for Databases On November 3, 2026, the Zero Day Initiative disclosed multiple critical vulnerabilities in Quest Foglight for Databases, including six remote code execution (RCE) flaws and two local privilege escalation (LPE) vulnerabilities. The most severe RCE vulnerabilities, CVE-2026-92189 and CVE-2026-92190, allow…