Clop, ShinyHunters, and SAP: When Supplier Risk Becomes Attack Surface

Three distinct threat campaigns broke on 14 August 2026, and each one targets the same vulnerability: supplier and third-party infrastructure. Clop ransomware claimed 89GB of Shell data via managed file transfer platforms, continuing a six-year pattern of targeting MFT tools across supply chains. ShinyHunters exposed 1.6 million RingCentral accounts while simultaneously running OAuth abuse campaigns against Salesforce and other SaaS platforms, weaponising legitimate integrations and voice phishing. A maximum-severity SAP Commerce Cloud vulnerability moved from patch release to active exploitation in just three days. Meanwhile, supplier breaches at the Crown Office and Procurator Fiscal Service in Scotland and Trezor’s logistics partner reinforce the same pattern: organisations with sound internal controls are being compromised through third-party infrastructure they don’t directly manage. This briefing explains why managed file transfer platforms, OAuth connections, and unpatched supplier software represent the dominant attack surface in 2026, and provides actionable steps for UK small businesses to identify and close these exposure gaps before threat actors exploit them.

Chapters

• Introduction Three separate threat streams reveal a unified pattern: organisations with well-managed internal environments are being compromised through supplier infrastructure, SaaS integrations, and third-party software.
• Clop Claims Shell: The Method Is Six Years Old Clop ransomware claimed 89GB of Shell data via PTC FlexPLM and Windchill platforms. Team Cymru analysis shows Clop has run nine campaigns over six years, systematically targeting managed file transfer tools across supply chains.
• Call to Action Encouragement to follow the show and share with colleagues who may underestimate their exposure to supplier-based threats.
• ShinyHunters Pivots from Data Theft to SaaS Infiltration ShinyHunters breached RingCentral, exposing 1.6 million accounts, while simultaneously running OAuth abuse campaigns against Salesforce and other SaaS platforms using voice phishing, supply chain compromise, and credential theft.
• SAP Commerce Cloud: Maximum Severity, Already Exploited A maximum-severity remote code execution vulnerability in SAP Commerce Cloud moved from patch release to active exploitation in three days, compressing response windows and exposing retailers and e-commerce operators.
• The Pattern Underneath Today’s Stories Clop, ShinyHunters, and the SAP campaign all exploit third-party and supplier exposure. Additional breaches at Crown Office Scotland and Trezor’s logistics partner reinforce that supplier risk is the dominant attack surface in 2026.
• Closing Practical takeaways: map supplier access, audit OAuth connections, patch on severity rather than schedule, and brief staff on voice phishing tactics targeting legitimate application approval processes.

Links

• https://haveibeenpwned.com
• https://www.teamcymru.com
• https://www.microsoft.com/security/blog
• https://defused.com
• https://www.ncsc.gov.uk