ShinyHunters breaches Clop ransomware site and demands payment

Attack linked to long-running feud

The cybercrime group ShinyHunters says it has breached the infrastructure of rival ransomware operation Clop, defaced its data leak site and stolen sensitive server information.

The attack signals an unusual escalation in the rivalry between two prominent cybercrime groups, with ShinyHunters now threatening to publish information it claims to have taken from Clop unless its demands are met.

BleepingComputer says it independently confirmed that ShinyHunters uploaded a file to Clop's server and that the group's Tor-based leak site had been defaced. However, the publication said it had not independently verified claims that ShinyHunters stole Clop's source code, server logs or private Tor keys.

The attack began last week when ShinyHunters exploited what it said was an unauthenticated file-upload flaw in the Grav content management system used by Clop's site.The attackers initially uploaded a small text file containing a message directed at the ransomware group.

"THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time," the message said, alongside a link to the ShinyHunters leak site.

Several hours later, ShinyHunters claimed it had "completely defaced" the site. ShinyHunters subsequently claimed to have stolen source code, Grav CMS plugins, and other files from the server.

"We are still downloading and reviewing them," the group said.

It also claimed to have taken files from the server's /var/log directory. Such files can contain information about system activity and authentication attempts and may include IP addresses associated with connections to the server.

Ransomware gang becomes extortion target

ShinyHunters has now turned the breach into an attempted extortion campaign of its own.

The group has published a series of daily messages on its leak site warning Clop that it is now the target of an extortion demand.

It demanded an eight-figure payment, warning that the amount would rise every 24 hours if Clop failed to respond. The demands were later expanded to include a public apology. ShinyHunters has also threatened to publish information about organisations that allegedly paid Clop during its Oracle E-Business Suite extortion campaign.

Attack linked to long-running feud

ShinyHunters said the breach was carried out in response to threats from a Clop representative during a dispute dating to Clop's 2025 campaign against Oracle E-Business Suite.

In that campaign, Clop exploited vulnerabilities including CVE-2025-61882 to steal data for extortion, while the "Scattered Lapsus$ Hunters" group, which included ShinyHunters, published a proof-of-concept exploit that Oracle later said matched one used in Clop attacks.

ShinyHunters said at that time that Clop had obtained its exploit without permission. The group now alleges that tensions intensified after the Oracle campaign, including threats against its members by a Clop representative.

ShinyHunters says one representative threatened to kill members of the group. Clop had not publicly responded to the allegations at the time of the report.

Steven Thomson, senior SOC analyst at Barrier Networks, said the incident demonstrated that cybercriminal groups could target one another in much the same way they target other organisations.

"This is another example of a group publicly defacing the infrastructure of another threat actor," he said, while cautioning that ShinyHunters' claims should be treated carefully because the group could benefit from the publicity.

Moreover, the incident does not necessarily mean Clop's wider operations have been disrupted, he said.

"Cl0p won't disappear and ShinyHunters will continue to be a major threat."

"The cat and mouse game continues, but as we are seeing here, in this environment, the cats hunt the cats as well the mice."