ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

{"heading_1":"The Attack and Its Impact","subheading_1":"ShinyHunters Exploits Clop's Data Leak Site","content_1":"ShinyHunters, an extortion group, exploited an unauthenticated file upload vulnerability in Grav CMS to upload a text file to Clop's data leak site. The file contained a message warning Clop not to threaten ShinyHunters and a link to ShinyHunters' own data leak site.","subheading_2":"Data Theft and Defacement","content_2":"ShinyHunters claims to have gained full access to the server and stolen source code, Grav CMS plugins, system logs, and other data. They also claim to have obtained the private keys used by Clop's Tor onion service, allowing them to operate a Tor site using Clop's existing onion address on servers they control.","subheading_3":"The Threat to Clop","content_3":"ShinyHunters threatens to publish a message on their own leak site instructing Clop to contact them within 72 hours. They also claim to have stolen all files stored under /var/log, which could contain system activity, authentication logs, and potentially, the IP addresses of those who connected to it.","subheading_4":"Background on the Cybercrime Groups","content_4":"The attack is retaliation for threats allegedly made by a Clop representative during an ongoing feud between the cybercrime groups. ShinyHunters claims that tensions escalated after the Oracle E-Business Suite data theft campaign in 2025, where Clop allegedly used a zero-day exploit without authorization."}