ransomware-group-operationinternet-facing-service-vulnerabilityinitial-access-methodthreat-infrastructure-tracking

ShinyHunters Defaces Clop Leak Site and Claims Theft of Onion-Service Keys

Threat Actor Intelligence · 20 sources · Updated 1mo ago · First seen Sep 19, 2026

ShinyHunters allegedly breached and defaced the Tor-based data-leak site of the Clop/Cl0p ransomware operation following a dispute between the cybercrime groups. The group said it exploited an unauthenticated file-upload flaw in Grav CMS, first placing a taunting text file on the site and then replacing it with an Umbreon-themed defacement page.

ShinyHunters claimed it obtained full server access and stole Clop source code, Grav CMS plugins, logs, server data, and private keys for the operation's onion service. It has threatened to extort Clop using the purportedly stolen material; however, the asserted access and data theft have not been independently verified. The conflict is reportedly tied to Clop's alleged threats and its 2025 Oracle E-Business Suite extortion campaign involving CVE-2025-61882.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

15 events · Aug 2020 – Sep 21, 2026

Reported Sep 22, 20261mo ago
Oracle E-Business Suite campaign reportedly affects more than 100 organizations
The Clop Oracle E-Business Suite zero-day campaign was reported to have victimized more than 100 organizations worldwide. Reported victims included Harvard University, the University of Phoenix, The Washington Post, Schneider Electric, Broadcom, Estée Lauder Companies, Cox Enterprises, Abbott, and Humana.
teiss - News - ShinyHunters hacks Cl0p leak site, demands a major ransom
Reported Sep 22, 20261mo ago
Clop site posts Russian maintenance message as leak site becomes unreachable
After ShinyHunters' defacement, Clop's darknet site displayed a short Russian-language message translated as “Relax, we are working on it.” Clop's data-leak site was reportedly unavailable and returned timeouts at the time of reporting.
Cybergang-Fehde: ShinyHunters knackt Cl0p-Darknetseite | heise online
Reported Sep 21, 20262mo ago
ShinyHunters sets payment and disclosure demands for Clop
ShinyHunters demanded an eight-figure payment and a public apology from Clop, and threatened to disclose companies that allegedly paid Clop during its Oracle EBS campaign, including alleged payment amounts and Bitcoin addresses.
ShinyHunters hacks rival extortion gang and takes over its dark web site | Malwarebytes
Sep 21, 20262mo ago
Clop posts message seeking to restore communications
A message attributed to Clop appeared on the compromised leak site stating that ShinyHunters' supplied contact email did not work and proposing renewed communication through a previously used platform. The message did not address the payment demands or theft claims, and the site reportedly displayed only this message after prior content was removed.
Clop Hack: ShinyHunters Hijacks Data Leak Site - Malware News - Malware Analysis, News and Indicators
Sep 21, 20262mo ago
ShinyHunters escalates Clop demand with daily increases
ShinyHunters said its demand against Clop would increase every 24 hours until Clop responded. The group also expanded its demand to all proceeds allegedly earned from Clop's Oracle E-Business Suite campaign, plus additional money and interest.
Clop gets a taste of its own medicine after ShinyHunters hijack leak site
Reported Sep 19, 20262mo ago
ShinyHunters threatens to extort Clop
ShinyHunters said it was reviewing the allegedly stolen data and intended to extort Clop, reportedly in retaliation for alleged identification and violent threats by a Clop representative. The group said it would direct Clop to make contact within 72 hours through a message on its own leak site.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang - Malware News - Malware Analysis, News and Indicators
Reported Sep 19, 20262mo ago
ShinyHunters claims Clop server-data and onion-key theft
ShinyHunters claimed it obtained full server access and stole source code, Grav CMS plugins, logs, other server data, and private keys for Clop's onion service. These theft claims were not independently verified.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang - Malware News - Malware Analysis, News and Indicators
Reported Sep 19, 20262mo ago
ShinyHunters defaces Clop leak site
ShinyHunters replaced Clop's leak site with an Umbreon-themed ASCII-art defacement page linking to its own Tor site. The defacement was independently verified.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang - Malware News - Malware Analysis, News and Indicators
Reported Sep 19, 20262mo ago
ShinyHunters uploads warning file to Clop server
ShinyHunters uploaded a text file warning Clop not to threaten the group and linking to ShinyHunters' leak site. The file was independently confirmed as downloadable from Clop's Tor site.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
Reported Sep 19, 20262mo ago
Scattered Lapsus$ Hunters releases Oracle exploit PoC
Threat actors calling themselves Scattered Lapsus$ Hunters, including ShinyHunters, released a proof-of-concept exploit that Oracle later confirmed matched one used in Clop's Oracle E-Business Suite attacks.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
Sep 19, 20262mo ago
Salesforce-related data made downloadable on compromised Clop site
Hackread observed that visitors to Clop's compromised onion address could download Salesforce-related data that ShinyHunters had also published through its own leak site. The reference does not establish the data's provenance or identify affected organizations.
Clop Ransomware Responds to ShinyHunters Amid Eight-Figure Demands
Sep 18, 20262mo ago
ShinyHunters breaches Clop's Tor leak site
ShinyHunters allegedly began compromising Clop/Cl0p's Tor-hosted data-leak site by exploiting an unauthenticated file-upload vulnerability in Grav CMS.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang - Malware News - Malware Analysis, News and Indicators
Oct 2025
Clop exploits Oracle E-Business Suite flaws for data theft
Clop exploited multiple Oracle E-Business Suite vulnerabilities, including zero-day CVE-2025-61882, to steal organizational data as part of an extortion campaign.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
Aug 2025
Clop begins exploiting Oracle E-Business Suite zero-day
Clop reportedly began exploiting the Oracle E-Business Suite zero-day CVE-2025-61882 in August 2025, later using the campaign to send mass extortion emails to executives at dozens of companies.
Hacker vs. Hacker: ShinyHunters Outsmarts Clop Ransomware Gang - CySecurity News - Latest Information Security and Hacking Incidents
Aug 2020
ShinyHunters claims HackForums defacement
ShinyHunters previously claimed responsibility for a HackForums defacement whose Umbreon-themed artwork was later reported to match the artwork used on Clop's leak-site defacement.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

2 linked

CL0P ShinyHunters

Malware

1 linked

Clop

Affected products

2 linked

GravGrav Cms

Breaches

1 linked

CLOP-2026-09

Observables

3 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

20 references tracked. Mallory keeps watching after this page renders.

SecuritymagazineNews · Sep 22, 2026

Why Security Needs to Stay Alert in the ShinyHunters, Clop Feud | Security MagazineOpen source ↗

Teiss NewsNews · Sep 22, 2026

teiss - News - ShinyHunters hacks Cl0p leak site, demands a major ransomOpen source ↗

ItproNews · Sep 22, 2026

‘Cyber criminal groups suffer from the same security weaknesses they routinely exploit’: ShinyHunters claims it hacked Clop ransomware rival | IT ProOpen source ↗

HeiseNews · Sep 22, 2026

Cybergang-Fehde: ShinyHunters knackt Cl0p-Darknetseite | heise onlineOpen source ↗

12 additional sources from 21-09-2026 to 21-09-2026

CyberveilleNews · Sep 19, 2026

ShinyHunters vandalise le site de fuite Tor du groupe ransomware Clop | CyberVeilleOpen source ↗

HackreadNews · Sep 19, 2026

ShinyHunters Hacks and Defaces Clop Ransomware Leak SiteOpen source ↗

Malware NewsNews · Sep 19, 2026

ShinyHunters hacks Clop leak site, threatens to extort ransomware gang - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Bleeping ComputerNews · Sep 19, 2026

ShinyHunters hacks Clop leak site, threatens to extort ransomware gangOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News