Loading story…
ShinyHunters allegedly breached and defaced the Tor-based data-leak site of the Clop/Cl0p ransomware operation following a dispute between the cybercrime groups. The group said it exploited an unauthenticated file-upload flaw in Grav CMS, first placing a taunting text file on the site and then replacing it with an Umbreon-themed defacement page.
ShinyHunters claimed it obtained full server access and stole Clop source code, Grav CMS plugins, logs, server data, and private keys for the operation's onion service. It has threatened to extort Clop using the purportedly stolen material; however, the asserted access and data theft have not been independently verified. The conflict is reportedly tied to Clop's alleged threats and its 2025 Oracle E-Business Suite extortion campaign involving CVE-2025-61882.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
ShinyHunters allegedly began compromising Clop/Cl0p's Tor-hosted data-leak site by exploiting an unauthenticated file-upload vulnerability in Grav CMS.
Clop exploited multiple Oracle E-Business Suite vulnerabilities, including zero-day CVE-2025-61882, to steal organizational data as part of an extortion campaign.
ShinyHunters previously claimed responsibility for a HackForums defacement whose Umbreon-themed artwork was later reported to match the artwork used on Clop's leak-site defacement.
ShinyHunters said it was reviewing the allegedly stolen data and intended to extort Clop, reportedly in retaliation for alleged identification and violent threats by a Clop representative. The group said it would direct Clop to make contact within 72 hours through a message on its own leak site.
ShinyHunters claimed it obtained full server access and stole source code, Grav CMS plugins, logs, other server data, and private keys for Clop's onion service. These theft claims were not independently verified.
ShinyHunters replaced Clop's leak site with an Umbreon-themed ASCII-art defacement page linking to its own Tor site. The defacement was independently verified.
ShinyHunters uploaded a text file warning Clop not to threaten the group and linking to ShinyHunters' leak site. The file was independently confirmed as downloadable from Clop's Tor site.
Threat actors calling themselves Scattered Lapsus$ Hunters, including ShinyHunters, released a proof-of-concept exploit that Oracle later confirmed matched one used in Clop's Oracle E-Business Suite attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Crunchbase** confirmed a cybersecurity incident after the **ShinyHunters** cybercrime group claimed it stole **over 2 million personal records**. ShinyHunters reportedly posted a **402 MB compressed archive** online after an extortion attempt failed, and Crunchbase stated the threat actor **exfiltrated certain documents from its corporate network**. Crunchbase said business operations were not disrupted, the incident was **contained**, external cybersecurity experts were engaged, and **federal law enforcement** was notified while the company reviews the exposed data to determine required legal notifications. In a separate ShinyHunters-linked extortion case, French crypto tax platform **Waltio** was reported to be facing a ransom threat tied to alleged theft of personal data for **nearly 50,000 users**, including threatened exposure of users’ **2024 tax reports**. Waltio stated its services and production systems remained secure and that **no sensitive banking or crypto access data** was compromised. The activity aligns with ShinyHunters’ established pattern of **data theft and leak-site pressure** when ransom demands are not met.
Jun 29, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026
The **Cl0p** extortion group continued broad data-theft campaigns by exploiting managed file-transfer and file-sharing platforms, with reporting tying the gang to attacks involving **Cleo LexiCom, VLTrader, and Harmony** through `CVE-2024-50623` and to a separate campaign targeting **CentreStack** file servers. Security researchers said the Cleo flaw allowed remote file upload and download and could lead to remote code execution, while Huntress reported active exploitation and warned that Cleo's patch in version `5.8.0.21` might be bypassed. Cl0p publicly claimed dozens of organizations affected by the Cleo breach and gave victims short deadlines to respond to ransom demands, consistent with the group's long-running pattern of stealing data before threatening publication on its leak site. The campaign's impact appeared to spread across sectors and geographies, including a report alleging that a **New Zealand poultry producer** was listed as a Cl0p victim. The activity fits Cl0p's established playbook of exploiting high-value file-transfer software vulnerabilities, as previously seen in the **Accellion FTA** and **MOVEit** mass-compromise waves, then pressuring organizations through leak-site postings and negotiation channels. The latest reporting indicates Cl0p remained focused on opportunistic exploitation of internet-facing file exchange systems to drive large-scale extortion operations rather than relying solely on traditional ransomware encryption.
Jun 29, 2026