ShinyHunters Hack Ransomware Site of the Clop Gang and Threaten to Fleece Them

BleepingComputer reports an unusual incident in the world of cybercrime: the ShinyHunters group has hacked the data-leak site of the Clop ransomware gang (also known as Cl0p), replaced its contents, and claimed to have stolen server information as well as the private keys to the victim's onion address.

How it happened

According to ShinyHunters, the attack began in the early hours of Friday. The intruders exploited a vulnerability in Grav CMS that allowed files to be uploaded to the server without authorization, and they planted a small text file on Clop's site with the message: "This site got burned by ShinyHunters — maybe you shouldn't have threatened us next time." The file contained a link to the attackers' own leak site. BleepingComputer confirmed that the document could indeed be downloaded directly from Clop's Tor site.

A few hours later, ShinyHunters announced that they had "fully defaced" the resource. Instead of the usual page, visitors saw ASCII art of the Pokémon Umbreon — the group's logo — with the caption "rooting your systems since 2019 ;)". Researcher VXDB noted that the same image had been used in the August 2020 breach of the HackForums forum, which was also attributed to ShinyHunters.

What was stolen

The attackers claim to have gained "full access" to the server and exfiltrated the source code, Grav CMS plugins, system logs, and the contents of the /var/log directory — which may hold authentication logs and the IP addresses of those who connected. Separately, ShinyHunters claim to have obtained the private keys to Clop's onion service: if the keys really work, the group will be able to bring the site back up at the same address, but on their own servers. BleepingComputer confirmed the defacement and the file upload, but could not independently verify the claims about stolen logs, source code, and keys.

Asked about their further plans, a ShinyHunters representative answered curtly: "We're going to extort them." The group intends to post an ultimatum on its own site demanding that Clop make contact within 72 hours.

A thieves' feud

ShinyHunters describe the attack as revenge. According to their account, the conflict dates back to Clop's campaign last year against Oracle E-Business Suite: in October 2025, Clop exploited a number of vulnerabilities, including the zero-day CVE-2025-61882, to steal data from organizations. ShinyHunters, together with "Scattered Lapsus$ Hunters," had published a PoC exploit that Oracle later acknowledged matched the one used in the attacks. According to ShinyHunters, the exploit originally belonged to them, and Clop used it without asking. From there, it is claimed, someone from Clop sent threats to ShinyHunters members — going as far as promises of physical violence. The publication was unable to verify these claims; it reached out to Clop itself for comment.

Source: Bleeping Computer