ShinyHunters Breaches Clop Ransomware Leak Site, Claims Theft of Private Keys

Key points

• ShinyHunters exploited an unauthenticated file upload vulnerability in Grav CMS to access Clop's Tor-based data leak site on Friday night.
• The group uploaded a text file warning Clop not to threaten them, followed by a full defacement of the site featuring Umbreon ASCII art.
• ShinyHunters claims to have stolen source code, Grav CMS plugins, system logs, and the private keys for Clop's onion service.
• The attack is described as retaliation for violent threats allegedly made by a Clop representative during a 2025 dispute over an Oracle E-Business Suite exploit.
• ShinyHunters has issued a 72-hour ultimatum for Clop to contact them, threatening to publish the stolen data on their own leak site.
• BleepingComputer confirmed the defacement and the uploaded file but has not independently verified the claims regarding the theft of private keys or logs.

Background

This incident follows a series of cybercrime disputes involving ShinyHunters, including a 2025 conflict over an Oracle E-Business Suite zero-day exploit (CVE-2025-61882) used by Clop. ShinyHunters previously claimed the exploit originally belonged to them. The group has also been involved in other high-profile breaches, such as the Florida DMV database and Ernst & Young, as noted in related coverage. The current breach highlights the escalating tensions between major ransomware and extortion groups, with ShinyHunters leveraging technical vulnerabilities to assert dominance over Clop's infrastructure.

Why it matters

The breach of a major ransomware gang's leak site by another cybercriminal group signals a shift in the cybercrime landscape, where groups are increasingly targeting each other's infrastructure rather than just corporate victims. The claim of stealing private keys for Tor onion services could allow ShinyHunters to hijack Clop's existing network address, potentially disrupting Clop's operations or using it for further extortion. This incident underscores the volatility within the cybercrime underworld and the potential for technical vulnerabilities in ransomware infrastructure to be exploited by rival groups, leading to a more fragmented and competitive threat landscape.

What to watch

Clop has 72 hours to contact ShinyHunters, as per the ultimatum issued by the extortion group. If no contact is made, ShinyHunters plans to publish a message on their own leak site and potentially release the stolen data. BleepingComputer has contacted Clop for a response and will update the story if they receive one. The defaced page is currently still being served from Clop's infrastructure, and it remains to be seen if Clop will restore the site or if ShinyHunters will maintain control of the onion address using the alleged private keys.