ShinyHunters Breaches Clop Ransomware Leak Site, Claims Theft of Private Keys
The ShinyHunters extortion group has compromised the data leak site of the Clop ransomware gang, defacing the Tor-based page and claiming to have stolen server logs, source code, and private keys. The attack, which began on Friday night, exploited an unauthenticated file upload vulnerability in the Grav CMS platform. ShinyHunters uploaded a text file warning Clop against further threats before fully defacing the site with ASCII art of the Pokémon Umbreon. The group claims this action is retaliation for violent threats allegedly made by a Clop representative during a previous dispute over an Oracle E-Business Suite exploit. ShinyHunters has given Clop 72 hours to contact them, threatening to publish stolen data if no response is received. BleepingComputer confirmed the defacement but has not independently verified claims regarding the theft of private keys or system logs.