ShinyHunters defaces Clop ransomware data leak site, claims data theft

As outlined in Bleeping Computer, the ShinyHunters extortion gang has reportedly breached and defaced the data leak site of the Clop ransomware operation. The attack, which began Friday night, allegedly involved exploiting a vulnerability in the Grav CMS used by Clop.

ShinyHunters claims to have exploited an unauthenticated file upload vulnerability in Grav CMS to deface the Clop Tor site with ASCII art of its Umbreon logo. The group also alleges to have gained full server access, stealing source code, Grav CMS plugins, system logs and the private keys for Clop's onion service. If confirmed, this would allow ShinyHunters to operate a Tor site using Clop's existing onion address.

This incident appears to be retaliation for alleged threats made by a Clop representative during an ongoing feud between the cybercrime groups, stemming from Clop's 2025 Oracle E-Business Suite data theft campaign. ShinyHunters plans to extort Clop using the stolen data, demanding contact within 72 hours.

Source: Bleeping Computer