A well known hacking collective has broken into the infrastructure of one of the world’s most active ransomware operations, flipping the usual script of extortion back onto the extortionists. ShinyHunters says it defaced the dark web leak site belonging to Clop, a ransomware gang responsible for some of last year’s largest corporate data thefts, and is now threatening to extort the group using data it claims to have pulled from Clop’s own servers.
The breach reportedly came through an unpatched, unauthenticated file upload flaw in Grav CMS, the content management system Clop used to run its Tor based leak portal. ShinyHunters told the outlet BleepingComputer it gained full access to the server and pulled source code, Grav CMS plugins, system logs, and files from the server’s /var/log directory, information that can include authentication records and the IP addresses of anyone who connected to the site.
The incident is still unfolding. ShinyHunters says it is reviewing the stolen material and intends to post a formal extortion demand, giving Clop 72 hours to respond, though as of the original report that demand had not yet gone up. What began as a spat between rival criminal groups is now being watched closely by security researchers, since a leak of Clop’s internal logs could expose details about the gang’s operations, victims, or members.
What ShinyHunters says it took
According to statements the group gave to BleepingComputer, the intrusion went beyond a simple defacement. ShinyHunters claims it obtained the private keys to Clop’s Tor onion service, meaning it could theoretically keep the same .onion address running even if Clop tries to lock the group out.
| Claimed item obtained | Description |
|---|---|
| Source code | Underlying code for Clop’s leak site |
| Grav CMS plugins | Software components running the site |
| System logs | Records of server activity |
| /var/log files | Possible authentication logs and visitor IP addresses |
| Tor onion private keys | Could allow control of Clop’s existing .onion address |
None of these claims have been independently verified, and they rest entirely on statements from ShinyHunters itself.
The defacement message
Visitors to Clop’s site reportedly found it replaced with ShinyHunters branding, including an ASCII rendering of the Pokemon character Umbreon, which the group uses as a logo, and a link to ShinyHunters’ own leak platform. A message on the page read “rooting your systems since ’19 ;)”. A separate uploaded file carried a warning aimed at Clop: “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p – Maybe don’t try to threaten us next time.” The defaced page was reportedly still live at the time of the original report.
Origins of the dispute
ShinyHunters attributes the attack to a personal conflict rather than a random hit. The group told BleepingComputer that during Clop’s 2025 campaign exploiting Oracle E-Business Suite, someone claiming to represent Clop messaged ShinyHunters directly with a threat, which the group says it is quoting translated from Russian: “I have more money than you and all of your people combined, I’ll kill you soon.” ShinyHunters says the retaliatory hack is a direct response to that threat and to alleged threats to expose the identities of its members.
Why this matters beyond two rival gangs
Conflicts between cybercriminal groups are not new, but when one ransomware operation’s internal logs and infrastructure end up in a rival’s hands, the fallout can spill over to victims and researchers alike. Leaked server logs could reveal technical details about how Clop’s leak site operated, and any further data dump would need independent verification before its contents can be treated as reliable.
