ShinyHunters Hacks Clop Leak Site, Threatens to Extort the Gang

The ShinyHunters extortion group has breached the Tor data leak site run by the Clop ransomware gang and defaced its front page. The group also claims to have stolen server logs, source code, and the private keys behind Clop's onion address. The attack began on the night of September 18, and it has turned one of the most prolific data theft operations of recent years into a target. ShinyHunters now says it plans to demand payment from Clop itself.

How ShinyHunters Broke Into Clop's Leak Site

ShinyHunters says it got in through an unauthenticated file upload vulnerability in Grav CMS, the content management system that powers Clop's leak site. The group first used the flaw to plant a small text file on the server. The note mocked Clop with the hashtag "#Skids10p", warned the gang not to threaten ShinyHunters again, and linked to ShinyHunters' own leak site.

Within hours, the attackers replaced the entire page. Visitors now see ASCII art of Umbreon, the Pokémon that ShinyHunters uses as its logo. The page also links to the group's Tor site and carries the line "rooting your systems since '19". Independent checks confirmed both the uploaded file and the defacement, and ShinyHunters says Clop's own infrastructure still serves the altered page.

Security researcher VXDB matched the Umbreon artwork to a 2020 defacement of the HackForums website, an attack ShinyHunters also claimed at the time. The match supports attribution, but it does not prove it on its own.

What ShinyHunters Claims It Took From Clop

Beyond the defacement, ShinyHunters claims it gained full access to the server hosting the Clop leak site. The group says it took source code, Grav CMS plugins, and every file in the server's /var/log directory.Those logs could hold authentication records and the IP addresses of people who connected to the server, including Clop operators and affiliates.

The most serious claim concerns Clop's Tor onion service keys. Whoever holds those private keys can host a site at the same onion address. If the keys are genuine, ShinyHunters could keep control of Clop's address even after Clop locks it out of the server.

Nobody has verified the theft claims yet. Outside observers can confirm only the uploaded file and the defaced page, and Clop has not responded publicly.

A 72-Hour Ultimatum

ShinyHunters has stated plainly what it intends to do with the data: extort Clop. The group said it would post a notice on its own leak site giving Clop 72 hours to make contact. That flips the model both gangs rely on, where stolen data and a public deadline push a victim toward paying.

How an Oracle Exploit Turned ShinyHunters Against Clop

ShinyHunters frames the attack as retaliation. The group says a Clop representative threatened to expose the identities of its members. ShinyHunters also claims the same person sent violent threats, including a message promising to kill one of its members. Nobody has independently verified these allegations.

The dispute traces back to Clop's 2025 campaign against Oracle E-Business Suite. Clop exploited several flaws in the platform, including the zero-day CVE-2025-61882, to steal data from organizations around the world. Around the same time, a group calling itself Scattered Lapsus$ Hunters, which includes ShinyHunters, leaked a proof-of-concept exploit. Oracle later confirmed it matched the exploit used in Clop's attacks.

ShinyHunters has long maintained that the exploit originally belonged to it and that Clop obtained it without permission. The Oracle campaign went on to hit universities, media outlets, and major consumer brands such as Estée Lauder. Now it sits at the center of a feud between two of the most prolific extortion groups operating today.

Two Gangs Built on Leak Sites

ShinyHunters has built its reputation on large-scale data theft. The group ran the 2024 Snowflake breach campaign and, this year, the Salesforce Aura data theft campaign against Experience Cloud customers. It has also claimed a long run of breaches at major companies across healthcare, telecoms, education, and travel.

Clop specializes in mass exploitation of enterprise software. It hit hundreds of organizations through the MOVEit Transfer zero-day in 2023, then through Oracle E-Business Suite. In 2026, it turned to a flaw in PTC Windchill and FlexPLM, listing Shell among dozens of new victims.

Both groups depend on their leak sites to pressure victims. A leak site is where the gang names a company, sets a deadline, and eventually publishes stolen files. So when ShinyHunters takes control of a Clop leak site, it strikes at the core tool of Clop's business.

Why a Hacked Clop Leak Site Matters to Past Victims

For organizations that Clop has already named, the onion key claim carries the most practical risk. If ShinyHunters controls Clop's address, a second criminal group could impersonate Clop, repost stolen data, or approach past victims with fresh demands. Any message that appears to come from Clop now deserves extra scrutiny before anyone responds.

The stolen server logs could also cut the other way. Authentication records and connection IPs from the Clop leak site may expose details about the gang's operators. That data would interest law enforcement if it ever surfaces, and ShinyHunters says it is still downloading and reviewing the material.

The entry point carries a lesson for defenders too. A single file upload flaw in a public-facing CMS handed attackers control of a server run by an experienced cybercrime operation. Organizations running Grav CMS or similar platforms should apply updates promptly and limit upload functions to authenticated users.

An Extortion Feud With No Clear End

The confirmed facts remain narrow: ShinyHunters planted a file on the Clop leak site and then defaced it. Everything else rests on ShinyHunters' own statements, including the stolen logs, the onion keys, and the threats behind the feud. The next few days should reveal if ShinyHunters follows through on its ultimatum.

Clop's next move matters just as much, because the gang could negotiate, retaliate, or rebuild its infrastructure elsewhere. For past victims of either group, the feud offers little comfort. Their stolen data still sits in criminal hands, and the rivalry adds one more party that may try to profit from it.