Skip to content
OriginalSign in

DataBreachesDissent

ShinyHunters Claims It Breached and Defaced Clop’s Leak Site

Part of the CVE-2025-61882 story · since 4 Feb

Quiet for 6 dayslast report 28 Oct8 articles7 outlets
4 Feb · Dark Reading first20 Jun5 Aug20 SepNowThis article4th of 8
  • Wed 4 Feb, 22:25 UTC. Dark Reading, first report. CISA Makes Unpublicized Ransomware Updates to KEV Catalog. Cites a CVE in CISA KEV.
  • Tue 3 Mar, 16:40 UTC. Security Affairs, its first report on the story. MSG data breach tied to Cl0p's Oracle flaw CVE-2025-61882. Cites a CVE in CISA KEV.
  • Mon 23 Mar, 15:10 UTC. SecurityWeek, its first report on the story. M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds. Cites a CVE in CISA KEV.
  • Sat 19 Sep, 14:25 UTC. DataBreaches, its first report on the story. ShinyHunters Claims It Breached and Defaced Clop’s Leak Site. Cites a CVE in CISA KEV. This article, 4th of 8.
  • Mon 21 Sep, 12:49 UTC. Infosecurity, its first report on the story. ShinyHunters Claims It Hacked and Extorted Clop Ransomware Group. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 15:01 UTC. SOCRadar, its first report on the story. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 20:53 UTC. Dark Reading. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 15:00 UTC. The Hacker News, its first report on the story. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution. Cites a CVE in CISA KEV.

The ShinyHunters extortion gang allegedly breached Clop (also known as Cl0p) ransomware’s Tor-based data leak site, defacing it and reportedly stealing server data and the private keys for its onion service. According to the report, the attack began on Friday night when ShinyHunters exploited what it described as an unauthenticated file-upload vulnerability in Grav CMS. The attackers uploaded a small text file containing a message warning Clop not to threaten them and linking to ShinyHunters’ own leak site.

The incident appears connected to an earlier dispute over CVE-2025-61882, a zero-day vulnerability that Clop allegedly used to attack Oracle E-Business Suite servers. ShinyHunters previously claimed that the vulnerability was theirs and that Clop had used it without permission.

The group has now alleged that someone associated with Clop threatened them during last year’s Oracle E-Business Suite campaign, reportedly saying: “I have more money than you and all of your people combined, I’ll kill you soon.” The report stresses that several aspects of the dispute remain unclear, including why ShinyHunters responded only now. The claims of stolen server data and private keys, as well as the details of the Grav CMS vulnerability, have not been independently confirmed in the supplied material.

How the story developed

All 8 articles
Quiet for 6 dayslast report 28 Oct8 articles7 outlets

8 articles from 7 outlets since 4 Feb. Quiet since 28 Oct. This was the 4th report, 227 days after the first.

Now4 Feb1725411182617 Sep2961321First reportDark Reading · 4 Feb, 22:25This article4th of 8 · day 227
  • Wed 4 Feb, 22:25 UTC. Dark Reading, first report. CISA Makes Unpublicized Ransomware Updates to KEV Catalog. Cites a CVE in CISA KEV.
  • Tue 3 Mar, 16:40 UTC. Security Affairs, its first report on the story. MSG data breach tied to Cl0p's Oracle flaw CVE-2025-61882. Cites a CVE in CISA KEV.
  • Mon 23 Mar, 15:10 UTC. SecurityWeek, its first report on the story. M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds. Cites a CVE in CISA KEV.
  • Sat 19 Sep, 14:25 UTC. DataBreaches, its first report on the story. ShinyHunters Claims It Breached and Defaced Clop’s Leak Site. Cites a CVE in CISA KEV. This article, 4th of 8.
  • Mon 21 Sep, 12:49 UTC. Infosecurity, its first report on the story. ShinyHunters Claims It Hacked and Extorted Clop Ransomware Group. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 15:01 UTC. SOCRadar, its first report on the story. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 20:53 UTC. Dark Reading. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 15:00 UTC. The Hacker News, its first report on the story. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Wed 4 FebDay 01
    1. CISA Makes Unpublicized Ransomware Updates to KEV Catalog22:25 · Dark Reading · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 4 weeks

    Tue 3 MarDay 271
    1. MSG data breach tied to Cl0p's Oracle flaw CVE-2025-6188216:40 · Security Affairs · Picked up again · Known exploited CVE

  3. Quiet for 3 weeks

    Mon 23 MarDay 471
    1. M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds15:10 · SecurityWeek · Picked up again · Known exploited CVE

  4. Quiet for 26 weeks

    Sat 19 SepDay 2271
    1. ShinyHunters Claims It Breached and Defaced Clop’s Leak Site14:25 · DataBreaches · Picked up again · Known exploited CVE · This article, 4th of 8

  5. Quiet for 2 days

    Mon 21 SepDay 2293
    1. ShinyHunters Claims It Hacked and Extorted Clop Ransomware Group12:49 · Infosecurity · Known exploited CVE
    2. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets15:01 · SOCRadar · Known exploited CVE
    3. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin20:53 · Dark Reading · Known exploited CVE

  6. Quiet for 5 weeks

    Wed 28 OctDay 2661
    1. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution15:00 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in