Skip to content
OriginalSign in
Image: Malwarebytes

Malwarebytes

ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Victims

Part of the Cl0p story · since 28 Aug 2025

Quiet for 2 weekslast report 27 Oct12 articles7 outlets
28 Aug · Dark Reading first3 Apr16 Jun29 AugNowThis article8th of 12
  • Thu 28 Aug, 21:10 UTC. Dark Reading, first report. Akira, Clop Top List of 5 Most Active Ransomware-as-a-Service Groups.
  • Tue 21 Jul, 11:20 UTC. SecurityWeek, its first report on the story. Estée Lauder alerts staff after Oracle EBS flaw leaks 870GB.
  • Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
  • Sat 25 Jul, 12:00 UTC. The Hacker News, its first report on the story. Cl0p exploits PTC Windchill flaw for unauthenticated RCE.
  • Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
  • Fri 21 Aug, 08:20 UTC. Security Affairs, its first report on the story. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 11:01 UTC. Malwarebytes, its first report on the story. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Victims. This article, 8th of 12.
  • Mon 21 Sep, 15:01 UTC. SOCRadar, its first report on the story. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 20:53 UTC. Dark Reading. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 15:18 UTC. SecurityWeek. BragJack Lets Malicious Extensions Hijack Browser AI Assistants.
  • Tue 27 Oct, 15:02 UTC. SOCRadar. ShinyHunters claims FBI breach as Clop leak site is hijacked.

ShinyHunters has reportedly breached and taken control of the Clop ransomware group’s dark-web leak site, escalating a feud between two cybercrime operations. Malwarebytes said the site displayed a ShinyHunters message demanding payment from Clop, a public apology and money allegedly made from its Oracle E-Business Suite (EBS) campaign. The message also threatened to publish information about companies that paid Clop, the amounts involved and the Bitcoin addresses used.

According to reporting cited by Malwarebytes, the attack began on Friday night when ShinyHunters exploited what it claimed was an unauthenticated file-upload vulnerability in the site’s Grav CMS, uploading a small text file before later defacing the site. ShinyHunters also claimed it had obtained Clop’s onion private keys, which would allow it to continue hosting the same onion address even if Clop removed its access. These technical and access claims are attributed to ShinyHunters and have not been independently confirmed in the article.

The groups’ conflict allegedly began after ShinyHunters disrupted a Clop data-theft campaign. ShinyHunters said a Clop representative subsequently threatened to identify and kill its members. The incident illustrates that criminal groups’ own exposed infrastructure can be vulnerable to the same weaknesses they exploit elsewhere, although the article provides no evidence that legitimate organisations were affected by this particular takeover.

How the story developed

All 12 articles
Quiet for 2 weekslast report 27 Oct12 articles7 outlets

12 articles from 7 outlets since 28 Aug. Quiet since 27 Oct. This was the 8th report, 389 days after the first.

Now28 Aug17 Jul3181626411192981626First reportDark Reading · 28 Aug, 21:10This article8th of 12 · day 389Exploited CVEDataBreaches · 24 Jul
  • Thu 28 Aug, 21:10 UTC. Dark Reading, first report. Akira, Clop Top List of 5 Most Active Ransomware-as-a-Service Groups.
  • Tue 21 Jul, 11:20 UTC. SecurityWeek, its first report on the story. Estée Lauder alerts staff after Oracle EBS flaw leaks 870GB.
  • Fri 24 Jul, 12:51 UTC. DataBreaches, its first report on the story. Clop ransomware hits Windchill via CVE-2026-12569 flaw. Cites a CVE in CISA KEV.
  • Sat 25 Jul, 12:00 UTC. The Hacker News, its first report on the story. Cl0p exploits PTC Windchill flaw for unauthenticated RCE.
  • Mon 27 Jul, 13:31 UTC. SecurityWeek. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw. Cites a CVE in CISA KEV.
  • Wed 19 Aug, 11:32 UTC. SecurityWeek. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign. Cites a CVE in CISA KEV.
  • Fri 21 Aug, 08:20 UTC. Security Affairs, its first report on the story. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 11:01 UTC. Malwarebytes, its first report on the story. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Victims. This article, 8th of 12.
  • Mon 21 Sep, 15:01 UTC. SOCRadar, its first report on the story. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets. Cites a CVE in CISA KEV.
  • Mon 21 Sep, 20:53 UTC. Dark Reading. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 15:18 UTC. SecurityWeek. BragJack Lets Malicious Extensions Hijack Browser AI Assistants.
  • Tue 27 Oct, 15:02 UTC. SOCRadar. ShinyHunters claims FBI breach as Clop leak site is hijacked.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Thu 28 AugDay 01
    1. Akira, Clop Top List of 5 Most Active Ransomware-as-a-Service Groups21:10 · Dark Reading · First report

  2. Quiet for 47 weeks

    Tue 21 JulDay 3271
    1. Estée Lauder alerts staff after Oracle EBS flaw leaks 870GB11:20 · SecurityWeek · Picked up again

  3. Quiet for 3 days

    Fri 24 JulDay 3301
    1. Clop ransomware hits Windchill via CVE-2026-12569 flaw12:51 · DataBreaches · Exploited CVE · Picked up again · Known exploited CVE
  4. Sat 25 JulDay 3311
    1. Cl0p exploits PTC Windchill flaw for unauthenticated RCE12:00 · The Hacker News

  5. Quiet for 2 days

    Mon 27 JulDay 3331
    1. Cl0p Gang Hits PTC Windchill via CVE-2026-12569 Flaw13:31 · SecurityWeek · Picked up again · Known exploited CVE

  6. Quiet for 3 weeks

    Wed 19 AugDay 3561
    1. Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Campaign11:32 · SecurityWeek · Picked up again · Known exploited CVE

  7. Quiet for 2 days

    Fri 21 AugDay 3581
    1. Cl0p ransomware exploits PTC Windchill flaw, hits Shell, Philips08:20 · Security Affairs · Known exploited CVE

  8. Quiet for 4 weeks

    Mon 21 SepDay 3893
    1. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Victims11:01 · Malwarebytes · Picked up again · This article, 8th of 12
    2. ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets15:01 · SOCRadar · Known exploited CVE
    3. ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin20:53 · Dark Reading · Known exploited CVE

  9. Quiet for 4 days

    Fri 25 SepDay 3931
    1. BragJack Lets Malicious Extensions Hijack Browser AI Assistants15:18 · SecurityWeek · Picked up again

  10. Quiet for 5 weeks

    Tue 27 OctDay 4251
    1. ShinyHunters claims FBI breach as Clop leak site is hijacked15:02 · SOCRadar · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in