ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets

ShinyHunters reportedly hijacked and defaced Clop’s (also known as Cl0p) Tor-based data-leak site on 18 September 2026, turning the ransomware group’s extortion platform against it. The attackers allegedly exploited an unauthenticated file-upload vulnerability in Grav CMS, initially uploading a taunting text file before replacing the site with ShinyHunters branding and an “Umbreon” ASCII mascot.

By 19 September, ShinyHunters claimed it had also stolen Clop’s source code, plugins, server logs and Tor private keys, which could potentially allow control of the onion address on other infrastructure. Those theft claims have not been independently verified, although the defacement confirmed that ShinyHunters had obtained enough access to modify the site.

ShinyHunters demanded payment from Clop, initially setting a 72-hour deadline and later threatening to disclose alleged details of Clop’s 2025 Oracle E-Business Suite extortion campaign, including victims, ransom payments and cryptocurrency wallets. The dispute appears linked to claims that Clop used an Oracle EBS exploit that ShinyHunters said belonged to it.

Oracle disclosed critical pre-authentication remote-code-execution vulnerability **CVE-2025-61882**, affecting EBS versions 12.2.3 through 12.2.14, but Google Threat Intelligence Group said multiple exploit chains were involved and that there was insufficient evidence to connect the earlier activity directly to the publicly leaked exploit. A message attributed to Clop later appeared on the compromised site, reportedly seeking to resume contact, but did not address the demands. As of 21 September, the extent of ShinyHunters’ access and any stolen victim or payment records remained unverified.