On September 19, 2026, the ShinyHunters group exploited an unauthenticated file upload vulnerability in the Grav CMS platform used by the Clop ransomware gang's data leak site. They uploaded a defacement message and subsequently replaced the site with their own content, including ASCII art and links to their own leak site. ShinyHunters claim to have gained full server access, stealing source code, plugins, system logs, and the private keys for Clop's Tor onion service, which would allow them to impersonate Clop's site. The attack is reportedly retaliation for threats made by Clop against ShinyHunters following disruptions to Clop's data theft campaigns, including a notable Oracle E-Business Suite exploitation campaign in 2025. ShinyHunters intend to extort Clop by demanding a large ransom. This event may indicate a trend toward more aggressive ransomware-on-ransomware attacks.

The defacement and alleged data theft compromise the integrity and confidentiality of Clop's leak site infrastructure. If ShinyHunters' claims about stealing private keys are accurate, they could impersonate Clop's Tor site, potentially disrupting Clop's operations and reputation. The public feud and extortion demands between ransomware groups could lead to increased instability and unpredictability in the ransomware ecosystem. However, there is no evidence of direct impact on victim organizations or broader infrastructure beyond the ransomware groups themselves. Independent verification of the full scope of data theft is pending.

No official patch or remediation applies as this is an attack between threat actor groups targeting each other's infrastructure. Defenders should monitor for potential fallout from this feud, but no direct mitigation steps are indicated for external organizations. The vendor advisory or authoritative source does not specify any required action. This incident highlights the importance of securing leak sites and associated infrastructure against unauthorized access and file upload vulnerabilities.