ShinyHunters hacks and defaces Cl0p · Will this shift the ransomware…

On Sept 19th the ransomware group ShinyHunters managed to hack into and deface the TOR leak site of Cl0p ransomware. After the initial defacement ShinyHunters has posted a number of messages for Cl0p to negotiate and pay them a sum of 8 figures. In the articles I have read it is said that this was happening due to a feud due to threats made by Cl0p against Shiny Hunters. It has been interesting watching this all develop.

In March of 2025 I also watched as the news that Dragonforce defaced the leak site of Mamona(Prev Blacklock) came out and everything saying it was also tied to a feud with Blacklock code being an almost exact match for Dragonforce.

Which has me curious, as even though this is not the first time we have seen this style of defacement, it is still very uncommon. Everything I have seen the groups tend to stay separate and keep things offline. My question is, are we seeing a shift in the environment from that to straight up attacks from groups, and will ShinyHunters success in this set precedent for other groups to take a more aggressive approach to solving feuds between groups?

I ask as i have seen precedent adjust the ransomware environment a lot. Ransomware as whole used to not touch hospitals, then one started hitting hospitals and then almost all were. The ransomware affiliate payment used to be not as good, then the 80/20 model started and most groups adopt that. So wanting to get peoples opinions on if you think we will see more of these ransomware on ransomware attacks in the future, or if these are one off outliers.

Source:

Impact

The defacement and alleged data theft compromise the integrity and confidentiality of Clop's leak site infrastructure. If ShinyHunters' claims about stealing private keys are accurate, they could impersonate Clop's Tor site, potentially disrupting Clop's operations and reputation. The public feud and extortion demands between ransomware groups could lead to increased instability and unpredictability in the ransomware ecosystem. However, there is no evidence of direct impact on victim organizations or broader infrastructure beyond the ransomware groups themselves. Independent verification of the full scope of data theft is pending.

Defensive guidance

Defenders should monitor for potential fallout from this feud, but no direct mitigation steps are indicated for external organizations. The vendor advisory or authoritative source does not specify any required action. This incident highlights the importance of securing leak sites and associated infrastructure against unauthorized access and file upload vulnerabilities.

Summary

On September 19, 2026, the ShinyHunters group exploited an unauthenticated file upload vulnerability in the Grav CMS platform used by the Clop ransomware gang's data leak site. They uploaded a defacement message and subsequently replaced the site with their own content, including ASCII art and links to their own leak site. ShinyHunters claim to have gained full server access, stealing source code, plugins, system logs, and the private keys for Clop's Tor onion service, which would allow them to impersonate Clop's site. The attack is reportedly retaliation for threats made by Clop against ShinyHunters following disruptions to Clop's data theft campaigns, including a notable Oracle E-Business Suite exploitation campaign in 2025. ShinyHunters intend to extort Clop by demanding a large ransom. This event may indicate a trend toward more aggressive ransomware-on-ransomware attacks.

ShinyHunters hacks and defaces Cl0p · Will this shift the ransomware environment?

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 21 Sep 2026, 17:01 UTC

Technical details

References

Community reviews

Related threats