ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

The ShinyHunters extortion group breached the Clop ransomware gang's data leak site by exploiting an unauthenticated file upload vulnerability in Grav CMS. They defaced the Tor site, uploaded a taunting message, and claim to have stolen server data including source code, Grav CMS plugins, system logs, and the private keys for Clop's Tor onion service. The stolen private keys could allow ShinyHunters to impersonate Clop's onion site. ShinyHunters intends to extort Clop using the stolen data. This attack appears to be part of an ongoing feud between the two cybercrime groups dating back to 2025.

• bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/ (opens in a new tab)

• Google Brotli · 2nd November · Threat Intelligence ReportExploitedBreach2026-11-02
• Bulletproof Host Virtualine Loses Its Domain to FBI SeizureNews2026-10-30
• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• A quiet week in infosec <.<HighVulnerability2026-10-29
• IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor AssessmentNews2026-10-29