ShinyHunters exploited an unauthenticated file upload vulnerability in the Grav CMS powering Clop ransomware's data leak site to gain full server access. They uploaded a text file with a message to Clop, defaced the Tor site with their logo, and claim to have stolen source code, Grav CMS plugins, system logs, and the private keys for Clop's Tor onion service. Possession of the onion private keys would allow ShinyHunters to host a site at Clop's onion address, undermining Clop's control of their leak site. ShinyHunters plans to extort Clop with the stolen data. The attack is reportedly retaliation for threats made by Clop representatives during a feud between the groups, which began after Clop exploited Oracle E-Business Suite vulnerabilities in 2025. Independent verification of the data theft claims beyond the defacement and file upload is pending.

If ShinyHunters' claims are accurate, they have compromised Clop's leak site infrastructure, potentially exposing sensitive source code, system logs, and private keys. This undermines Clop's operational security and ability to control their Tor onion service, allowing ShinyHunters to impersonate Clop's site. The breach may disrupt Clop's ransomware extortion campaigns and damage their reputation. Additionally, stolen system logs could reveal information about Clop's operations and contacts. The incident highlights risks of vulnerabilities in third-party CMS software used by threat actors.

No official patch or remediation is applicable to this incident as it involves a compromise of a criminal group's infrastructure. The vulnerability exploited was an unauthenticated file upload in Grav CMS, which should be patched or mitigated by legitimate users of the software. Organizations using Grav CMS should ensure they apply security updates and harden file upload mechanisms. For defenders, monitoring for similar exploitation attempts and securing CMS instances against unauthenticated uploads is recommended. Since this is a conflict between threat actors, no direct mitigation for defenders is available beyond general CMS security best practices.