ShinyHunters hacks rival extortion gang and takes over its dark web site
ShinyHunters claims it hacked rival extortion gang Clop's leak site via a Grav CMS flaw and seized its onion domain.
ShinyHunters reportedly breached the Clop ransomware gang's dark web leak site by exploiting a claimed unauthenticated file-upload vulnerability in Grav CMS, defacing it with an extortion note demanding money and a public apology. The group claims to control the onion service private keys and threatens to disclose which companies paid Clop and to what Bitcoin addresses, including during the Oracle EBS campaign. ShinyHunters, active since 2019, previously claimed stealing 3.65 TB of data on about 9,000 academic institutions from Instructure, while Clop's PTC Windchill campaign named over 40 victims including Shell and Philips.
- ShinyHunters exploited a claimed unauthenticated file-upload flaw in Grav CMS on Clop's site.
- Clop's dark web leak site was defaced and displays a ShinyHunters extortion note.
- ShinyHunters claims to hold the onion service private keys, ensuring continued control.
- Gang war allegedly began after ShinyHunters disrupted a Clop data-theft campaign.
- ShinyHunters threatens to expose Clop victims' ransom payments and Bitcoin addresses.
- Products
- Oracle EBSPTC Windchill
- Threat actors
- ShinyHuntersClop
- Victims
- InstructureShellPhilips
- Organizations
- BleepingComputer
From the original article
3 min read at malwarebytes.com
Hackers hacked the hackers as a feud between two cybercrime groups escalated, leaving ShinyHunters with the upper hand over rival Clop.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.