ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
ShinyHunters exploited a Grav CMS file upload flaw to breach and deface the Clop ransomware gang's leak site, claiming theft of source code, logs, and Tor private keys.
The ShinyHunters extortion gang exploited a claimed unauthenticated file upload vulnerability in Grav CMS to upload a taunting file and completely deface the Clop ransomware operation's Tor data leak site with Umbreon ASCII art. ShinyHunters claims it gained full server access, stealing source code, Grav CMS plugins, /var/log files, and the private keys for Clop's onion service, and plans to extort Clop with a 72-hour deadline. The feud reportedly stems from Clop's 2025 Oracle E-Business Suite extortion campaign, which used the zero-day CVE-2025-61882 and an exploit ShinyHunters says was stolen from them. BleepingComputer confirmed the defacement but could not verify the data theft or key theft claims.
- ShinyHunters exploited a claimed unauthenticated file upload flaw in Grav CMS to deface Clop's Tor leak site.
- Claims theft of source code, CMS plugins, server logs, and Clop's onion service private keys.
- Group plans to extort Clop, demanding contact within 72 hours via its own leak site.
- Feud traces to Clop's 2025 Oracle EBS campaign using zero-day CVE-2025-61882.
- Umbreon defacement matches ShinyHunters' claimed 2020 HackForums defacement.
- CVEs
- CVE-2025-61882
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1491.002 External DefacementT1005 Data from Local SystemT1552.004 Private Keys
- Products
- Oracle E-Business Suite
- Threat actors
- ShinyHuntersClopScattered Lapsus$ Hunters
- Organizations
- HackForums
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-61882 | Unauthenticated Takeover of Oracle E-Business Suite Concurrent Processing | 9.8 | 100% | KEVRansomware | KEV |
From the original article
4 min read at bleepingcomputer.com
The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.