ShinyHunters Claim Hack of Rival Ransomware Gang Clop
ShinyHunters hacked rival ransomware gang Clop, defacing its leak site and claiming to have stolen operational data and private keys.
The ShinyHunters hacking group has claimed a cyber-attack against the Clop ransomware group, defacing its dark web data leak site. ShinyHunters claims to have stolen private keys, server data, and authentication logs that could reveal Clop's operational details and member IP addresses. The incident stems from a feud that began in 2025 over the use of a zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite, which both groups exploited for data theft and extortion campaigns.
- ShinyHunters claimed a hack against rival ransomware gang Clop.
- Attack involved defacing Clop's dark web data leak site.
- ShinyHunters claimed to have stolen private keys, server data, and authentication logs.
- Feud originated in 2025 over the use of a zero-day in Oracle E-Business Suite (CVE-2025-61882).
Vulnerabilities mentionedAll →
- CVE-2025-618829.8100%Unauthenticated Takeover of Oracle E-Business Suite Concurrent Processingpublished · Oracle E-Business Suite (Oracle Concurrent Processing, BI Publisher Integration component) KEV ransomware
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Full article470 words · extracted from infosecurity-magazine.com · click to collapse
The ShinyHunters hacking and extortion gang has claimed a cyber-attack against a fellow cybercriminal outfit, the Clop ransomware group.
The incident, which came to light on the evening of 18 September, saw Clop’s dark web data leak site defaced with a message which said “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS”. The background of the site was also changed to ASCII artwork of a Pokémon.
ShinyHunters claimed to have stolen private keys and server data used to run Clop’s ransomware operations. The message left behind on the Clop website also contained a link to ShinyHunters’ own data leak site.
The alleged gang-on-gang attack was first reported by Bleeping Computer. ShinyHunters told the publication they had stolen files which could reveal activity, authentication logs and even the IP addresses of Clop members who connected to the service. That could potentially be used to identify members of the Clop ransomware gang.
Despite Clop being another criminal hacking gang, ShinyHunters are treating them like any other victim and have issued a ransom note telling Clop to contact them.
When questioned by Bleeping Computer about what they planned to do with the access they had to Clop, the attacker reportedly replied, “going to extort them.”
Feud Between Hacking Gangs
The ShinyHunters attack against Clop appears to be the latest stage in a feud between the two criminal extortion groups which began in 2025.
The origins of the row centered around competing claims over ownership of vulnerabilities in Oracle E-Business Suite servers. This included the zero-day CVE-2025-61882 which was used by both groups to steal data from organizations in blackmail and extortion campaigns.
"This is a useful reminder that cybercriminal groups are not a single, coordinated ecosystem; they are competitive businesses driven by trust, reputation and money,” said Javvad Malik, lead CISO advisor at KnowBe4.
“When relationships are built on deception and fear, double-crossing and betrayal is always a credible threat. For defenders, it reinforces the need to understand not just the technology, but the motivations and behaviors of the people behind the attacks,” he added.
ShinyHunters is one of the most prolific cyber extortion groups of 2026, with significant campaigns against users of commonly deployed software-as-a-service providers including Salesforce Experience Cloud and Canvas Learning Management System.
ShinyHunters also recently claimed an attack on American healthcare giant McKesson, which wholesale medical supplies and pharmaceutical distribution to over 40,000 corporate and institutional customers.
The Clop ransomware group has been active since 2019 and has been responsible for a range of disruptive cyber-attacks. These incidents include a ransomware attack and data breach against the University of Phoenix which affected nearly 3.5 million people in December 2025.
Clop was also behind several ransomware attacks against major companies in 2023, which the group performed by exploiting a security vulnerability in MOVEit Transfer and MoveIT Cloud.