Extortion Group Hacks Clop Ransomware Operation's Tor Site
The ShinyHunters extortion gang breached the Clop ransomware operation's data leak site on Friday night, defacing the Tor page and claiming to have stolen server data and the private keys for its onion service. BleepingComputer confirmed the defacement and an earlier uploaded file. ShinyHunters says the breach is retaliation for alleged threats made by Clop after a dispute over exploit code in 2025, and the group now plans to extort the ransomware operation within 72 hours.
File Upload Through Grav CMS Vulnerability
ShinyHunters exploited what they describe as an unauthenticated file upload flaw in Grav CMS on Friday night. They uploaded a small text file containing the message "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time" and a link to their own leak site. BleepingComputer verified that the file was hosted on Clop's Tor server and could be downloaded directly.
Site Defacement With Group Logo
Hours after the initial upload, ShinyHunters replaced Clop's leak site with a defacement page displaying ASCII art of Umbreon, the Pokemon used as ShinyHunters' logo, along with the message "rooting your systems since '19 ;)". BleepingComputer confirmed the defaced page was still served from Clop's infrastructure at the time of the report. Researcher VXDB noted that the same Umbreon artwork appeared when ShinyHunters claimed credit for defacing HackForums in August 2020.
Claims of Stolen Server Data
ShinyHunters told BleepingComputer they gained full access to the server and stole source code, Grav CMS plugins, and system logs from the /var/log directory. Those logs could contain system activity, authentication records and potentially IP addresses of those who connected to the site. The group also claims to have obtained the private keys for Clop's Tor onion service. BleepingComputer has not independently verified the theft of logs, source code or onion keys.
Extortion Threat Against Ransomware Operation
When asked about their plans, ShinyHunters replied, "Going to extort them." The group says it will post a message on its own leak site instructing Clop to contact them within 72 hours. This reverses the usual dynamic in which ransomware operations extort victims. ShinyHunters says it is still reviewing the data it claims to have taken from the server.
Dispute Over Oracle Exploit Code
ShinyHunters says the attack is retaliation for alleged threats made by a Clop representative after a dispute in October 2025. At that time, Clop exploited multiple vulnerabilities in Oracle E-Business Suite servers, including a zero-day tracked as CVE-2025-61882, to steal data from organizations. Threat actors identifying as "Scattered Lapsus$ Hunters," which included ShinyHunters, released a proof-of-concept exploit during the same period. Oracle later confirmed it matched an exploit used in the Clop attacks. ShinyHunters told BleepingComputer the exploit had originally belonged to them and that Clop obtained it without authorization.
Alleged Threats Escalated Tensions
ShinyHunters alleges that tensions escalated when a Clop representative sent threatening messages following the Oracle campaign. According to ShinyHunters, the representative sent messages that included statements about having more resources and making violent threats against ShinyHunters members. BleepingComputer has not independently verified these allegations and contacted Clop but had not received a response at the time of the report.
Questions readers ask
What did ShinyHunters do to the Clop leak site?
ShinyHunters exploited a file upload vulnerability to upload a proof-of-access file, then defaced the entire site with ASCII art and a message. BleepingComputer confirmed the defacement was served from Clop's Tor infrastructure.
What data does ShinyHunters claim to have stolen?
ShinyHunters claims it stole source code, Grav CMS plugins, system logs from /var/log, and the private keys for Clop's Tor onion service. BleepingComputer has not independently verified these claims.
Why is ShinyHunters targeting a ransomware group?
ShinyHunters says the attack is retaliation for alleged threats made by a Clop representative during a dispute over exploit code. The dispute began in October 2025 after ShinyHunters leaked an Oracle E-Business Suite exploit that Clop was using.
What could ShinyHunters do with onion private keys?
If the keys are valid, ShinyHunters could host a Tor site at Clop's existing onion address from servers they control, potentially impersonating the ransomware group's infrastructure or taking over the address entirely.
How did ShinyHunters gain access to the site?
ShinyHunters exploited what they describe as an unauthenticated file upload vulnerability in Grav CMS, the content management system running on Clop's leak site. BleepingComputer confirmed that a file was successfully uploaded to the server.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.