ShinyHunters Breaches Clop Ransomware Site, Initiates Extortion Threat

• •ShinyHunters exploited a vulnerability in Grav CMS to breach Clop's site.
• •The gang claims to have stolen sensitive data including source code and onion service keys.
• •ShinyHunters is demanding a response from Clop within 72 hours or face extortion.

The ShinyHunters extortion gang successfully hacked the Clop ransomware operation's data leak site, exploiting an unauthenticated file upload vulnerability in Grav CMS. They defaced the site with their branding and a warning message, claiming to have stolen sensitive data including source code, system logs, and private keys for Clop's Tor onion service. ShinyHunters has threatened to extort Clop, demanding a response within 72 hours. The attack is reportedly linked to a prior dispute over Clop's Oracle E-Business Suite data theft campaign. BleepingComputer confirmed the defacement and the claims of data theft, although the full extent of the stolen data remains unverified. The defaced site continues to display ShinyHunters' artwork and messages. This incident highlights the ongoing rivalry and conflicts between cybercrime groups.