Cybersecurity
ShinyHunters breaches Clop leak site, threatens extortion
ShinyHunters said it used a Grav CMS upload flaw to deface Clop's Tor leak site and steal data, while BleepingComputer confirmed the defacement but not the broader theft claims.
- ShinyHunters said it broke into Clop's leak site on Friday night by using what it described as an unauthorised file upload flaw in Grav CMS.
- The group said it uploaded a text file that warned Clop and linked to ShinyHunters' own leak site.
- BleepingComputer confirmed the file and the defaced page, but not the claims of stolen logs, source code or onion private keys.
- ShinyHunters said it planned to extort Clop and to post a message telling the group to make contact within 72 hours.
- ShinyHunters tied the dispute to Clop's 2025 Oracle E-Business Suite campaign and alleged threats from a Clop representative.
ShinyHunters said it broke into Clop's leak site on Friday night by exploiting what it described as a file upload flaw in Grav CMS. It said it placed a message on the site that warned Clop and linked to ShinyHunters' own leak page.
BleepingComputer confirmed the file had been uploaded and could be downloaded from Clop's Tor site. A few hours later, ShinyHunters told the outlet the site had been fully altered, and the page was shown with Umbreon ASCII art and a link to ShinyHunters' Tor site.
ShinyHunters said it had taken source code, Grav CMS plugins, system logs and other data, and it claimed to have the private keys for Clop's onion service. BleepingComputer said it had not verified those claims.
The group said it would use the material to extort Clop and would publish a message on its leak site asking the group to make contact within 72 hours. It said the breach was retaliation for threats it alleged had come from a Clop representative during an earlier dispute.
ShinyHunters linked that dispute to Clop's 2025 Oracle E-Business Suite campaign. The article said Clop had used multiple vulnerabilities in those servers, including CVE-2025-61882, in extortion campaigns.
Named in this story
People
- VXDB
- said the Umbreon artwork matched an earlier defacement
Organisations
- ShinyHunters
- said it breached Clop's leak site and claimed to have stolen data
- Clop (aka Cl0p)
- was the ransomware operation whose leak site was defaced
Products and systems
- Grav CMS
- was the software ShinyHunters said had an unauthorised upload flaw
- Oracle E-Business Suite
- was the campaign ShinyHunters linked the dispute to
How the source tells it
The article was mostly neutral and attribution-led, with mild conflict framing from the feud, retaliation and extortion language.
- retaliation drama the story is framed as a feud, with quoted threats and a 72-hour extortion deadline
- vandalism colour the defacement note and logo-led ASCII art supply the main theatrical detail