GoKawiilShinyHunters breaches Clop ransomware's leak site, defaces it and claims stolen data
The extortion group ShinyHunters says it exploited an unauthenticated file upload flaw in Grav CMS to compromise the Tor-based data leak site run by the Clop ransomware operation. The attackers uploaded a taunting message, later fully defaced the site with Pokémon-themed ASCII art, and claim to have exfiltrated source code, CMS plugins, system logs and other server files. BleepingComputer confirmed the defacement was live on Clop's infrastructure and that the uploaded file could be downloaded from the site.
GoKawiil's interpretation of the reporting above, not reported fact.
A rival cybercriminal group breaching a major ransomware operation's own infrastructure is an unusual escalation that shows even extortion gangs are vulnerable to the same kind of attacks they use against victims. If ShinyHunters' claims of stolen source code and system logs hold up, it could expose Clop's internal tooling and operational details, potentially aiding defenders and law enforcement while also embarrassing a group that has extorted hundreds of organizations.
- ShinyHunters claims it exploited an unauthenticated file upload vulnerability in Grav CMS to compromise Clop's leak site.
- The site was defaced with a taunting message and Pokémon-themed ASCII art, and remained altered at time of reporting.
- ShinyHunters says it stole source code, CMS plugins, system logs and other files from Clop's server, though full verification is pending.
Source: bleepingcomputer.com, 2026-09-19
Published there as: “ShinyHunters hacks Clop leak site, threatens to extort ransomware gang”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.