GoKawiilShinyHunters breach Clop's dark web leak site, demand extortion payment
ShinyHunters, a data-theft and extortion group, defaced rival ransomware gang Clop's dark web leak portal over the weekend, claiming to have exploited an unpatched file-upload flaw in the site's Grav CMS. The attackers say they stole Clop's source code, plugins, system logs and private encryption keys, and are now demanding an unspecified eight-figure Bitcoin payment from Clop while threatening to expose details of victims who paid ransoms.
GoKawiil's interpretation of the reporting above, not reported fact.
Clop is responsible for some of the largest extortion campaigns in recent memory, including the MOVEit and GoAnywhere zero-day attacks, so any leaked internal data could expose confidential details about which organizations paid ransoms and how much. This rare gang-on-gang breach shows that even sophisticated cybercriminal infrastructure is vulnerable, and it could inadvertently expose sensitive victim information that both criminal groups have strong incentives to keep hidden.
- ShinyHunters claims to have breached Clop's leak site using an unpatched Grav CMS vulnerability.
- Stolen data reportedly includes source code, private keys, and system logs, though claims remain unverified.
- Victims of Clop's past campaigns could face new exposure if extortion details are leaked publicly.
YubiKey 5C NFC Security Key — With ransomware gangs like Clop exploiting file-transfer vulnerabilities and stolen credentials to breach organizations, hardware-backed multi-factor authentication is one of the strongest defenses available. A YubiKey adds phishing-resistant protection to your accounts, making it far harder for attackers to pivot into your systems even if passwords leak.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Alexander Culafi, 2026-09-21
Published there as: “ShinyHunters Hacked Clop. Now What About Clop's Victims?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.