‘Cyber criminal groups suffer from the same security weaknesses they routinely exploit’: ShinyHunters claims it hacked Clop ransomware rival
An attack on the cyber crime gang could prove dangerous for previous victims if data leaks, experts have warned
A battle has broken out between a pair of cyber crime groups, highlighting how even hackers need to be wary of vulnerabilities in their infrastructure.
ShinyHunters, known for a series of devastating attacks in recent years, claims it has taken over the website and infrastructure of rival hacking group, Clop. The incident appears to be in response to a threat from Clop and part of a wider disagreement between the two hacking groups.
"We basically own them now," ShinyHunters said via an online chat conversation with Reuters. Clop's dark web site appears to remain offline and the targeted group has yet to make a public statement.
ShinyHunters used an unauthenticated file upload flaw in Grav CMS, leveraging the flaw by uploading a text file to the Clop site, according to a report in Bleeping Computer, which said the file included a warning against "threatening" ShinyHunters.
The attackers later defaced the Clop site with ASCII art, and added their rivals to the list of victims on its data leak list, the report added, with a note asking for a ransom and apology in order to get the website back.
"Kindly excuse our unprofessionalism," the note added.
A funny twist, if true
Steven Thomson, senior SOC analyst at Barrier Networks, said the incident was a "funny twist", but added it should be viewed cautiously as ShinyHunters has “a lot to gain from the publicity surrounding the 'apparent' breach."
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
Jamie Akhtar, CEO and co-founder of CyberSmart, said the incident is a “striking reminder that cyber criminal groups suffer from the same security weaknesses they routinely exploit in legitimate organisations”.
"Clop’s alleged compromise appears to have moved beyond website defacement to the possible theft of source code, logs and Tor service keys, potentially exposing both its infrastructure and operational methods."
William Wright, CEO of Closed Door Security, echoed Akhtar’s comments, particularly given that Clop has an “extensive track record” of waging supply chain attacks.
“The group’s site getting hacked through similar means shows that not even experienced threat actors are immune to such attacks,” he said.
ShinyHunters and Clop competing for dominance
In recent years, ShinyHunters has emerged as one of the most aggressive ransomware groups globally. In February this year, Google sounded the alarm over a ShinyHunters vishing campaign which targeted corporate environments.
Weeks later, Salesforce warned customers after ShinyHunters claimed to have breached its Experience Cloud. Notably, the group claimed responsibility for a devastating attack on education platform Canvas that impacted universities around the world.
Clop, meanwhile, has been a notorious player on the ransomware scene for several years.
The group has run a series of highly damaging campaigns in recent years, targeting everything from print management software to the MOVEit File Transfer system to gain access.
That prolific activity hasn't left the two groups too busy for infighting, it would seem.
Javvad Malik, Lead CISO Advisor at KnowBe4, said the incident was a timely reminder that cyber crime gangs are competitive businesses.
"When relationships are built on deception and fear, double-crossing and betrayal is always a credible threat," Malik said. "For defenders, it reinforces the need to understand not just the technology, but the motivations and behaviours of the people behind the attacks."
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Freelance journalist Nicole Kobie first started writing for ITPro in 2007, with bylines in New Scientist, Wired, PC Pro and many more.
Nicole the author of a book about the history of technology, The Long History of the Future.
-
Cyber teams are being pushed to breaking point – and AI is doing little to alleviate strainNews An increasingly perilous threat landscape and lack of funding means cyber teams are being stretched too thin
-
AI skills investment could boost the UK economy by £80 billionNews Researchers are calling for a Skills Tax Credit to incentivize employers
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals