ShinyHunters Defaces Clop Leak Site, Claims Theft of Server Data and Onion Keys
Summary
BleepingComputer confirmed ShinyHunters defaced Clop’s leak site and uploaded a message. The group claims it stole server data and onion keys, but those claims and allegations about the feud remain unverified.
Key points
- ShinyHunters reportedly used an alleged unauthenticated Grav CMS file-upload flaw to place a message on Clop’s leak site.
- BleepingComputer confirmed the uploaded file and that the Tor site displayed a ShinyHunters defacement.
- ShinyHunters claims it accessed the server and stole source code, Grav CMS plugins, system logs, and Clop’s onion-service private keys; these claims were not independently verified.
- If valid, the claimed onion keys could allow the group to operate a site under Clop’s existing onion address.
- ShinyHunters said it plans to review the allegedly stolen data and extort Clop.
- The group described the attack as retaliation amid a dispute over Clop’s Oracle E-Business Suite extortion campaign and alleged threats; those allegations were not independently verified.
Article Details
- Victim Organization
- Clop
- Incident Type
- Website breach and defacement; ShinyHunters also claimed to steal server data and Clop's Tor onion-service private keys.
- Data Types Exposed
- Source code
- Grav CMS plugins
- System logs
- Tor onion-service private keys
- Operational Impact
- Clop's Tor data leak site was defaced. ShinyHunters claimed it had full server access and said valid onion private keys could let it operate a site at Clop's existing onion address; the key claim was not independently verified.
- Ransom Or Extortion
- ShinyHunters said it planned to extort Clop and planned to post a message instructing Clop to contact it within 72 hours. The source does not confirm that an extortion demand was delivered.
- Claim Status
- alleged
MITRE ATT&CK
People
Threat Actors
ClopRansomware operation whose data leak site was breached and defaced; ShinyHunters' claims of data theft and threats by a Clop representative were not independently verified.ShinyHuntersClaimed responsibility for breaching and defacing Clop's leak site and claimed to have stolen server data and onion-service private keys; the claimed data theft was not independently verified.