Shiny Hunters Targets Clop as Police Arrest Alleged Leader
· 23:55 · Watch on YouTube ↗
Summary
The panel discusses Shiny Hunters' reported takeover of Clop's leak site, the arrest of an alleged group leader, and the group's claims about FBI data, alongside guidance for assessing extortion activity.
Key points
- The panel says Shiny Hunters exploited an unauthenticated file-upload flaw in Clop's unpatched Grab CMS installation, defacing its leak site and taking over its onion address.
- Shiny Hunters claimed the dispute arose from Clop taking revenue from an Oracle EBS campaign and demanded an eight-figure payment and an apology.
- Dutch police arrested Pippin van der Stopp, whom authorities allege is a Shiny Hunters leader responsible for more than $70 million in extortion across over 140 organizations since 2025.
- The panel says Shiny Hunters claimed to have stolen two to three terabytes of personal and health information through fbi[.]jobs[.]gov and shared a sample of about 5,000 records. The group later denied financial motivation.
- The speakers advise defenders to prioritize observable actions, including whether data left the network, which third-party integrations were used and whether access has been revoked.
Article Details
- Topics
- [02:30] Shiny Hunters' reported takeover of Clop's leak site
- [05:23] Alleged dispute over Oracle EBS campaign proceeds
- [11:03] Arrest of an alleged Shiny Hunters leader and FBI response
- [13:10] Third-party compromise and help desk social engineering
- [17:41] Shiny Hunters' claims about FBI data and subsequent statement
- [20:45] Assessing threat-actor claims against observable evidence
MITRE ATT&CK
People
Brett LeathermanFBI Cyber Division Assistant Director who publicly urged remaining Shiny Hunters members to contact authorities.Dave BalesVideo panelist discussing the leak-site takeover and incident-response priorities.Eric AnarchyVideo panelist discussing law enforcement's response to Shiny Hunters.Evil MogVideo panelist discussing threat-actor infrastructure and attribution challenges.Nick BradleyVideo presenter discussing the Shiny Hunters and Clop incidents.
Threat Actors
ClopExtortion group whose leak site was reportedly taken over by Shiny Hunters; the speakers associate it with exploitation of enterprise file-transfer software.Pippin van der StoppArrested in Amsterdam; authorities allege he is a Shiny Hunters leader responsible for extortion affecting more than 140 organizations.Shiny HuntersThe group reportedly took over Clop's leak site and claimed to have obtained FBI-related personal and health information.