Barry Cheevers

What Happened

On the evening of 18 September 2026, ShinyHunters defaced Clop’s Tor-hosted data leak site, replacing it with their signature Umbreon ASCII artwork and the message “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS”. BleepingComputer confirmed the defacement and an uploaded file independently, though it could not verify the broader data theft claims. ShinyHunters asserted they had taken source code, system logs, Grav CMS plugins, and the private keys for Clop’s Tor onion service, then gave Clop 72 hours to make contact before threatening to publish the material on their own leak site.

I wrote this up as a full investigation for Dispatch, and this post summarises the core findings and why I think they matter beyond the immediate incident. The full piece is available at https://www.anomali.com/blog/when-criminals-hack-criminals-shinyhunters-breach-of-clop-and-what-it-reveals-about-the-ransomware-underground.

The Entry Point Was Embarrassingly Basic

The technical detail here is worth dwelling on. ShinyHunters’ entry point was CVE-2024-27921, an unauthenticated file upload path traversal vulnerability in Grav CMS. That vulnerability was patched in Grav version 1.7.45. Clop was running its extortion infrastructure on an unpatched instance, publicly exposed on Tor.

The vulnerability chain documented in security research makes the exposure worse than the single CVE suggests. CVE-2024-27921 alone produces limited impact, but chained with CVE-2024-34082, a Server-Side Template Injection flaw enabling account takeover, combined with password reset poisoning via a manipulated HTTP Host header and abuse of Grav’s built-in Scheduler feature, an unauthenticated attacker can achieve full remote code execution. Grav stores all credentials and password reset tokens in flat YAML files with no database backend, so file-read access translates directly to account takeover without cracking a single password.

The group that chained zero-days in GoAnywhere MFT and MOVEit Transfer to compromise hundreds of organisations was running its own command-and-control infrastructure on an unpatched commodity CMS with publicly documented vulnerabilities. That is not a minor oversight. It reflects the operational complacency that sustained impunity tends to produce: when prosecution risk is low and revenue is reliable, patch cadence gets less attention than the next campaign.

The Secondary Exposure Problem for Victim Organisations

The more uncomfortable finding concerns organisations that previously paid Clop a ransom. Clop’s model was data-first: exfiltrate, threaten publication, negotiate, collect. That process generated records. Victim lists, negotiation transcripts, payment confirmation logs, and communications tied to specific organisations all likely existed on the infrastructure ShinyHunters claims to have accessed.

If those claims are even partially accurate, any organisation that paid Clop and trusted that their data was subsequently deleted is now in an uncertain position. ShinyHunters has demonstrated willingness to extort the original holder of that data. The downstream question is whether they will approach previously victimised organisations directly, sell the records, or publish them. The system logs from /var/log could also expose IP addresses of individuals who connected to Clop’s infrastructure, information with obvious value to law enforcement and rival groups alike. If the onion private keys are valid, ShinyHunters could operate a site at Clop’s existing .onion address from servers they control, enabling full impersonation of Clop’s negotiation infrastructure.

This Is a Pattern, Not an Anomaly

The incident fits a broader trend I document in the full piece. The RaaS trust model has been degrading for years, and there is direct forum evidence to support that. ALPHV defrauded affiliate “notchy” of their share of a $22 million ransom paid by a US healthcare provider, then staged a fabricated law enforcement takedown notice to cover their exit. LockBit failed to pay affiliate “michon” $4 million for corporate network access and was subsequently banned from the XSS and Exploit underground forums. DragonForce hacked Blacklock’s Tor infrastructure, defaced their sites, and published stolen configuration files before launching a cartel model requiring new affiliates to either produce a referral or post a $10,000 deposit.

These are not isolated disputes. They are the operational behaviour of an ecosystem where contractual enforcement does not exist and reputation is the only collateral. Affiliates typically retain 60 to 80 percent of ransom payments under standard RaaS programme terms. When trust degrades, affiliates defect, transfer victim data between programmes, and expose their former operators to multi-party extortion. The surface appearance of organised criminal enterprises conceals what is structurally a coalition of freelancers who defect the moment incentives shift.

ShinyHunters is also not an unsophisticated actor stumbling into criminal targets by accident. The group exploited a Snowflake contractor’s compromised machine to access approximately 165 Snowflake customer accounts including Ticketmaster and Santander. They exploited Oracle PeopleSoft zero-day CVE-2026-35273, a 9.8 CVSS-scored remote code execution flaw, against over 100 organisations. Their recruitment infrastructure actively solicits insider access across finance, insurance, aviation, and telecom sectors. The attack on Clop originated in a feud dating to 2025 over disputed ownership of a zero-day exploit used in Clop’s Oracle E-Business Suite campaign. This was a deliberate, motivated targeting decision.

Why This Matters for Defenders

Criminal-on-criminal attacks are not a self-correcting mechanism that benefits defenders. They generate a secondary exposure layer for organisations that believed their ransomware incident was closed. They surface operational intelligence about RaaS infrastructure that law enforcement and rival groups can exploit. And they demonstrate that the operational security failures defenders are expected to remediate are present throughout the criminal ecosystem as well, just with different consequences when they materialise.

The full investigation, including the complete vulnerability chain analysis, the ShinyHunters capability profile, and the structural analysis of RaaS trust degradation, is published at https://www.anomali.com/blog/when-criminals-hack-criminals-shinyhunters-breach-of-clop-and-what-it-reveals-about-the-ransomware-underground.