ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
ShinyHunters defaces Clop ransomware leak site, claims data and key theft, threatens extortion.
The ShinyHunters extortion gang has breached and defaced the Clop ransomware operation's Tor data leak site, allegedly stealing server data and private keys for the onion service. ShinyHunters claims to have exploited a Grav CMS vulnerability to gain access, and is now threatening to extort Clop, stating they will publish stolen data if demands are not met within 72 hours. This attack appears to be retaliation for threats made by Clop representatives.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Grav CMS?
Get an email when a new story names Grav CMS, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonShinyHunters exploited a known vulnerability in Grav CMS to compromise Clop's Tor-hosted data leak site, stealing server data and private onion service keys. The root cause is straightforward: a publicly accessible web application was running unpatched, vulnerable software — a failure that even criminal organizations are not immune to. This incident underscores that any internet-facing asset, regardless of who operates it, becomes a target when basic patch hygiene is neglected. It also highlights how stolen private keys and server credentials can cause cascading damage far beyond initial access. The broader lesson for defenders is that vulnerability management must cover all internet-exposed infrastructure, not just corporate endpoints.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — http://shinyhunters.onion
- malware — Grav CMS
- cve — CVE-2025-61882