[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpKxJXESiDyJFj3xhPiuveTFk_tiX9gFjp83gkQH_bgA":3},{"article":4,"iocs":52,"watch_terms":63,"solutions":64,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"4a81ea4b-3b5b-4017-a74d-72170ccf15b9","ShinyHunters hacks Clop leak site, threatens to extort ransomware gang","shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang-14e87e","The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service. [...]","The ShinyHunters extortion gang has breached and defaced the Clop ransomware operation's Tor data leak site, allegedly stealing server data and private keys for the onion service. ShinyHunters claims to have exploited a Grav CMS vulnerability to gain access, and is now threatening to extort Clop, stating they will publish stolen data if demands are not met within 72 hours. This attack appears to be retaliation for threats made by Clop representatives.","ShinyHunters defaces Clop ransomware leak site, claims data and key theft, threatens extortion.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fshinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F06\u002F15\u002Femoji-hacker.jpg","2026-09-19T13:48:32+00:00","2026-09-19T14:00:21.694021+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":19},"Clop",{"name":23,"type":19},"Cl0p",{"name":25,"type":26},"Grav CMS","product",{"name":28,"type":26},"Oracle E-Business Suite","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":29,"icon":31,"name":32,"slug":33},[53,57,59],{"type":54,"value":55,"context":56},"url","http:\u002F\u002Fshinyhunters.onion","ShinyHunters' own data leak site mentioned in defacement",{"type":49,"value":25,"context":58},"Vulnerability exploited in Grav CMS to gain initial access",{"type":60,"value":61,"context":62},"cve","CVE-2025-61882","Vulnerability exploited by Clop in Oracle E-Business Suite data theft campaign",[25,28],{"controls":65,"vendors":152},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,107,115],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":96,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":124,"name":125,"problem":126,"products":127},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":167},"unpatched-cms-lets-shinyhunters-breach-clops-leak-site","Unpatched CMS Lets ShinyHunters Breach Clop's Leak Site","ShinyHunters exploited a known vulnerability in Grav CMS to compromise Clop's Tor-hosted data leak site, stealing server data and private onion service keys. The root cause is straightforward: a publicly accessible web application was running unpatched, vulnerable software — a failure that even criminal organizations are not immune to. This incident underscores that any internet-facing asset, regardless of who operates it, becomes a target when basic patch hygiene is neglected. It also highlights how stolen private keys and server credentials can cause cascading damage far beyond initial access. The broader lesson for defenders is that vulnerability management must cover all internet-exposed infrastructure, not just corporate endpoints.",[158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST CM-6: Configuration Settings","OWASP Top 10: A06 Vulnerable and Outdated Components","ITIL Change Management: Emergency Change Procedures",{}]