Actor Profile

ShinyHunters is an extortion gang active since at least 2019, known for data theft operations and high-profile breaches. The group uses Umbreon (Pokémon) as its logo and has previously defaced HackForums in August 2020. In this incident, ShinyHunters targeted the Clop (Cl0p) ransomware operation—a financially motivated cybercrime group that conducts mass exploitation campaigns and double extortion attacks. The breach represents an unusual case of inter-gang conflict, with ShinyHunters claiming retaliation for alleged threats made by Clop representatives following a dispute over a stolen Oracle E-Business Suite exploit used in Clop's 2025 CVE-2025-61882 zero-day campaign.

TTPs (Tactics, Techniques, Procedures)

ShinyHunters exploited an unauthenticated file upload vulnerability in Grav CMS to gain initial access to Clop's Tor-based data leak site infrastructure. The attack progressed from initial file upload (Friday night) to full server compromise and defacement within hours. The threat actors claim to have achieved full server access, enabling data exfiltration of source code, Grav CMS plugins, system logs from /var/log (potentially containing authentication logs and visitor IP addresses), and the private keys for Clop's Tor onion service. The defacement replaced the site with ASCII art and messaging. ShinyHunters demonstrated persistence capabilities by claiming control of Clop's onion private keys, which would allow them to host a malicious site at Clop's legitimate onion address even if ejected from the original infrastructure. The group announced plans to extort Clop with a 72-hour ultimatum posted to their own leak site.

Targets & Patterns

This operation targeted Clop ransomware gang's operational infrastructure—specifically their Tor-based data leak site used for victim extortion. The targeting represents retaliation rather than financial opportunism. According to ShinyHunters, the attack was motivated by alleged threats from a Clop representative following a dispute over an Oracle E-Business Suite exploit that ShinyHunters claims Clop obtained without authorization and used in their October 2025 CVE-2025-61882 zero-day campaign. ShinyHunters alleges a Clop representative made violent threats and doxing threats after ShinyHunters (operating as "Scattered Lapsus$ Hunters") leaked a proof-of-concept exploit matching the one used in Clop's attacks. This incident highlights how inter-gang conflicts can lead to offensive cyber operations between criminal groups, with threat actors applying the same TTPs used against legitimate organizations to attack rival cybercrime operations.

Historical Context

ShinyHunters has been active since at least 2019 ("rooting your systems since '19") and previously defaced HackForums in August 2020 using the same Umbreon artwork displayed in this attack. The current incident stems from an October 2025 dispute during Clop's Oracle E-Business Suite data theft campaign, where Clop exploited multiple vulnerabilities including CVE-2025-61882 (a zero-day) to steal data from organizations. Around that time, threat actors calling themselves "Scattered Lapsus$ Hunters" (including ShinyHunters) leaked a proof-of-concept exploit that Oracle confirmed matched the exploit used in Clop's attacks. ShinyHunters claimed the exploit originally belonged to them and that Clop obtained it without authorization, leading to escalating tensions. ShinyHunters has been linked to multiple high-profile breaches including Florida's DAVID DMV database, Ernst & Young, and Novocure. Clop has conducted numerous mass exploitation campaigns and is known for custom tooling such as web shells for Windchill attacks.

Defensive Recommendations

  • Monitor for unauthenticated file upload vulnerabilities in content management systems, particularly Grav CMS; implement strict file upload validation, type checking, and execution prevention controls
  • Harden Tor hidden service infrastructure by securing private key storage with encryption at rest, restricted file system permissions, and hardware security modules where feasible to prevent key theft
  • Implement comprehensive logging and monitoring for web application anomalies, including unexpected file uploads, directory traversal attempts, and unauthorized file system access patterns
  • Apply defense-in-depth controls to leak site infrastructure including web application firewalls, input validation, least-privilege access controls, and regular security patching of CMS platforms
  • Maintain offline backups of critical infrastructure components including onion service keys, and establish incident response procedures for infrastructure compromise including key rotation and service migration capabilities