ShinyHunters Hijacks Cl0p's Dark Web Leak Site
ShinyHunters claims to have taken control of Cl0p’s dark web leak site, hijacking its Tor platform. On September 18, 2026, the site was defaced with Pokémon artwork and a message declaring it "PWN3D" by ShinyHunters.
The Incident
The attack marked the end of a feud between the two criminal groups. According to BleepingComputer, ShinyHunters uploaded a file and claimed access to Cl0p’s source code, plugins, and system logs through an unauthenticated file-upload flaw in Grav, the content management system behind the leak site.
Unverified Claims
ShinyHunters also alleged possession of Cl0p's private keys for its dark web address, a detail yet to be proven. They gave a 72-hour ultimatum, threatening to extort another extortion group. While the conflict dates back to October 2025, when Cl0p exploited Oracle’s E-Business Suite, no direct evidence supports ShinyHunters' claim about the exploit's origin.
Background of Both Groups
Both groups have a history of cyberattacks. Cl0p led the MOVEit Transfer campaign in 2023, affecting over 2,000 organizations, and had previous campaigns against GoAnywhere and Accellion. In 2026, ShinyHunters targeted several companies, including a phone company that lost 1.6 million records and more than 100 firms through Oracle PeopleSoft in June.
Unclear Aftermath
Cl0p has remained silent, and ShinyHunters' own site later went offline, but there's no confirmation of retaliation. The only verified aspects are the defaced web page and a file upload. The stolen code, server access, and Tor keys are mentioned only by the group claiming responsibility.
By Ana-Maria Stanciuc, Editor-in-Chief, TNW