[REVISION HISTORY]

ShinyHunters and Clop cybercrime conflict

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-09-22 10:22 UTC → 2026-09-22 23:30 UTC · added ~~removed~~

A public confrontation has emerged between cybercrime syndicates ShinyHunters and Clop. In late September 2026, ShinyHunters reportedly hijacked Clop’s dark web leak site by exploiting an unauthenticated file upload vulnerability in Grav CMS. The takeover included defacing Clop’s Tor site with the message “Domain Seized By ShinyHunters” and allegedly stealing sensitive data, such as source code, system logs, and private cryptographic keys. The dispute is reportedly driven by a disagreement over a zero-day exploit used in campaigns targeting Oracle E-Business Suite. ShinyHunters claims they discovered the vulnerability first and is attempting to extort Clop for an eight-figure payment and a public apology. The groups have engaged in mutual threats, with ShinyHunters vowing to leak Clop’s files and identify companies that previously paid ransoms to the gang. On September 22, 2026, ShinyHunters expanded its activities by claiming to have breached FBI systems, allegedly stealing between 2TB and 3TB of sensitive data. The group asserts the breach includes information on current and former FBI agents, employees, and job applicants, such as names, home addresses, and phone numbers. ShinyHunters claims they exploited a zero-day vulnerability in Oracle PeopleSoft to access recruitment infrastructure and move into government cloud environments like AWS GovCloud. The group described the attack as retaliation for a May 2026 FBI announcement regarding their methods, demanding the bureau retract its statements. While some portions of a data sample have been partially verified by media outlets, the FBI has not officially confirmed the breach.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.