SHINYHUNTERS TURNS EXTORTION TACTICS AGAINST CL0P AFTER APPARENTLY HIJACKING RANSOMWARE GANG’S LEAK SITE

A rare confrontation between two major cybercrime operations has spilled onto the dark web after the ShinyHunters extortion group apparently seized control of Cl0p’s long-running leak site and used the ransomware gang’s own infrastructure to demand payment.

The compromised site had served for years as one of Cl0p’s primary pressure mechanisms, allowing the group to publicly identify victims, publish stolen information, and threaten additional disclosures when extortion demands were not met. Over the weekend, that same site was altered to display material claiming that ShinyHunters had taken control.

A banner posted on the site stated that the domain had been seized by ShinyHunters. Additional messages attributed to the group demanded an unspecified eight-figure payment from Cl0p and claimed that the amount represented 2.333 percent of the ShinyHunters speaker’s own net worth.

That calculation would imply a claimed personal or group net worth reaching into the hundreds of millions of dollars, but the figure is an assertion made by cybercriminals and has not been independently established.

ShinyHunters also threatened to increase its demand every 24 hours if Cl0p failed to respond.

The messages escalated further by Monday, when the demands reportedly expanded to include a public apology from Cl0p. ShinyHunters also threatened to expose information it claimed could reveal companies that had paid Cl0p, ransom amounts, and Bitcoin addresses associated with those transactions.

If authentic, such records could carry consequences extending beyond the dispute between the groups.

Ransomware payment records can provide investigators with financial links between cryptocurrency wallets, operators, affiliates, victims, and infrastructure. Even partial transaction information can become valuable when combined with blockchain analysis, exchange records, seizure actions, and intelligence gathered during separate investigations.

No public evidence currently establishes that ShinyHunters possesses a complete Cl0p payment database, and its claims should be treated as assertions made during an active extortion attempt.

The takeover also included messages identifying three people whom ShinyHunters claimed were connected to Cl0p. Public attribution of individual cybercriminals remains sensitive because criminal groups frequently use aliases, stolen identities, false information, and deliberate misdirection.

The technical method used to take control of the Cl0p site has not been independently established.

A successful takeover could result from compromised administrative credentials, exposed infrastructure, a vulnerability in the underlying site, access to hosting systems, theft of cryptographic material, or another route. Without forensic evidence, the defacement itself does not establish how ShinyHunters gained control.

The episode is notable because extortion infrastructure is normally designed to pressure conventional victims rather than another extortion organization.

Cl0p has built much of its reputation through large-scale campaigns targeting vulnerabilities in widely deployed enterprise software. Federal authorities have previously documented the group’s use of vulnerabilities in MOVEit Transfer and related file-transfer technology.

In June 2023, the FBI and Cybersecurity and Infrastructure Security Agency issued a joint advisory detailing Cl0p’s exploitation of CVE-2023-34362 in MOVEit Transfer. Investigators said the group used the vulnerability to install the LEMURLOOT web shell and steal data from underlying databases. Federal agencies also connected Cl0p activity with earlier campaigns involving Accellion File Transfer Appliance systems and Fortra GoAnywhere managed file-transfer products.

The FBI and CISA warned at the time that Cl0p had demonstrated an ability to rapidly exploit newly discovered vulnerabilities across large numbers of internet-facing systems. That operating model allowed the group to compromise organizations at scale before many administrators could apply patches or fully understand the vulnerability being targeted.

The current dispute reportedly centers partly on an Oracle E-Business Suite vulnerability and the criminal campaigns in which the exploit was allegedly used.

Oracle has released several major security updates for E-Business Suite during 2026. Its September Critical Security Patch Update alone contained 159 new E-Business Suite security fixes, including 19 vulnerabilities Oracle said could be remotely exploited without authentication. Supported E-Business Suite versions affected by various flaws include releases 12.2.3 through 12.2.15.

ShinyHunters has claimed that Cl0p obtained and used an exploit for an Oracle E-Business Suite vulnerability without the group’s permission and later threatened one of its members. Those statements describe the cybercriminal group’s version of the dispute and have not been independently verified.

ShinyHunters demanded proceeds it claims Cl0p obtained from recent attacks involving Oracle E-Business Suite, along with additional payment.

The confrontation represents an unusual collision between two different cybercrime business models.

Cl0p has historically become associated with vulnerability exploitation followed by large-scale data theft and extortion. ShinyHunters has developed a separate record centered heavily on credential theft, social engineering, cloud-service compromise, database theft, and threats to publish stolen information.

The FBI has directly documented extortion activity associated with the ShinyHunters name.

In a September 2025 cyber alert coordinated with CISA, the FBI warned that some victims of the UNC6040 cybercriminal operation later received cryptocurrency extortion demands allegedly from ShinyHunters after data had been stolen from Salesforce environments. The bureau said UNC6040 actors commonly used voice phishing to impersonate information-technology personnel and convince employees to authorize malicious applications or surrender credentials and multifactor authentication codes.

The FBI said those techniques could give attackers broad access to Salesforce environments while making malicious activity appear to originate from legitimate integrations. Investigators advised organizations to use phishing-resistant multifactor authentication, restrict user privileges, monitor API activity, examine network logs for signs of data exfiltration, and review third-party integrations.

ShinyHunters also has a documented criminal history extending back several years.

In January 2024, the Justice Department announced the sentencing of French national Sebastien Raoult, also known as Sezyo Kaizen, for his involvement with the ShinyHunters group. DOJ said Raoult and co-conspirators hacked companies, stole confidential and customer information, and sold stolen data through dark-web markets. Between April 2020 and July 2021, ShinyHunters advertised stolen information from more than 60 companies, according to court records cited by federal prosecutors.

Prosecutors said the conspirators created fraudulent login pages, sent phishing messages, captured employee credentials, accessed corporate systems, and searched stolen information for additional credentials that could provide access to cloud storage and other services. Federal authorities estimated that the operation stole hundreds of millions of customer records and caused more than $6 million in losses to victim companies.

The current Cl0p incident shows a different application of the same basic criminal pressure model.

Instead of threatening a conventional company with stolen corporate or customer information, ShinyHunters is threatening another cybercrime organization with exposure of its internal operations, finances, victims, and alleged operators.

The situation developed another turn when the defaced Cl0p site was later replaced with a message apparently posted by Cl0p stating that the group was attempting to contact ShinyHunters and claiming the provided email channel was not functioning.

That message suggests some level of attempted communication between the two operations, but it does not establish whether negotiations occurred, whether Cl0p regained complete control of its infrastructure, or whether ShinyHunters retained access elsewhere.

A restored webpage is not proof that an intrusion has been fully contained.

If administrative credentials, hosting systems, databases, private keys, internal communications, cryptocurrency information, or victim records were accessed, control of the visible site could be only one part of the compromise.

The threatened disclosure of Cl0p payment records could prove particularly damaging if ShinyHunters obtained authentic internal information.

Ransomware organizations depend on secrecy surrounding their personnel, affiliates, cryptocurrency wallets, negotiations, infrastructure, and victim communications. Exposure of those records could provide law enforcement and cybersecurity investigators with information that would normally remain hidden behind encrypted channels and pseudonymous payment systems.

It could also expose organizations that quietly paid ransom demands.

Federal authorities consistently advise ransomware victims against paying. The FBI states that ransom payments do not guarantee recovery of data and can encourage additional criminal activity. The bureau urges victims to contact the FBI or submit incidents through the Internet Crime Complaint Center.

The confrontation also illustrates a basic weakness inside criminal infrastructure: cybercriminals depend on many of the same technologies they target.

They require servers, credentials, access controls, cryptocurrency wallets, communication systems, web applications, databases, and operational security. Those systems can themselves contain vulnerabilities, misconfigurations, stolen credentials, or exploitable human weaknesses.

Cl0p has spent years exploiting those weaknesses in other organizations.

The apparent takeover of its own extortion site shows that operating a criminal cyber infrastructure does not make that infrastructure immune from compromise.

For now, the most consequential claims remain unverified: the extent of ShinyHunters’ access, whether it obtained Cl0p’s financial records, whether the named individuals are accurately connected to the operation, how much money Cl0p controls, and whether any payment negotiations are taking place.

What is clear is that a dark-web platform built to pressure ransomware victims was temporarily turned against the ransomware group that operated it.

That reversal has transformed a dispute between cybercriminal organizations into a potential intelligence leak involving ransom payments, cryptocurrency infrastructure, internal identities, and the financial machinery behind one of the most persistent extortion groups operating on the internet.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---