ShinyHunters breaches Clop ransomware site

Cybersecurity

Hacking the hackers: ShinyHunters breaches Clop ransomware site

Ransomware gang breached: Rival cybercriminals threaten operational exposure

Ransomware group ShinyHunters hits major alarm company
Canvas reaches settlement with ShinyHunters extortion group

1
Hacking the hackers: ShinyHunters breaches Clop ransomware site
2
The clause the EU and Morocco refuse to put in writing to safeguard Spain’s sovereignty over Ceuta and Melilla
3
NightEagle threat group expands cyber operations from China to Russia
4
AI hallucination nearly sparked a U.S.-China military conflict
5
What is a BAM? The Spanish Navy’s Multipurpose Warship Class as much of NATO has no direct equivalent

Alberto Payo
Technology Journalist
Published on
22 September 2026 at 07:10

Cybercriminals do not only target companies and public institutions. They can also attack each other. Although some groups collaborate for their malicious activities and others emerge as small ‘offspring’ of larger collectives, it can also happen that two formations have their rivalry and even engagein relentless battles over victims, money, reputation, and other things.

This is what just happened between two of the most infamous bands in the ecosystem: ShinyHunters and Clop ransomware.

The first of them claims to have gained access to the server used by Clop for its leak site and manipulated it to place their own brand and a message directed at their rivals.

Among the displayed elements was an ASCII representation of the Pokémon Umbreon, associated with the identity of ShinyHunters, as well as a link to the group’s own Tor site.

Additionally, ShinyHunters also allegedly accessed various files and components of the ransomware group’s infrastructure.

“The data we stole includesoading and reviewing them,” the collective commented to the cybersecurity information website BleepingComputer

The threat actor also claims it is reviewing the obtained information and intends to use it to pressure Clop. Thus, they have given a 72-hour ultimatum. In this way, interestingly, they are following to the letter the modus operandi that ransomware bands usually carry out with their victims.

The ‘Pokémon hunters’ managed to exploit an unauthenticated file upload vulnerability in Grav CMS, the content managementsystem used by the site. From there, they managed to introduce their own content and alter the page.

Furthermore, the attackers boast of having in their possession the private keys used by Clop’s Tor service. According to the hackers, possessing these keys would mean they could maintain control over the .onion address even if Clop tried to expel them from the server. The band claims they could use these keys to host the same service again under that address.

But why did this clash occur? ShinyHunters explained that this attack was carried out asretaliation for threats of violence and identification of their group members supposedly made by a Clop representative. These threats were made during a dispute over Clop’s Oracle E-Business Suite data theft campaign last year.

“During the Oracle EBS campaign they organized and from which I was stolen last year, someone from cl0p sent me a personal message that said, and I quote (translated from Russian): I have more money than you and all your people together, I will kill you soon,” the ShinyHunters spokesperson explained to the aforementioned page.

ShinyHunters is a cybercriminal group dedicated to mass data theft and extortion. Emerging around 2019, it is linked to the international criminal ecosystem and actors from countries like France, the U.S., or the U.K. It operates mainly through social engineering, credential theft, and attacks on cloud services. Among its victims are Ticketmaster, Santander, AT&T, Qantas, and Coinbase. Some investigations speak of very young members, aged 16 to 25, and even younger.

Clop (or Cl0p) is a ransomware gang linked to the Russian-speaking criminal ecosystem. Active since 2019, it combines system encryption with the theft and subsequent publication of information to pressure its victims. In recent years, it has become especially known for exploiting vulnerabilities in enterprise file transfer tools, as happened with MOVEit in 2023.

Other cybercriminal duels

It is not the first time that a conflict of this type occurs between black hat hackers. There are other recent and notable cases. For example, in March of last year, Dragon Force disrupted the leak page of its rivals BlackLock and Mamona, to publicly embarrass them.

This year, another incident of this kind occurred, although here there was not a single victim, but two. 0APT and KryBit attacked each other and leaked the rival’s operational data. As a result, both operations were severely affected.

Become a premium member for free!

You may be interested in

CybersecurityRansomware group ShinyHunters hits major alarm companyAlberto Payo
CybersecurityCanvas reaches settlement with ShinyHunters extortion groupAlberto Payo
CybersecurityHBO Max’s Reddit account hacked to spread malwareAlberto Payo
CybersecuritySerious TP-Link Tapo C200 flaw could let cybercriminals spy inside homesAlberto Payo

“;
$(“#container-comentar-comentarios”).html(respuesta);
} else if (data == 2) { //TIEMPO
var respuesta =
“No ha pasado aún un minuto desde tu último comentario. Espera un poco y podrás comentar de nuevo una noticia.
“;
$(“#container-comentar-comentarios”).html(respuesta);
} else if (data == 3) { //PALABROTA
var respuesta = “Por favor, utiliza un lenguaje correcto para comentar las noticias.”;
Swal.fire({
text: respuesta,
icon: “warning”
});
} else { //NO LOGUEADO
var respuesta =
“Lo sentimos, al parecer no tienes una sesión iniciada. Vuelve a Iniciar Sesión y podrás publicar este comentario.”;
Swal.fire({
text: respuesta,
icon: “warning”
});
}

},
error: function(request, error) {
//console.log(error);
}
});

}

function sumarPositivo(id_comentario, id_usuario) {

$.ajax({
type: “POST”,
xhrFields: {
withCredentials: true
},
url: `https://api.v.1.2.3.escudodigital.newscript.es/api/sumar_reaccion_comentario.php?t=` +
generarCadenaAlfanumerica(),
data: {
tipo: ‘positivo’,
id_comentario: id_comentario,
id_usuario: id_usuario
},
success: function(data) {
//console.log(data);
if (data == 1) {
var likes = parseInt($(“#like_” + id_comentario + ” span”).text());
$(“#like_” + id_comentario + ” span”).text(parseInt(likes + 1));
}
},
error: function(request, error) {
//console.log(error);
}
});

}

function recargar_widgets_sesion() {
recargar_cabecero_sesion();
recargar_menu_sesion();
recargar_comentar_sesion();
recargar_comentar_comentar();
comprobar_user_sesion_215_articulo(0);
}

function iniciarSesion() {
var continuar = true;
var msg = “”;
var usuario_log = $(“#usuario_log”).val();
var password_log = $(“#password_log”).val();
var valor_periodico = $(‘#valor_periodico’).val();

// console.log(valor_periodico);
if (usuario_log.length == 0) {
continuar = false;
msg += “Es necesario rellenar el correo electrónico n”;
}

if (password_log.length == 0) {
continuar = false;
msg += “Es necesario rellenar la contraseña.n”;
}

if (continuar) {

$.ajax({
type: “POST”,
data: $(“#formulario_login”).serialize(),
xhrFields: {
withCredentials: true
},
url: `https://api.v.1.2.3.escudodigital.newscript.es/api/login-user.php?t=` +
generarCadenaAlfanumerica(),
success: function(data) {
// console.log(data);
if (data == 1) {
recargar_widgets_sesion();
$(“#modal-login .modal-action.modal-close.close-btn”).trigger(“click”);
$(“#usuario_log”).val(“”);
$(“#password_log”).val(“”);
if (window.location.href.includes(“area-usuario”)) {
// window.location.reload();
}
} else {
var respuesta =
“No hemos encontrado ningún usuario con el correo electrónico y la contraseña introducidos. Por favor, vuelve a intentarlo o recupera la contraseña pulsando el botón inferior.”;
Swal.fire({
text: respuesta,
icon: “warning”
});
}
}
});
} else {
Swal.fire({
text: msg,
icon: “warning”
});
}
}

function comprobar_user_sesion_215_articulo(es_premium) {
$.ajax({
type: “POST”,
xhrFields: {
withCredentials: true
},
url: `https://api.v.1.2.3.escudodigital.newscript.es/api/comprobar_sesion_user.php?t=` +
generarCadenaAlfanumerica(),
success: function(data) {
console.log(“COMPROBADO SESION USUARIO ” + data);
if (data == 1) {
$(“#art-cuerpo-visible”).removeClass(“d-none”);
$(“#art-cuerpo-visible”).removeClass(“art-cuerpo-no-visible”);
$(“#art-cuerpo-visible”).addClass(“art-cuerpo-visible”);
$(“#art-cuerpo-visible-premium”).removeClass(“art-cuerpo-visible”);
$(“#art-cuerpo-visible-premium”).addClass(“d-none”);
$(“#banner-premium”).addClass(“d-none”);

} else {
// $(“#art-cuerpo-visible”).removeClass(“art-cuerpo-visible”);
// $(“#art-cuerpo-visible”).addClass(“art-cuerpo-no-visible”);
if (es_premium) {
$(“#art-cuerpo-visible”).removeClass(“d-none”);
$(“#art-cuerpo-visible”).removeClass(“art-cuerpo-no-visible”);
$(“#art-cuerpo-visible”).addClass(“d-none”);
$(“#art-cuerpo-visible-premium”).addClass(“art-cuerpo-visible”);
$(“#art-cuerpo-visible-premium”).removeClass(“d-none”);
$(“#banner-premium”).removeClass(“d-none”);
} else {
$(“#art-cuerpo-visible-premium”).removeClass(“art-cuerpo-visible”);
$(“#art-cuerpo-visible-premium”).addClass(“d-none”);
$(“#banner-premium”).addClass(“d-none”);
$(“#art-cuerpo-visible”).removeClass(“d-none”);
$(“#art-cuerpo-visible”).removeClass(“art-cuerpo-no-visible”);
$(“#art-cuerpo-visible”).addClass(“art-cuerpo-visible”);

}
}
}
});
}

function comprobar_user_sesion_215() {
$.ajax({
type: “POST”,
xhrFields: {
withCredentials: true
},
url: `https://api.v.1.2.3.escudodigital.newscript.es/api/comprobar_sesion_user.php?t=` +
generarCadenaAlfanumerica(),
success: function(data) {
console.log(“COMPROBADO SESION USUARIO ” + data);
if (data == 1) {
$(‘.col-comparador-registro-login’).addClass(‘w-auto’)

} else {
$(‘.col-comparador-registro-login’).removeClass(‘w-auto’)
}
}
});
}

function registrarCuenta() {
var continuar = true;
var msg = “”;
var email_registro = $(“#email_reg”).val();
var pass_registro = $(“#password_reg”).val();
var pass_registro2 = $(“#password_reg_2”).val();
var nombre_registro = $(“#nombre_reg”).val();
var apellidos_registro = $(“#apellidos_reg”).val();
var ref_id_periodico = $(“#ref_id_periodico”).val();

if (pass_registro2 != pass_registro) {
continuar = false;
msg += “Deben coincidir ambas contraseñas. n”;
}

if (email_registro.length == 0) {
continuar = false;
msg += “Es necesario rellenar el correo electrónico. n”;
}
// if (pass_registro.length < 8) {
// continuar = false;
// msg += “Cal omplir la contrasenya amb un mínim de 8 caràcters. n”;
// }
if (nombre_registro.length == 0) {
continuar = false;
msg += “Hay que llenar el nombre. n”;
}

if (!$(“#aceptopoliticas”).is(“:checked”)) {
continuar = false;
if (ref_id_periodico == 8) {
msg += “You must accept the privacy policy. n”;
} else {
msg += “Debes aceptar la política de privacidad. n”;
}
}

if (continuar) {
$.ajax({
type: “POST”,
xhrFields: {
withCredentials: true
},
data: $(“#formulario_registro”).serialize(),
url: `https://api.v.1.2.3.escudodigital.newscript.es/api/register-user.php?t=` +
generarCadenaAlfanumerica(),
success: function(data) {
if (data == 0) {
var respuesta = “Este correo electrónico ya está registrado.”;
Swal.fire({
text: respuesta,
icon: “warning”
});
} else {
var respuesta = “¡Enhorabuena! Te has registrado con éxito.”;
Swal.fire({
text: respuesta,
icon: “warning”
});
recargar_widgets_sesion();
$(“#email_reg”).val(“”);
$(“#password_reg”).val(“”);
$(“#nombre_reg”).val(“”);
}
}
});
} else {
Swal.fire({
text: msg,
icon: “warning”
});
}
}

}
});
} else {
var respuesta = “La contraseña debe tener un mínimo de 8 caracteres.”;
Swal.fire({
text: respuesta,
icon: “warning”
});

}
} else {
var respuesta = “Ambas contraseñas deben coincidir.”;
Swal.fire({
text: respuesta,
icon: “warning”
});

}

$(document).ready(function() {
recargar_widgets_sesion(); //DESCOMENTAR ESTO
});
‘)
.text(msg)
.insertAfter($el);
}

function esEmailValido(email) {
return /^[^s@]+@[^s@]+.[^s@]{2,}$/.test(String(email).trim());
}

function validar() {
limpiarErrores();
let ok = true;

const $nombre = $(“#nombre”);
const $email = $(“#email”);
const $motivo = $(“#motivo”);
const $check = $(“#checkbox”);

if (!$check.is(“:checked”)) {
marcarError($check, “You must accept the legal terms.”);
ok = false;
}

return ok;
}

function setLoading(isLoading) {
$btn.prop(“disabled”, isLoading);
$btn.text(isLoading ? “Sending…” : “Sent”);
}

function submitFormWithToken(token) {
setLoading(true);

const payload = {
nombre: $(“#nombre”).val().trim(),
email: $(“#email”).val().trim(),
motivo: $(“#motivo”).val().trim(),
legal: $(“#checkbox”).is(“:checked”) ? 1 : 0,
periodico_id_periodico: 8,
periodico: ‘www.escudodigital.com’,
url: window.location.href,
periodico_nombre: ‘DigitalShield’,
token: token
};

$.ajax({
url: URL_ENDPOINT,
method: “POST”,
data: payload,
dataType: “json” // Expects JSON response from server
})
.done(function(res) {
if (res && (res === 1 || res === “1” || res.ok)) {
$(“#msgFormContacto”).html(‘Message sent successfully.
‘);
$form[0].reset();
} else {
$(“#msgFormContacto”).html(‘Message not sent. Try again.
‘);
}
})
.fail(function(xhr) {
$(“#msgFormContacto”).html(‘Connection error. Try again.
‘);
})
.always(function() {
setLoading(false);
});
}

$btn.on(“click”, function(e) {
e.preventDefault();
e.stopPropagation(); // Stop default button behavior if any

if (!validar()) return;

// Execute reCAPTCHA
if (window.grecaptcha) {
grecaptcha.ready(function() {
grecaptcha.execute(RECAPTCHA_SITE_KEY, {
action: ‘submit’
}).then(function(token) {
submitFormWithToken(token);
});
});
} else {
// Fallback or error if grecaptcha not loaded
alert(“reCAPTCHA not loaded. Please refresh.”);
}
});

$(“#nombre,#email,#motivo,#checkbox”).on(“input change”, function() {
$(this).removeClass(“is-invalid”);
$(this).next(“.error-text”).remove();
});
});
// funcion para detectar si el primer mega top existe el primer mega lo oculte
if ($.trim($(‘.BN-MEGATOP’).html()) !== ”) {
console.log(“entra”);

// 1. Busca el container-mega inmediatamente superior a TRIPLE_SUPERIOR
$(‘.TRIPLE_SUPERIOR’).first().prevAll(‘.container-mega’).first().addClass(‘d-none’);

// 2. CORREGIDO: Busca el primer container-mega DENTRO de .wrap-LISTADO
$(‘.wrap-LISTADO’).find(‘.container-mega’).first().addClass(‘d-none’);
}

What's Hot

Bill Gates pushes for ‘smart use’ of AI as his foundation builds more representative language data

the Global Startup Competition arrives in Saudi Arabia

AI could be a bubble and is not yet making Australia more productive, Michele Bullock says

ShinyHunters breaches Clop ransomware site

Bill Gates pushes for ‘smart use’ of AI as his foundation builds more representative language data

the Global Startup Competition arrives in Saudi Arabia

AI could be a bubble and is not yet making Australia more productive, Michele Bullock says

Bill Gates pushes for ‘smart use’ of AI as his foundation builds more representative language data

the Global Startup Competition arrives in Saudi Arabia

AI could be a bubble and is not yet making Australia more productive, Michele Bullock says

Rankpage Hong Kong Expands AI SEO Services for Traditional and AI-Powered Search

Bill Gates pushes for ‘smart use’ of AI as his foundation builds more representative language data

the Global Startup Competition arrives in Saudi Arabia

AI could be a bubble and is not yet making Australia more productive, Michele Bullock says

Subscribe to Updates

What's Hot

ShinyHunters breaches Clop ransomware site

Hacking the hackers: ShinyHunters breaches Clop ransomware site

Other cybercriminal duels

You may be interested in

Related Posts

Subscribe to Updates