ShinyHunters Hacks Clop Ransomware Leak Site in Dark Web War

Executive Summary

In an extraordinary escalation of inter-cartel cyber warfare, the notorious extortion syndicate ShinyHunters has successfully breached, compromised, and defaced the primary Tor data leak portal operated by the Clop (Cl0p) ransomware operation. The intrusion represents an unprecedented public humiliation for Clop—the prolific Russian-speaking ransomware gang responsible for historic mass-exploitation campaigns against enterprise file transfer platforms including MOVEit Transfer, GoAnywhere MFT, and Accellion FTA.

First reported by BleepingComputer, the attack saw ShinyHunters compromise the backend infrastructure hosting Clop's dark web leak site by exploiting an unauthenticated arbitrary file upload vulnerability in Grav CMS (an open-source flat-file content management system utilized by the ransomware operators). After planting an initial warning payload, ShinyHunters fully defaced the site, supplanting Clop's victim rosters with ASCII artwork depicting Umbreon—the dark-type Pokémon serving as ShinyHunters' hallmark signature—accompanied by the taunt: "rooting your systems since '19 ;)".

Crucially, ShinyHunters claims to have obtained complete root-level access to Clop's hosting server, exfiltrating web server databases, custom Grav CMS plugins, administrative server logs, and the cryptographic private keys for Clop's Tor hidden service (`hs_ed25519_secret_key`). Possession of these private keys gives ShinyHunters the capability to hijack, clone, or permanently commandeer Clop's dark web address. The attack was launched in retaliation following a violent dispute surrounding shared exploits for an Oracle E-Business Suite vulnerability (CVE-2025-61882), during which Clop operatives allegedly threatened ShinyHunters members. ShinyHunters has now announced plans to extort the ransomware syndicate itself.

Technical Vulnerability Analysis & Attack Chain

The intrusion chain illustrates that even elite ransomware operations frequently suffer from fundamental web application hardening failures:

[ShinyHunters Reconnaissance on Clop Tor Infrastructure]

│

▼

[Identify Vulnerable Content Management Platform]

- Clop Data Leak Site Powered by Open-Source Grav CMS

- Exposed Administrative Routing & Public Upload Handlers

│

▼

[Unauthenticated Arbitrary File Upload Exploitation]

- ShinyHunters Bypasses Upload Extension Filters in Grav CMS

- Injects PHP Web Shell / Execution Script Directly onto Disk

│

▼

[Initial Proof-of-Concept & Server-Side Execution]

- Uploads Warning Text File to Confirm Unrestricted Access

- Escalates Privileges to Acquire Host System & Webroot Control

│

▼

[Full Tor Leak Site Defacement & Credential Plunder]

- Replaces Victim Rosters with Umbreon ASCII Art & ShinyHunters Links

- Dumps Server Logs, Database Dumps, and Victim Staging Archives

│

▼

[Tor Hidden Service Private Key Exfiltration]

- Accesses /var/lib/tor/hidden_service/hs_ed25519_secret_key

- Seizes Cryptographic Authority to Mirror or Route Clop's Onion URL

│

▼

[Counter-Extortion Campaign Against Clop Gang]

- ShinyHunters Demands Ransom from Clop Ransomware Operators

- Puts Victim Data & Negotiation Backdoors at High Collateral Risk

1. The Grav CMS Ingress Vector

While enterprise networks invest heavily in mitigating Clop's sophisticated zero-day toolkits, Clop's external public-facing leak infrastructure was constructed upon Grav CMS, an open-source, flat-file content management platform written in PHP.

ShinyHunters identified an unauthenticated file upload weakness within the site's media management or plugin processing pipeline. By crafting an HTTP POST payload containing disguised executable scripts (e.g., polyglot image/PHP files or bypasses of upload sanitization filters), the attackers uploaded a web shell directly to a web-accessible directory. Because the underlying web server user maintained write permissions across the document root, execution was achieved immediately upon requesting the uploaded script.

2. Defacement & Infrastructure Disruption

After validating code execution with an initial probe file, ShinyHunters overwrote the CMS templates and markdown page stores:

• ASCII Art Branding: The entire homepage was transformed into ASCII art of Umbreon, the Pokémon mascot long used by ShinyHunters across illicit hacking forums (such as BreachForums).
• Attribution Banner: The site displayed the phrase "rooting your systems since '19 ;)", referencing ShinyHunters' historical emergence in 2019, alongside hyperlinks redirecting visitors to ShinyHunters' dedicated dark web portal.

3. Exfiltration of Tor v3 Private Keys (hs_ed25519_secret_key)

The most consequential dimension of the compromise is the alleged theft of the Tor hidden service private keys:

• Tor Cryptographic Authority: A Tor v3 onion address is derived directly from the public key of an Ed25519 keypair. The secret key (hs_ed25519_secret_key) resides on the host server (typically within /var/lib/tor/hidden_service/).
• Domain Hijacking Capability: If ShinyHunters holds the genuine private key, they can launch a competing Tor service anywhere in the world utilizing the identical .onion address. This enables them to intercept victim traffic, poison active extortion negotiations, or decommission Clop's web presence entirely.
• Access to Staged Victim Data: The compromised host server stored Clop's administrative access logs, backend plugins, and potentially unreleased victim files staged for future extortion cycles.

Threat Actor Profile & Campaign Attribution

• Perpetrator — ShinyHunters: An elite, financially motivated cybercriminal syndicate active since 2019. Known for devastating data breaches targeting major conglomerates (including Ticketmaster, AT&T/Snowflake ecosystems, Santander, and Microsoft GitHub repositories), ShinyHunters operates with sophisticated web application penetration testing capabilities.
• Target — Clop (TA505 / FIN11 Affiliate): One of the most financially destructive ransomware cartels globally. Clop specializes in "data theft extortion" without encryption, leveraging zero-day vulnerabilities in enterprise file transfer gateways.
• The Conflict Origin: The breach stems from an escalating grievance. Threat telemetry indicates both groups were actively maneuvering around vulnerabilities in Oracle E-Business Suite (CVE-2025-61882). During operational friction, a Clop representative reportedly issued direct threats against ShinyHunters personnel, prompting ShinyHunters to retaliate by hunting down and destroying Clop's dark web infrastructure.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance (For Enterprises in Extortion Negotiations)

• Immediate Cessation of Direct Clop Negotiations:
  • Any enterprise currently engaged in extortion communications with Clop must immediately freeze negotiation channels. With Clop's dark web servers and communication channels breached, third parties (including ShinyHunters or federal law enforcement) may possess access to negotiation chat transcripts, staging servers, and uploaded decryption validation samples.
• Prepare for Secondary Extortion / Leak Exposure:
  • Assume that all data previously stolen by Clop has been co-compromised by ShinyHunters. Legal, incident response, and executive crisis teams must anticipate potential secondary extortion demands or immediate dump releases on ShinyHunters-affiliated forums.
• Harden Web Applications Running Grav CMS:
  • For legitimate organizations utilizing Grav CMS: audit all installed plugins, restrict file upload permissions to non-executable storage buckets (e.g., AWS S3 with rigid MIME validation), and ensure allow_url_fopen is disabled in php.ini.

2. Network & Perimeter Defenses

• Monitor Tor Gateway Traffic:
  • Threat actors frequently rotate hosting infrastructure once hidden service keys are compromised. SOC analysts should monitor corporate egress for unexpected connection spikes to newly stood-up Tor proxies.
• Snort / Suricata Rule: Grav CMS Arbitrary File Upload Attempt:

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"EXPLOIT Grav CMS Arbitrary File Upload Web Shell Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/media/"; http_uri; content:"filename="; content:".php"; nocase; classtype:web-application-attack; sid:20260920; rev:1;)

3. Endpoint Detection & Hunting Query

Sigma Rule: Web Server Executing Shell Commands from CMS Upload Directory

title: Web Shell Execution Spawned from CMS Upload Path

status: experimental

description: Detects command execution originating from PHP-FPM or Apache/Nginx web server workers executing within CMS upload or cache directories.

logsource:

category: process_creation

product: linux

detection:

selection_parent:

ParentImage|endswith:

- '/php-fpm'

- '/apache2'

- '/httpd'

- '/nginx'

selection_child:

Image|endswith:

- '/bin/sh'

- '/bin/bash'

- '/usr/bin/curl'

- '/usr/bin/wget'

- '/usr/bin/python3'

- '/usr/bin/id'

- '/usr/bin/whoami'

selection_path:

CommandLine|contains:

- '/user/pages/'

- '/user/data/'

- '/images/'

- '/uploads/'

condition: (selection_parent and selection_child) or selection_path

level: critical

tags:

- attack.persistence

- attack.t1505.003

- attack.initial_access

- attack.t1190

Splunk Hunting Query: Anomalous File Modifications in Tor Hidden Service Directory

index=os sourcetype=auditd (file_path="*/hidden_service/*" OR file_path="*hs_ed25519_secret_key*")

| stats count earliest(_time) as first_access latest(_time) as last_access by host, user, file_path, comm, exe

| convert ctime(first_access) ctime(last_access)