A battle has broken out between a pair of cyber crime groups, highlighting how even hackers need to be wary of vulnerabilities in their infrastructure.
ShinyHunters, known for a series of devastating attacks in recent years, claims it has taken over the website and infrastructure of rival hacking group, Clop. The incident appears to be in response to a threat from Clop and part of a wider disagreement between the two hacking groups.
"We basically own them now," ShinyHunters said via an online chat conversation with . Clop's dark web site appears to remain offline and the targeted group has yet to make a public statement.
ShinyHunters used an unauthenticated file upload flaw in Grav CMS, leveraging the flaw by uploading a text file to the Clop site, according to a report in , which said the file included a warning against "threatening" ShinyHunters.
The attackers later defaced the Clop site with ASCII art, and added their rivals to the list of victims on its data leak list, the report added, with a note asking for a ransom and apology in order to get the website back.
"Kindly excuse our unprofessionalism," the note added.
A funny twist, if true
Steven Thomson, senior SOC analyst at Barrier Networks, said the incident was a "funny twist", but added it should be viewed cautiously as ShinyHunters has “a lot to gain from the publicity surrounding the 'apparent' breach."
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
Jamie Akhtar, CEO and co-founder of CyberSmart, said the incident is a “striking reminder that cyber criminal groups suffer from the same security weaknesses they routinely exploit in legitimate organisations”.
"Clop’s alleged compromise appears to have moved beyond website defacement to the possible theft of source code, logs and Tor service keys, potentially exposing both its infrastructure and operational methods."
William Wright, CEO of Closed Door Security, echoed Akhtar’s comments, particularly given that Clop has an “extensive track record” of waging supply chain attacks.
“The group’s site getting hacked through similar means shows that not even experienced threat actors are immune to such attacks,” he said.
ShinyHunters and Clop competing for dominance
In recent years, ShinyHunters has emerged as one of the most aggressive ransomware groups globally. In February this year, Google sounded the alarm over a ShinyHunters vishing campaign which targeted corporate environments.
Weeks later, Salesforce warned customers after ShinyHunters claimed to have breached its Experience Cloud. Notably, the group claimed responsibility for a devastating attack on education platform Canvas that impacted universities around the world.
Clop, meanwhile, has been a notorious player on the ransomware scene for several years.
The group has run a series of highly damaging campaigns in recent years, targeting everything from print management software to the MOVEit File Transfer system to gain access.
That prolific activity hasn't left the two groups too busy for infighting, it would seem.
Javvad Malik, Lead CISO Advisor at KnowBe4, said the incident was a timely reminder that cyber crime gangs are competitive businesses.
"When relationships are built on deception and fear, double-crossing and betrayal is always a credible threat," Malik said. "For defenders, it reinforces the need to understand not just the technology, but the motivations and behaviours of the people behind the attacks."