Cybercrime Rivals Turn on Each Other: ShinyHunters Hijacks Cl0p's Extortion Site

In an unusual turn within the cybercrime underworld, the extortion group ShinyHunters has seized control of the dark web leak site normally used by the Cl0p ransomware gang to pressure its victims into paying. Over the weekend, the site was defaced with a banner announcing the takeover, followed by messages demanding an unspecified eight-figure payment described as a small percentage of Cl0p's alleged net worth.

ShinyHunters, a group typically known for social engineering rather than technical hacking, named three individuals it claims are Cl0p operators and demanded proceeds from Cl0p's recent campaign against Oracle's E-Business Suite, a widely used business platform. That earlier campaign had already prompted warnings from Oracle, the FBI, and cybersecurity agencies in the UK and Singapore. ShinyHunters says the feud began after Cl0p allegedly used a vulnerability without authorisation and threatened one of its members.

As part of the pressure campaign, ShinyHunters is threatening to publish records showing which companies paid Cl0p, how much, and which Bitcoin addresses were used, information that could expose past ransomware victims. By Monday, the site displayed a message apparently from Cl0p attempting to make contact, suggesting the dispute between the two groups is ongoing.