Cybercriminal Infighting: ShinyHunters Claims to Have Hacked Rival Ransomware Gang Clop

ShinyHunters, a prolific cyber extortion gang, has claimed responsibility for hacking a rival criminal group, Clop, best known for its ransomware operations. On 18 September, Clop's dark web data leak site was defaced with a message declaring it had been compromised, along with artwork replacing the site's background. ShinyHunters says it stole private keys and server data used to run Clop's operations, including files that could reveal activity logs, authentication records and IP addresses tied to Clop members.

Rather than treating Clop as a fellow criminal outfit, ShinyHunters is reportedly treating the group like any other victim, issuing a ransom demand and stating an intention to extort Clop directly. This apparent gang-on-gang attack seems to stem from an ongoing feud between the two groups dating back to 2025, originally sparked by competing claims over exploitation of a vulnerability in Oracle E-Business Suite servers that both groups used in separate extortion campaigns.

Security experts say the episode is a reminder that criminal hacking groups are not unified organisations but competitive, profit-driven operations built on shaky trust. As one industry advisor noted, when relationships are based on deception, betrayal between groups is always plausible. For defenders, understanding these internal rivalries and motivations can offer useful insight into how threat groups operate and evolve, even if it does not change the risk they pose to legitimate businesses.