conv.

All stories
SecurityQuiet 3d · day 3

ShinyHunters hijacks rival cybercrime gang cl0p's dark web site

A public feud between two of the world's most prolific data-extortion gangs spills onto the dark web after a disputed zero-day exploit.

newest coverage 2d agosummary written 2d ago6 pieces2 likes & upvotes NewswiresHacker News

What to know

  • ShinyHunters says it hijacked rival gang cl0p's dark web site on Sept 18-19 after finding a vulnerability in cl0p's infrastructure.
  • The feud stems from a disputed 2025 zero-day exploit in Oracle's E-Business Suite, which cl0p used to steal data from over 100 companies but which ShinyHunters says it discovered first.
  • Both groups reportedly threatened to expose each other's members and internal operations; cl0p has not responded to requests for comment and Reuters could not verify ShinyHunters' account.
  • Security researchers call the open, public clash between two major cybercrime groups unusual and apparently genuine.

“This was a twist for sure. It is rare I get to see these criminals fight each other.”

Joe Roosen, Senior director of security research, SpyCloud · Reuters ↗ · Sep 19

ShinyHunters Digital extortion groupcl0p Russian-speaking cybercrime gangBrandon Parsons Threat intelligence manager, Ascent SolutionsJoe Roosen Senior director of security research, SpyCloud

ShinyHunters hijacks rival cybercrime gang cl0p's dark web site
Daily Maverick

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 1 piece in one hour at Sep 20, 8 PM; 6 pieces over 3 days (5 articles · 1 post) Sep 20, 8 PM — 1 piece · 1 article — Newswires 1Sep 20, 9 PM — 1 piece · 1 article — Newswires 1Sep 20, 10 PM — 1 piece · 1 article — Newswires 1Sep 20, 11 PM — 1 piece · 1 article — Newswires 1Sep 21, 12 AM — quietSep 21, 1 AM — quietSep 21, 2 AM — quietSep 21, 3 AM — quietSep 21, 4 AM — 1 piece · 1 post — Hacker News 1Sep 21, 5 AM — quietSep 21, 6 AM — quietSep 21, 7 AM — quietSep 21, 8 AM — quietSep 21, 9 AM — quietSep 21, 10 AM — quietSep 21, 11 AM — 1 piece · 1 article — Newswires 1Sep 21, 12 PM — quietSep 21, 1 PM — quietSep 21, 2 PM — quietSep 21, 3 PM — quietSep 21, 4 PM — quietSep 21, 5 PM — quietSep 21, 6 PM — quietSep 21, 7 PM — quietSep 21, 8 PM — quietSep 21, 9 PM — quietSep 21, 10 PM — quietSep 21, 11 PM — quietSep 22, 12 AM — quietSep 22, 1 AM — quietSep 22, 2 AM — quietSep 22, 3 AM — quietSep 22, 4 AM — quietSep 22, 5 AM — quietSep 22, 6 AM — quietSep 22, 7 AM — quietSep 22, 8 AM — quietSep 22, 9 AM — quietSep 22, 10 AM — quietSep 22, 11 AM — quietSep 22, 12 PM — quietSep 22, 1 PM — quietSep 22, 2 PM — quietSep 22, 3 PM — quietSep 22, 4 PM — quietSep 22, 5 PM — quietSep 22, 6 PM — quietSep 22, 7 PM — quietSep 22, 8 PM — quietSep 22, 9 PM — quietSep 22, 10 PM — quietSep 22, 11 PM — quietYesterday, 12 AM — quietYesterday, 1 AM — quietYesterday, 2 AM — quietYesterday, 3 AM — quietYesterday, 4 AM — quietYesterday, 5 AM — quietYesterday, 6 AM — quietYesterday, 7 AM — quietYesterday, 8 AM — quietYesterday, 9 AM — quietYesterday, 10 AM — quietYesterday, 11 AM — quietYesterday, 12 PM — quietYesterday, 1 PM — quietYesterday, 2 PM — quietYesterday, 3 PM — quietYesterday, 4 PM — quietYesterday, 5 PM — quietYesterday, 6 PM — quietYesterday, 7 PM — quietYesterday, 8 PM — quietYesterday, 9 PM — quietYesterday, 10 PM — quietYesterday, 11 PM — quietToday, 12 AM — quiet 1
Sep 21Sep 22yesterdaynow · 1:58 AM ET
  1. 1

    Coverage spreads noting cl0p's and ShinyHunters' track records

    Outlets recap cl0p's 2023 MOVEit breach affecting over 600 companies and its recent claimed theft from nearly 50 firms, alongside ShinyHunters' Rockstar Games and Canvas hacks and Anthropic's recent detection of ShinyHunters-linked activity.

    “Street beefs on the dark web are a real thing.”
    — Brandon Parsons, Threat intelligence manager, Ascent Solutions · source
  2. background

    Security researchers say the dark web feud looks genuine — Two cybersecurity experts told Reuters the public clash between the two groups appeared real and unusually open for rival cybercrime gangs.

  3. background

    ShinyHunters publicly claims the hijack and details the feud — ShinyHunters told Reuters it broke into cl0p's site after discovering the vulnerability, and disclosed that cl0p had threatened to reveal its members' identities while ShinyHunters threatened to expose cl0p's internal workings. Cl0p did not respond to requests for comment.

  4. background

    Cl0p's dark web site is defaced with a seizure message — Cl0p's site displayed the words "Domain Seized By ShinyHunters," according to a screenshot preserved by cybercrime research platform eCrime.ch; the site was later unreachable.

  5. background

    ShinyHunters breaches cl0p's dark web infrastructure — ShinyHunters says it exploited a vulnerability in cl0p's own software to gain wide-ranging control over the rival gang's dark web site and infrastructure.

  6. background

    Cl0p allegedly steals a zero-day exploit from ShinyHunters — ShinyHunters says it discovered a then-unknown flaw in Oracle's E-Business Suite (EBS) software first, but accuses cl0p of stealing the exploit, sparking a feud between the two groups.

Also covered reported alongside — the timeline has no entry for these yet

  1. 5 outlets Cybercrime feud erupts on dark web as notorious group claims hijack of rival's website

    first by Reuters, 2d ago · also Daily Maverick, Indian Express, Straits Times, Channel News Asia