ShinyHunters Claims It Hijacked Rival cl0p's Dark Web Site
ShinyHunters says it took control of rival gang cl0p's dark web site, a claim two security experts describe as credible.
One of the most prominent cyber extortion groups has claimed it seized control of a rival gang's dark web site, pulling a long-running dispute between the two operations into public view.
ShinyHunters said it breached cl0p's site on Friday after finding a vulnerability in the rival group's software and using it to gain broad control over its infrastructure. "We basically own them now," the group said in an online chat.
Cl0p did not respond to repeated requests for comment. Its dark web site was unreachable on Sunday, but a day earlier it displayed the message "Domain Seized By ShinyHunters," according to a screenshot preserved by cybercrime research platform eCrime.ch.
Two cybersecurity experts said the clash appeared authentic. Brandon Parsons, a threat intelligence manager at Minnesota-based Ascent Solutions, noted that "street beefs on the dark web are a real thing." Joe Roosen, senior director of security research at Texas-based SpyCloud, said he had never seen one cybercrime group take on another so openly, calling it "a twist for sure" and adding that it is rare to watch such criminals fight each other.
Dispute over an Oracle exploit
ShinyHunters said the feud stemmed from the alleged theft last year of a software exploit targeting a then-unknown flaw in Oracle's E-Business Suite (EBS). Such "zero days" are prized by hackers because they allow sweeping access to vulnerable networks.
Cl0p, a Russian-speaking gang, used the EBS vulnerability to steal data from what a Google analyst estimated was more than 100 companies. ShinyHunters maintains it discovered the zero day first. As the dispute deepened, cl0p threatened to expose the identities of several of its rival's members, according to ShinyHunters, which in turn threatened to reveal details of cl0p's internal operations. The veracity of ShinyHunters' account could not be immediately established.
Both groups are prolific
Cl0p ranks among the most prolific and innovative cybercrime groups, largely for its skill in finding and exploiting flaws in enterprise software. In 2023, it used a bug in MOVEit file management software to steal data on tens of millions of people from more than 600 companies. Last month it claimed to have stolen large volumes of data from nearly 50 companies worldwide, including Philips, Shell, Fiserv and GE.
ShinyHunters is similarly active. It drew media attention in April after claiming to have stolen millions of business records from Rockstar Games, the maker of "Grand Theft Auto", and for a May hack centered on the education tool Canvas that disrupted schools across the United States. This month, AI company Anthropic said it had caught ShinyHunters-linked hackers attempting to use its tools.