Clop Faces Extortion After Rival Hackers Hijack Its Leak Site
ShinyHunters demands eight-figure payment after exploiting vulnerability in Clop's infrastructure.
1Rival hackers hijack Clop's site
ShinyHunters took over Clop's dark web leak site, displaying a seizure banner and demanding payment. The hack occurred through a vulnerability in the site's software, which ShinyHunters claims gave them extensive access to Clop's infrastructure. This marks a rare case where an extortion group becomes the victim of extortion. The public defacement undermines Clop's operational security and reputation in the cybercrime community.
2Roots of the feud
The conflict stems from last year's attacks on Oracle E-Business Suite customers. ShinyHunters claims they discovered the zero-day exploit first, only for Clop to use it against corporate networks. Now ShinyHunters demands a share of Clop's profits from those attacks. They've posted messages dating the dispute back to these events, framing their current demands as retribution for stolen opportunities.
3Escalating financial demands
Initial demands included an eight-figure sum representing 2.333% of ShinyHunters' claimed net worth. Subsequent updates increased this to all profits from the EBS campaign plus interest. The hackers are using the seized platform to post increasingly aggressive messages, threatening to expose companies that previously paid ransoms to Clop, including payment amounts and Bitcoin addresses.
4Tactical timeline pressure
ShinyHunters imposed a 24-hour countdown on September 21, warning that demands would increase with each passing day without response. They've added new requirements including a public apology. This mirrors typical ransomware group tactics, but unusually applied between criminal organizations rather than against legitimate businesses.
5Reputation damage
For an extortion group, losing control of its leak site represents significant operational and reputational harm. These sites demonstrate control over stolen data and operational security. Having a rival repurpose the platform to extort the original extortionists undermines credibility in the criminal ecosystem where reputation directly impacts effectiveness.
6Potential collateral damage
If ShinyHunters publishes records of previous ransom payments as threatened, this could expose companies that believed paying Clop kept negotiations private. Such disclosures would create legal and reputational risks for victim organizations that had hoped to quietly resolve breaches. However, these claims remain unverified as of reporting.
7Comparative notoriety
Both groups have extensive cybercrime histories. Clop gained infamy through the 2023 MOVEit campaign affecting thousands of organizations. ShinyHunters has been linked to numerous large-scale data thefts. This incident represents an unusual public conflict between two established criminal operations rather than the typical hacker-vs-company dynamic.
8Industry implications
The public feud between prominent ransomware groups may signal increasing competition in the cybercrime ecosystem. It demonstrates how even criminal operations face security vulnerabilities and reputational risks. The incident could influence how future ransomware groups approach operational security and inter-group conflicts in an increasingly crowded and competitive underground market.