# Clop Faces Extortion After Rival Hackers Hijack Its Leak Site ShinyHunters demands eight-figure payment after exploiting vulnerability in Clop's infrastructure. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-09-21 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a5387d59-1f8f-492c-a886-25418aea55dc ## Rival hackers hijack Clop's site ShinyHunters took over Clop's dark web leak site, displaying a seizure banner and demanding payment. The hack occurred through a vulnerability in the site's software, which ShinyHunters claims gave them extensive access to Clop's infrastructure. This marks a rare case where an extortion group becomes the victim of extortion. The public defacement undermines Clop's operational security and reputation in the cybercrime community. ## Roots of the feud The conflict stems from last year's attacks on Oracle E-Business Suite customers. ShinyHunters claims they discovered the zero-day exploit first, only for Clop to use it against corporate networks. Now ShinyHunters demands a share of Clop's profits from those attacks. They've posted messages dating the dispute back to these events, framing their current demands as retribution for stolen opportunities. ## Escalating financial demands Initial demands included an eight-figure sum representing 2.333% of ShinyHunters' claimed net worth. Subsequent updates increased this to all profits from the EBS campaign plus interest. The hackers are using the seized platform to post increasingly aggressive messages, threatening to expose companies that previously paid ransoms to Clop, including payment amounts and Bitcoin addresses. ## Tactical timeline pressure ShinyHunters imposed a 24-hour countdown on September 21, warning that demands would increase with each passing day without response. They've added new requirements including a public apology. This mirrors typical ransomware group tactics, but unusually applied between criminal organizations rather than against legitimate businesses. ## Reputation damage For an extortion group, losing control of its leak site represents significant operational and reputational harm. These sites demonstrate control over stolen data and operational security. Having a rival repurpose the platform to extort the original extortionists undermines credibility in the criminal ecosystem where reputation directly impacts effectiveness. ## Potential collateral damage If ShinyHunters publishes records of previous ransom payments as threatened, this could expose companies that believed paying Clop kept negotiations private. Such disclosures would create legal and reputational risks for victim organizations that had hoped to quietly resolve breaches. However, these claims remain unverified as of reporting. ## Comparative notoriety Both groups have extensive cybercrime histories. Clop gained infamy through the 2023 MOVEit campaign affecting thousands of organizations. ShinyHunters has been linked to numerous large-scale data thefts. This incident represents an unusual public conflict between two established criminal operations rather than the typical hacker-vs-company dynamic. ## Industry implications The public feud between prominent ransomware groups may signal increasing competition in the cybercrime ecosystem. It demonstrates how even criminal operations face security vulnerabilities and reputational risks. The incident could influence how future ransomware groups approach operational security and inter-group conflicts in an increasingly crowded and competitive underground market. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/09/21/clop-gets-a-taste-of-its-own-medicine-after-shinyhunters-hijack-leak-site/5297702 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._