ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

1. Executive summary

The ShinyHunters extortion gang (MITRE G1057) claims to have breached the Clop ransomware operation's Tor-based data leak site, defacing it and stealing server data plus the private keys for the onion service. Initial access allegedly came via an unauthenticated file upload vulnerability in Grav CMS, exploited Friday night. Clop has no MITRE ATT&CK profile, and the attribution of the original Clop operation is unconfirmed; the entire account currently rests on a single report from Lawrence Abrams, relayed by DataBreaches, with the full technical detail behind a paywall. There is no direct risk to EMEA financial services clients from this intrusion itself: the victim is a criminal infrastructure operator, not a client or a regulated third party. The indirect relevance is that Clop's stolen victim data and leak-site keys may be republished or resold, and that an unauthenticated upload flaw in Grav CMS, if confirmed and patched, is a lesson for any client running that platform.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The incident affects criminal infrastructure, not a client's own ICT systems, an ICT third-party provider in scope of a client's contracts, or a supply-chain component a client operates. Clients running Grav CMS should treat the patching question under their normal vulnerability management process; the item as reported does not trigger a distinctive obligation under the articles in scope.

3. Technical analysis & attack chain

The confirmed detail available is thin because the primary report is truncated and the underlying BleepingComputer article is paywalled. What the source states, as a claimed sequence:

1. ShinyHunters identified an unauthenticated file upload vulnerability in Grav CMS exposed by Clop's leak-site infrastructure.
2. On Friday night they exploited the flaw to gain access to the server hosting the Tor onion service.
3. They defaced the leak site.
4. They claim to have stolen server data and the private keys for the onion service.
5. They have threatened to extort Clop itself, inverting the usual ransomware extortion model.

Technical specifics that matter to a defender, limited to what the source supports:

• Initial access vector: unauthenticated file upload in Grav CMS. No CVE identifier, version number, or exploit detail is given in the available text. The verified reference data for this item contains no CVE record, CVSS score, or CISA-KEV entry for this flaw, so we assign no severity and no exploitation status to it.
• Payload, persistence, privilege escalation, command-and-control, lateral movement: not described in the available source material.
• Data access: claimed theft of server data and the onion service's private keys. If the private-key claim is accurate, anyone holding them can host a convincing copy of the Clop onion service, which matters for anyone who monitors or visits leak sites for threat-intel purposes.
• Observed impact: defacement of the Tor site, plus the extortion threat against Clop.

Confidence caveats: every material claim here is single-sourced, originating with Lawrence Abrams's report and republished by DataBreaches. ShinyHunters' own claims about the vulnerability and the stolen keys are attacker assertions, not independently verified. Clop's identity and attribution are unconfirmed in the verified reference data (no MITRE ATT&CK profile); ShinyHunters is profiled as G1057. Treat the entire chain as claimed until the paywalled report or independent corroboration is available.

4. Mitigation & containment

This incident does not create a containment action for clients. The actions below are the two that follow from the reported facts.

P1 (within 24h):

• No client-side containment action is required. The victim is criminal infrastructure. Do not block or hunt on the basis of this report alone; there are no validated indicators.

P2 (within 72h):

• If your organisation runs Grav CMS on any internet-facing server, check the current version against the vendor's security advisories and apply the latest patch. The source names the flaw only as an unauthenticated file upload, gives no CVE or affected version, so verify against Grav's own advisories rather than this report. Restrict write access to the CMS upload paths and disable anonymous file upload functionality if the deployment does not require it.
• If your threat-intel or brand-protection function monitors Clop's onion service for client data, treat any content served from it after Friday night with suspicion. Stolen onion private keys would allow a third party to impersonate the service, so confirm any "leak" through a second channel before acting on it or notifying a client.

P3 (within 7 days):

• Review whether any incident-response runbook assumes leak-site content is authentic evidence of a breach. Where it does, add a verification step, since this incident shows leak-site content and identity can be manipulated by a third party.

5. Indicators of compromise

No indicators of compromise available in the source material. The report names no onion addresses, hashes, IP addresses, or file artefacts. The onion service's private keys are described as stolen but are not published in the available text.

6. Detection

Insufficient indicators to author detection rules. The source contains no strings, file names, command lines, or registry artefacts attributable to the intrusion. Grav CMS is a legitimate product and is not itself a detection artefact.

Threat actor context

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

No MITRE ATT&CK profile for: Clop.

7. Sources

• DataBreaches, "ShinyHunters hacks Clop leak site, threatens to extort ransomware gang", https://databreaches.net/2026/09/19/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/, 2026-09-19
• Lawrence Abrams (BleepingComputer), original report referenced by the above; not directly available, content truncated and paywalled.

8. Adverse Trace position

We assess this item as low direct severity for EMEA financial services clients: the victim is a ransomware gang's own infrastructure and no client system, data, or in-scope third party is reported as affected. The report is single-sourced and paywalled, the technical claims are attacker assertions, and Clop's attribution is unconfirmed, so we will not issue client actions or indicators on this basis. Two things are worth watching: whether the Grav CMS upload flaw is confirmed and assigned a CVE, at which point it becomes a standard patch-management item for any client running that platform, and whether the stolen onion private keys are used to impersonate the Clop leak site, which would degrade the evidentiary value of leak-site monitoring. We will update this advisory if the full Abrams report or independent corroboration becomes available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.