ShinyHunters hacks rival extortion gang and takes over its dark web site

Reportedly, the ShinyHunters extortion group breached the leak site of one of its competitors, the Clop ransomware gang.

ShinyHunters is a financially motivated cybercrime and extortion group active since 2019. It is known for stealing large volumes of data and pressuring victims to pay, rather than necessarily deploying ransomware. One recent high-profile organization targeted by the group was Instructure, the maker of Canvas LMS. ShinyHunters claimed it stole 3.65 TB of data belonging to about 9,000 academic institutions.

Clop, also written Cl0p, is a ransomware and data-extortion operation associated with large-scale exploitation of vulnerabilities in enterprise software and file-transfer platforms. In its recent campaign targeting PTC Windchill systems, it named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, and Toast.

At the time of writing, the Clop dark web leak site looks like this:

Domain seized by ShinyHunters

The rest of that page looks much the same as the ShinyHunters leak site, which includes this “Note to Cl0p”: