CyberNew CyberNew
Ransomware & Malware Dark Reading 3 weeks ago

ShinyHunters Hacked Clop. Now What About Clop's Victims?

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Data & Identity Stores
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"ShinyHunters apparently breached rival ransomware gang Clop last week, and the incident could pose additional risks to victim organizations caught in the middle. ShinyHunters is a financially motivated cybercrime group known primarily for data theft and extortion attacks. The group's identity has become increasingly fluid, with researchers observing ties to and collaboration with cybercriminals..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

ShinyHunters apparently breached rival ransomware gang Clop last week, and the incident could pose additional risks to victim organizations caught in the middle.

ShinyHunters is a financially motivated cybercrime group known primarily for data theft and extortion attacks. The group's identity has become increasingly fluid, with researchers observing ties to and collaboration with cybercriminals associated with the Scattered Spider and Lapsus$ collectives.

Clop, meanwhile, is a notorious ransomware gang best known for large-scale data extortion campaigns, particularly involving zero-day vulnerabilities. Clop actors were behind the massive 2023 campaign that exploited a zero-day in Progress Software's MOVEit file transfer software, as well as a similar campaign that targeted a Fortra GoAnywwhere flaw that same year.

Over the weekend, ShinyHunters defaced Clop's Dark Web data leak site with a message: "DOMAIN SEIZED BY SHINYHUNTERS." As first reported by BleepingComputer, ShinyHunters claimed the attack began on Friday night when it exploited an unauthenticated file upload vulnerability in the Grav CMS used by Clop's leak site.

Related:Cybercriminals Are Hiding New Malware in Torrents for Popular Films

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →