Skip to content
Today
Sections

Security Widely confirmed6 publishers 2 min read Published Updated

ShinyHunters claims the private keys to Clop's onion address after defacing the leak site

BleepingComputer confirmed the defacement and the file ShinyHunters uploaded to Clop's Tor site. The stolen logs and the onion keys are so far only the attacker's account, and Clop has 72 hours to make contact.

The Watch · Security desk

Send a correction

Illustration accompanying ShinyHunters claims the private keys to Clop's onion address after defacing the leak site
Generated illustration

What happened

  • ShinyHunters began the attack on Friday night and got in through what it says is an unauthenticated file upload vulnerability in Grav CMS, using it to upload a small text file to Clop's leak site.
  • Several hours later the site had been replaced with ASCII art of Umbreon, the Pokemon used as ShinyHunters' logo, alongside a link to the group's own Tor site.
  • ShinyHunters told BleepingComputer it had full access to the server and took source code, Grav CMS plugins, system logs and other data that it was still downloading and reviewing.
  • BleepingComputer confirmed the defacement and the uploaded file, and did not independently verify the claimed theft of server logs, source code or Clop's onion private keys.
  • Clop exploited several Oracle E-Business Suite vulnerabilities in October 2025, including the zero-day CVE-2025-61882, in data theft and extortion campaigns.

Why it matters

  • What's now possible capability Whoever holds an onion service's private keys can serve that address from their own hardware, so evicting an intruder from the box does not return control of the URL to its operator.
  • Who's exposed exposure Every host that connected to Clop's leak site, victim-side responders included, is exposed in a copied log set if the /var/log claim holds.
  • What doesn't add up contradiction The only description of the Grav CMS flaw comes from the attacker, with no identifier or affected version, so anyone running Grav has nothing to check their own installation against.
  • Who has to decide decision Clop now has to choose inside 72 hours between negotiating with ShinyHunters and abandoning the onion address that victims and researchers know it by.

ShinyHunters told BleepingComputer, "We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL" [14]. BleepingComputer said that if the keys are valid, the group could run a Tor site at Clop's existing onion address from servers it controls [15]. Researchers and responders treat a listing at a known leak-site address as the gang's own publication. Once two parties can serve one address, a post there does not establish who wrote it [21].

The evidence is uneven across the five outcomes ShinyHunters described. Two are confirmed: the uploaded file, which BleepingComputer downloaded directly from Clop's Tor site [9], and the defacement. The source code and Grav plugins, the contents of /var/log, and the onion keys rest on the group's own account [20].

The retrievable file does establish one thing. An attacker could write into a path that Clop's web server then handed back to any visitor [11]. The file read: "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time" [8].

ShinyHunters also says it took every file under /var/log, which can hold system activity, authentication records, and the IP addresses of hosts that connected to the site [13]. As of the report, the defaced page was still being served from Clop's own infrastructure, according to the group [5].

The dispute has a paper trail. Around the time of the Oracle campaign, actors calling themselves Scattered Lapsus$ Hunters, ShinyHunters among them, leaked a proof-of-concept exploit that Oracle later confirmed matched the one used in the Clop attacks, and ShinyHunters said the exploit had been theirs and that Clop took it without authorization [7]. The group says a Clop representative then threatened to identify its members and made violent threats after ShinyHunters disrupted a Clop data theft campaign [18]. Researcher VXDB told BleepingComputer that the Umbreon artwork now on Clop's site is the same image used in the August 2020 defacement of HackForums, which ShinyHunters also claimed at the time [10].

ShinyHunters said it would post a message on its own leak site telling Clop to make contact within 72 hours [4]. Asked what it planned to do with the stolen data, the group said, "Going to extort them." [3]

What to watch

  • Whether Grav publishes an advisory or a CVE matching the unauthenticated upload path ShinyHunters describes.
  • Whether Clop's existing onion address later resolves to content ShinyHunters controls, which would test the key claim.
  • Whether ShinyHunters publishes anything from /var/log identifying hosts that connected to the leak site.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence60
Adoption55
Hype gap+35
Incentives78
Confidence62

Perspective Coverage

6 publishers
Builder
Builder 18%
Operator
Operator 63%
Investor
Investor 19%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The ShinyHunters extortion gang breached the Clop (Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service.

    Reported SupportedView cited source
  2. [2]

    Several hours later ShinyHunters told BleepingComputer it had "completely defaced" the Clop site; the page was replaced with ASCII art of Umbreon, the Pokemon used as ShinyHunters' logo, a link to the group's Tor site, and the message "rooting your systems since '19 ;)".

    Reported SupportedView cited source
  3. [3]

    Asked what they planned to do with the stolen information, the threat actor responded, "Going to extort them."

    Reported SupportedView cited source
  4. [4]

    The group says it plans to publish a message on its own leak site instructing Clop to contact them within 72 hours.

    Reported SupportedView cited source
  5. [5]

    At the time of writing, the defaced page was still being served from Clop's infrastructure, according to ShinyHunters.

    Reported SupportedView cited source
  6. [6]

    In October 2025, Clop exploited multiple vulnerabilities in Oracle E-Business Suite servers, including a zero-day flaw tracked as CVE-2025-61882, to steal data from organizations in extortion campaigns.

    Reported SupportedView cited source
  7. [7]

    Around the same time, threat actors calling themselves "Scattered Lapsus$ Hunters", including ShinyHunters, leaked a proof-of-concept exploit that Oracle later confirmed matched an exploit used in the Clop attacks; ShinyHunters told BleepingComputer the exploit had originally belonged to them and that Clop obtained it without authorization.

    Reported SupportedView cited source
  8. [8]

    The uploaded file read: "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time", and also contained a link to the ShinyHunters data leak site.

    Reported SupportedView cited source
  9. [9]

    BleepingComputer confirmed that the file had been uploaded to Clop's server and could be downloaded directly from the ransomware gang's Tor site.

    Reported SupportedView cited source
  10. [10]

    Cybersecurity researcher VXDB told BleepingComputer the Umbreon artwork now displayed on Clop's leak site is the same as what was used in the August 2020 defacement of the HackForums website, which ShinyHunters also claimed at the time.

    Reported SupportedView cited source
  11. [11]

    An attacker was able to write a file into a path that Clop's web server then served to visitors.

    Derived Supported
  12. [12]

    ShinyHunters told BleepingComputer it gained "full access" to the server and stole source code, Grav CMS plugins, system logs, and other data, and was still downloading and reviewing them.

    Reported InsufficientView cited source
  13. [13]

    ShinyHunters claims to have stolen all files stored under /var/log, which could contain system activity, authentication logs, and potentially the IP addresses of those who connected to the site.

    Reported InsufficientView cited source
  14. [14]

    ShinyHunters told BleepingComputer: "We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL".

    Reported InsufficientView cited source
  15. [15]

    BleepingComputer reported that if the keys are valid, it would allow the threat actors to operate a Tor site using Clop's existing onion address on servers they control.

    Reported InsufficientView cited source
  16. [16]

    BleepingComputer independently confirmed the defacement and the earlier uploaded file but has not independently verified ShinyHunters' claims that it stole server logs, source code, or Clop's onion private keys.

    Reported InsufficientView cited source
  17. [17]

    The attack began Friday night when ShinyHunters exploited what they claim is an unauthenticated file upload vulnerability in Grav CMS, which they used to upload a small text file to Clop's site.

    Reported InsufficientView cited source
  18. [18]

    ShinyHunters says the attack is retaliation for threats allegedly made by a Clop representative, who it says threatened to identify group members and made violent threats after ShinyHunters disrupted a Clop data theft campaign; ShinyHunters says the dispute dates back to Clop's 2025 Oracle E-Business Suite data theft campaign.

    Reported InsufficientView cited source
  19. [19]

    ShinyHunters told BleepingComputer: "During the Oracle EBS campaign they ran and stole from me last year, someone from cl0p personally messaged me and said, and I quote (translated from Russian): I have more money than you and all of your people combined, I'll kill you soon".

    Reported InsufficientView cited source
  20. [20]

    Of the five outcomes ShinyHunters described, two are independently confirmed (the uploaded file and the defacement) and three rest on the group's own account (source code and Grav plugins, the /var/log files, the onion private keys).

    Derived Insufficient
  21. [21]

    If two parties can serve the same onion address, a listing published at that address no longer establishes who published it.

    Derived Insufficient
  22. [22]

    The account of the claimed Grav CMS flaw comes only from ShinyHunters, and the report does not name a CVE or an affected Grav version.

    Derived Insufficient

Sources

6 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    2 articles · September 20, 2026

    ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
  2. cyberdaily.au

    1 article · September 21, 2026

    Hacker drama! ShinyHunters hacks, extorts Cl0P cyber extortion group - Cyber Daily
  3. infosecurity-magazine.com

    2 articles · September 21, 2026

    ShinyHunters Claim Hack of Rival Ransomware Gang Clop
  4. malwarebytes.com

    1 article · September 21, 2026

    ShinyHunters hacks rival extortion gang and takes over its dark web site
  5. scworld.com

    1 article · September 21, 2026

    ShinyHunters defaces Clop ransomware data leak site, claims data theft
  6. therecord.media

    1 article · September 21, 2026

    ShinyHunters cybercrime gang takes over Cl0p ransomware site, demands extortion payment

Topics and entities

Topics

Entities