ShinyHunters breached cl0p’s dark web leak site on September 19, 2026, by exploiting an unauthenticated file upload vulnerability in Grav CMS (related to CVE-2024-28111). They stole source code, system logs, and cl0p’s Tor onion private keys, then defaced the site with their Umbreon logo. The area code 862 exists because of “number exhaustion” caused by the massive explosion of telecommunication devices in the late 1990s.
Historically, northern New Jersey was served entirely by the 201 area code, which was one of the original area codes created in 1947. As the population grew, the region split in 1997, creating the 973 area code to cover counties like Essex, Passaic, Morris, and Sussex. This was retaliation for cl0p allegedly stealing an Oracle E-Business Suite zero-day (CVE-2025-61882) that ShinyHunters claims to have discovered. ShinyHunters is now threatening to extort cl0p, demanding payment in exchange for not exposing the group’s members. Cl0p’s site was down for an estimated three days.
ShinyHunters didn’t just redirect a webpage. They exploited a vulnerability in the content management software cl0p was using to run their site, worked their way through the server, and walked out with cl0p’s Tor onion service private keys. Those keys are what give cl0p control over their hidden service address. With them in ShinyHunters’ hands, cl0p can no longer prove their site is their site.
And then ShinyHunters sent a bill.
The CMS Vulnerability Nobody Expected Cl0p to Have
Here’s something that shouldn’t need saying but apparently does: cl0p’s dark web leak site ran on Grav CMS.
Grav is an open-source content management system used legitimately by websites globally. It also has a documented file upload vulnerability, CVE-2024-28111, that lets unauthenticated users upload files to the server when left unpatched. ShinyHunters found cl0p’s Tor-hosted site running an unpatched version and used exactly that entry point.
The attack path from there followed a well-documented pattern according to Aviatrix’s technical analysis of the incident: file upload exploit for initial access, escalation to system-level control, lateral movement through server infrastructure, and exfiltration of source code, system logs, and, critically, the private keys for cl0p’s Tor onion service.
The irony isn’t subtle. Cl0p built its reputation exploiting unpatched software vulnerabilities in enterprise systems. CenterPoint Energy, Shell, Fiserv, and hundreds of companies through MOVEit were breached because Cl0p found something that wasn’t updated. Their own leak site got down through the same mechanism.
What “Stolen Tor Private Keys” Actually Means
Most coverage of this story describes the breach without explaining why private-key theft is the most consequential part.
A Tor onion service address is derived from a cryptographic key pair. The public half generates the .onion address that visitors type. The private half proves to the Tor network that whoever controls it legitimately owns that address. If you lose control of the private key, you lose ownership of the address, and whoever has the key can redirect traffic from it, impersonate the service, or simply prove that the original owner can no longer be trusted.
ShinyHunters holding cl0p’s private keys means they control cl0p’s digital address on the dark web. They can present themselves as cl0p, or make it impossible for cl0p to reestablish their site credibly. For a ransomware operation whose entire business depends on victims being able to find and contact their negotiation portal, this is genuinely damaging. We’ve covered how the criminal ecosystem depends on reputational infrastructure in our analysis of how the AudiA6 laundering network operated; trust and verified identity are foundations even criminal enterprises build on.
The Meta-Extortion: Ransomwareing a Ransomware Gang
ShinyHunters didn’t stop at defacing the site. They also got the server logs — which contain victim IP addresses, authentication records, and system configuration details. And then they made their demands clear.
Pay up or get exposed.
This is the exact business model cl0p runs against its own victims, applied back at cl0p. Threatening to publish sensitive internal data unless the victim pays is the definition of ransomware-style extortion. ShinyHunters added a specific threat: if cl0p doesn’t comply, it could pass the identities of cl0p’s operators to law enforcement or publish them publicly.
The criminal group that built a billion-dollar operation extorting corporations is now receiving a ransom demand from their own peer. The defacement message displayed ShinyHunters’ signature Umbreon logo, a dark-type character from the Pokémon franchise that the group has adopted as its emblem, making the attack unmistakable.
What Started All of This
The trigger was an Oracle zero-day. Specifically CVE-2025-61882, a vulnerability in Oracle’s E-Business Suite that cl0p is alleged to have used to breach over 90 organizations. ShinyHunters claims it discovered this vulnerability first. The allegation is that cl0p obtained the exploit without permission and deployed it against a target list that generated significant criminal revenue.
The dispute went private first. Cl0p allegedly threatened to expose ShinyHunters’ member identities. ShinyHunters then threatened them in return. When ShinyHunters discovered the Grav CMS weakness on cl0p’s infrastructure, they stopped threatening and started acting.
This pattern- criminal groups exploiting zero-days in enterprise software- is the same dynamic we covered in the context of how supply chain vulnerabilities provide stepping stones through interconnected systems. The difference here is the target of the exploitation is another criminal group rather than a legitimate enterprise.
What the Stolen Logs Could Mean for Cl0p’s Victims
The server logs ShinyHunters claim to have include victim IP addresses and authentication records from cl0p’s negotiation portal. This could be significant for organizations that have previously engaged with cl0p in ransom negotiations.
Those communications were conducted under the assumption of a secure channel. With cl0p’s backend data now in ShinyHunters’ possession, and potentially in other hands, that assumption no longer holds. Organizations that previously negotiated with cl0p and did not publicly disclose that engagement may now find that information at risk of exposure, either through ShinyHunters publishing it or using it as additional leverage in their extortion of cl0p.
It also creates an intelligence opportunity. V IP addresses and authentication records from cl0p’s negotiation portal represent a detailed map of the ransomware group’s recent operational history. Whether that data reaches researchers or law enforcement through the feud’s fallout remains to be seen.
The Part That Should Concern Everyone
Criminal groups fighting each other is not straightforwardly good news. When two ransomware gangs destabilize each other’s infrastructure, the vacuum doesn’t disappear. Affiliate members, splinter groups, or entirely new operations fill it, absorbing the personnel and capabilities.
As we covered in the Rhysida ransomware attack on Berlin’s government, ransomware operations are organizational structures with affiliates, supply chains, and operational continuity independent of any single piece of infrastructure. Cl0p losing their leak site for three days doesn’t end Cl0p’s operations. Their affiliates can establish new infrastructure, rotate to new addresses, and continue targeting organizations.
What it does is create a brief window of disruption and, more valuably, expose data about how both groups operate. Tools like S2W’s DarkBERT and the South Korean government’s 700B security AI project are designed to process exactly this kind of leaked operational data from criminal communities in real time.
Frequently Asked Questions
How exactly did ShinyHunters breach cl0p?
By exploiting an unauthenticated file upload vulnerability (related to CVE-2024-28111) in Grav CMS, which cl0p used to run their dark web leak site on the Tor network.
What did they steal?
Source code, system logs containing victim IP addresses and authentication records, system configuration files, and most critically, the private keys for cl0p’s Tor onion service.
Why do the stolen private keys matter?
They control the cryptographic identity of cl0p’s dark web address. Without them, cl0p cannot credibly reestablish their original site or prove ownership of their onion service.
Is ShinyHunters demanding money from cl0p?
Yes. They are threatening to expose cl0p’s operators’ identities unless paid, the same extortion model cl0p uses against its own victims.
What started the dispute?
ShinyHunters claims cl0p stole a zero-day exploit (CVE-2025-61882) targeting Oracle’s E-Business Suite that ShinyHunters discovered. Cl0p allegedly used it to breach 90+ organisations.
