Cybercrime civil war brewing? ShinyHunters reportedly hacks Cl0p ransomware gang and threatens further damage

• September 21, 2026

• ShinyHunters hacked rival gang Cl0p, stealing source code, logs, and onion service keys
• The gang defaced Cl0p’s site via Grav CMS flaw, posting their logo and taunts about past threats
• Feud recalls Conti’s collapse in 2022, raising risk of escalating “cyber war” between criminal groups

Infamous cybercriminal gang Cl0p has seemingly been hacked by an even more infamous data leak collective, ShinyHunters.

The attack is still being pieced together, but it would seem we have true hacker beef on our hands – which just might escalate into a full-blown cyber war.

ShinyHunters has added Cl0p to their data leak site, giving the hacking group 72 hours to pay a ransom or see all their files leaked into the cybercriminal underbelly. The files allegedly stolen in the attack include source code, Grav CMS plugins, system logs, and other information, Cybernews reports. We don’t know how much money ShinyHunters are asking to keep Cl0p’s files private.

Still downloading

“The data we stole includes source codes, gravCMS plugins, and other things. We are still downloading and reviewing them,” ShinyHunters allegedly told BleepingComputer.

The group also said they stole everything in the server’s /var/log directory, including system activity records, authentication logs, and IP addresses associated with connections to the server. We doubt this could lead to the identification of any Cl0p members, and even if it could, it would mean very little since the members are likely Russian and thus mostly free to conduct their operations.

Doxxing might help defenders disrupt the group’s infrastructure, though.

Whether or not that will be needed, given ShinyHunters’ activity, remains to be seen. The attackers also said they stole the private keys for Cl0p’s Tor onion service:

“We have their onion keys. So if they kick us out it wouldn’t matter at all because we control the private keys to host the same exact onion URL,” the group said.

On top of it all, ShinyHunters defaced Cl0p’s website. Allegedly, the group found an unauthenticated file upload flaw in the Grav CMS Cl0p was using, gaining access to their target’s servers, website, and more. Cybernews confirmed the website had been defaced and now holds an ASCII image of ShinyHunters’ logo, and a link to their Tor site. It also displays a large message:

“THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p – Maybe don’t try to threaten us next time.” Furthermore, it says “rooting your systems since ’19 ;)”.

The “maybe don’t try to threaten us next time” message seems to refer to a threat that a Cl0p member made earlier. Apparently, this person threatened violence against ShinyHunters, as well as to expose their identities to the public. The remarks were made during Cl0p’s 2025 Oracle E-Business Suite attacks.

“During the Oracle EBS campaign they ran and stole from me last year, someone from cl0p personally messaged me and said, and I quote (translated from Russian): I have more money than you and all of your people combined, I’ll kill you soon,” ShinyHunters told BleepingComputer.

Dog eat dog

Cybercriminals often work together. They share resources, rent each other’s services, and often complement their campaigns. However, that doesn’t make them “friends” or “colleagues”, in any way. It is usually just a marriage of convenience that falls apart at the slightest sound of trouble. The last big “feud” we’ve seen was back in 2022, at the very start of the Russian invasion of Ukraine. Back then, a group called Conti publicly declared its “full support” for the Russian government and threatened to use its resources against anyone conducting cyberattacks on Russian infrastructure.

The announcement was a fiasco – many of Conti’s affiliates stopped working with the group, and others were openly attacking it. Soon after, a Ukrainian researcher and an alleged affiliate leaked more than 60,000 messages, exposing the group’s operations and internal organization.

All of this eventually led to Conti’s collapse later that year. However, its members did not disappear – they splintered into multiple groups such as Black Basta, Royal, and Quantum. Some of the crooks engaged in Conti are allegedly still active today.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

ShinyHunters hacked rival gang Cl0p, stealing source code, logs, and onion service keys The gang defaced Cl0p’s site via Grav CMS flaw, posting their logo and taunts about past threats Feud recalls Conti’s collapse in 2022, raising risk of escalating “cyber war” between criminal groups Infamous cybercriminal gang Cl0p has…