Reported by 10 outlets

Timeline

1. original reporting

   ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw

   bleepingcomputer.com · 18d ago · September 25th, 2026

   The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. The Clop leak site was breached earlier this month by the ShinyHunters extortion gang, which first uploaded a small text file and later replaced the site with a full-page defacement displaying its Umbreon Pokémon logo and a link to its own data leak site. Clop data leak site defaced by ShinyHunters ShinyHunters later claimed on its own data leak site that it stole source code, Grav CMS plugins, server logs, and the private keys used by Clop's Tor onion service. The group then issued a ransom demand, threatening to leak the stolen files if Clop did not pay. Clop has now announced a new onion address and says the old domain will remain accessible temporarily before being retired. Clop also denied having any relationship or ongoing negotiations with ShinyHunters. "We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so—either now or in the future," Clop told BleepingComputer. When asked whether the group had determined how ShinyHunters breached the leak site, Clop confirmed that its Grav installation had not been fully updated. However, the Russian ransomware gang disputes ShinyHunters' claims that

2. update from tantosec.com

   Grav-ity of the situation: Unauthenticated Access to RCE in Grav CMS

   tantosec.com · 735d ago · October 9th, 2024

   The original researcher disclosure behind the flaw class used against Clop: Riyush Ghimire details CVE-2024-27921, a file upload path traversal reported to Grav maintainers on 13 January 2024 and fixed in Grav 1.7.45, chained with CVE-2024-34082 SSTI account takeover (fixed in 1.7.46) and Scheduler abuse for unauthenticated remote code execution. The post also documents Grav storing credentials and password reset tokens in flat YAML files under user/accounts and counts roughly 36,000 Grav admin login pages visible on ZoomEye. Date taken from the article's own '9 Oct 2024' byline.

3. update from bleepingcomputer.com

   ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

   bleepingcomputer.com · 24d ago · September 19th, 2026

   First news coverage of the breach: the attack began Friday night when ShinyHunters exploited what it claims is an unauthenticated file upload vulnerability in Grav CMS to plant a text file on Clop's Tor leak site, then replaced the site with an Umbreon defacement. ShinyHunters claims full server access, theft of source code, Grav plugins, all files under /var/log, and the private keys of Clop's onion service, and demanded an eight-figure payment rising every 24 hours. Page shows 'September 19, 2026 09:48 AM' US Eastern; the site's RSS feed confirms the -0400 offset, giving 13:48 UTC.

4. update from infosecurity-magazine.com

   ShinyHunters Claim Hack of Rival Ransomware Gang Clop

   infosecurity-magazine.com · 23d ago · September 21st, 2026

   Danny Palmer reports the incident came to light on the evening of 18 September and traces the feud to competing claims over the Oracle E-Business Suite zero-day CVE-2025-61882 exploited by Clop in 2025. It notes the stolen logs could reveal the IP addresses of people who connected to Clop's service, potentially unmasking gang members. Page is dated 21 September 2026.

5. update from malwarebytes.com

   ShinyHunters hacks rival extortion gang and takes over its dark web site

   malwarebytes.com · 23d ago · September 21st, 2026

   Reproduces ShinyHunters' escalating 'Note to Cl0p' with updates dated 19, 20 and 21 September 2026, including the demand for Clop's earnings from the Oracle EBS campaign plus interest and a threat to disclose which companies paid Clop, how much, and to what Bitcoin address.

6. update from anomali.com

   When Criminals Hack Criminals: ShinyHunters' Breach of Clop and What It Reveals About the Ransomware Underground

   anomali.com · 21d ago · September 23rd, 2026

   Vendor analysis published 23 September 2026 that connects the incident to CVE-2024-27921, noting the specific CVE used against Clop has not been publicly confirmed, and recalls the TantoSec chain to CVE-2024-34082 for full unauthenticated RCE, with CVE-2024-27921 patched in Grav 1.7.45. It frames the second-order risk that organizations which previously paid Clop may face exposure of their negotiation records.

7. update from www.bleepingcomputer.com

   ShinyHunters compromised Clop's leak site via a Grav CMS path traversal flaw

   www.bleepingcomputer.com · 18d ago · September 25th, 2026

   Ironic in substance: an infrastructure dedicated to leaking stolen data was itself breached. via Mastodon https://www.bleepingcomputer.com/news/security/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal-flaw/

8. mentioned by www.bleepingcomputer.com

   🤖 ShinyHunters defaced Clop's data leak site via an unauthenticated path traversal flaw in an unpatched Grav CMS instance. The ransomware ga

   www.bleepingcomputer.com · 18d ago · September 26th, 2026

9. mentioned by www.bleepingcomputer.com

   # ShinyHunters hacked # Clop leak site using # Grav # CMS path traversal flaw https://www. bleepingcomputer.com/news/secu rity/shinyhunters-

   www.bleepingcomputer.com · 17d ago · September 26th, 2026

10. update from justpaste.in

    Cybercrime feud erupts on dark web as notorious group claims hijack of rival’s website The ShinyHunters group says it broke into the dark we

    justpaste.in · 17d ago · September 26th, 2026

    Cybercrime feud erupts on dark web as notorious group claims hijack of rival’s website The ShinyHunters group says it broke into the dark we

    via Mastodon https://justpaste.in/news/cybercrime-feud-erupts-shinyhunters-claims-hijack-cl0p-website/

11. update from cyber.netsecops.io

    📰 ShinyHunters Hijacks Clop Ransomware Site in Inter-Gang Feud Cybercrime infighting: ShinyHunters has hijacked the data leak site of the Cl

    cyber.netsecops.io · 15d ago · September 28th, 2026

    📰 ShinyHunters Hijacks Clop Ransomware Site in Inter-Gang Feud Cybercrime infighting: ShinyHunters has hijacked the data leak site of the Cl

    via Mastodon https://cyber.netsecops.io/articles/shinyhunters-hijacks-clop-ransomware-leak-site-in-extortion-feud/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

12. update from malware.news

    Another ShinyHunters suspect arrested

    malware.news · 6d ago · October 7th, 2026

    The net is tightening around the Shiny Hunters cybercrime group following the reported arrest of a second member. On Saturday, Reuters said that 16 year-old Saif al-Din Khader had been arrested in Jordan and was in FBI custody. This follows the arrest earlier in September of another member in the Netherlands. Third party reports named him as 24 year-old Pepijn van der Stap, an offensive security lead at Dutch company Neo Security. The FBI posted a message following the Dutch arrest warning other ShinyHunter members that it was coming for them next. Cyber Division Assistant Director Brett Leatherman hinted that people already taken into custody had been talking. I suggest you reach out first while the choice is still yours.” According to security blogger Brian Krebs, Khader (who goes by the nickname ‘Rey’), was the technical operator and public face of Scattered LAPSUS$ Hunters, which he said was an amalgamation of three groups: Scattered Spider, LAPSUS$ and ShinyHunters. Active since at least 2019, ShinyHunters focused on data theft and extortion. The group commonly uses social engineering to gain access to victims’ accounts on third-party services, but also exploits flaws in software. Victims of the ShinyHunters group include Kodak , along with American healthcare and pharmaceuticals distributor McKesson . Shortly afte

13. update from malware.news

    ShinyHunters Extorted Boeing Spin-off Prior to Arrests

    malware.news · 6d ago · October 7th, 2026

    A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle “ Rey ,” was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing , which manufactures the fleet of planes used by the employer of Rey’s father — Royal Jordanian Airlines . The logo for Jeppesen ForeFlight, a business unit divested last year by the aerospace firm Boeing. KrebsOnSecurity identified Rey as Khader in a November 2025 profile , in which the young man admitted working with multiple ransomware groups. Rey was featured again in a September 28 exclusive about the Dutch police arresting 24-year-old convicted cybercriminal Pepijn van der Stap on suspicion of aiding in data thefts and extortions by ShinyHunters. The story noted that immediately fo

14. update from bleepingcomputer.com

    FBI arrests another suspected ShinyHunters hacker after agency breach

    bleepingcomputer.com · 4d ago · October 9th, 2026

    "Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent http://FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor," Patel said on X . "This is the latest arrest this FBI has made in a matter of days involving this network, as we work non-stop to dismantle the group, pursue new leads and evidence, and act quickly." While Patel did not identify the suspect or disclose where the arrest occurred, The New York Times reports that the suspect is a Canadian citizen who was arrested in Pennsylvania and is considered a primary co-conspirator in the intrusion. Authorities have not publicly disclosed the suspect's name or the specific charges against him. ShinyHunters told BleepingComputer in September that it accessed FBI systems by exploiting an alleged Oracle PeopleSoft zero-day vulnerability before moving laterally into FBI-managed AWS GovCloud infrastructure. The threat actors claimed they stole between 2TB and 3TB of data, including information on current and former FBI employees, job applicants, medical and psychiatric records, and intern

15. update from malware.news

    FBI arrests another ShinyHunters suspect after massive breach of employee data

    malware.news · 4d ago · October 9th, 2026

    The statement did not name the suspect, specify charges or describe the person’s alleged role in the intrusion. The announcement follows https://www.reuters.com/world/middle-east/key-shinyhunters-hacker-detained-jordan-is-cooperating-sources-say-2026-10-

16. update from securityweek.com

    Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe

    securityweek.com · 1d ago · October 12th, 2026

    A Canada-based cybersecurity expert was arrested last week in the United States on suspicion of being involved in ShinyHunters attacks, including the recent hacking of FBI systems. Dubrovsky was reportedly arrested by the FBI after traveling to Philadelphia for a conference. The hackers said they carried out the attack in response to a report the FBI published earlie