ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour Extortion

ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via (TL-2026-2584), also tracked as Clop leak site hack, is a medium-severity data breach, first published 2026-09-19. It is attributed to ShinyHunters with high confidence, affects Trilby Media / GetGrav Grav CMS, references 1 CVE (CVE-2025-61882), maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1059), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-2584

Threat ID
TL-2026-2584
Also known as
Clop leak site hack, ShinyHunters vs Clop feud
Severity
MEDIUM
Status
ACTIVE
Category
DATA_BREACH
First published
2026-09-19
Last reviewed
2026-09-19
Attribution
ShinyHunters
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
dark-web-criminal-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
19
Updates
2026-09-19 · revalidated 1× · latest source

Malware and tooling in ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via

Malware and tooling: Clop, scattered lapsus$ hunters, Grav CMS, Tor - S0183, Umbreon

Extortion group ShinyHunters breached and defaced Clop ransomware's Tor-based data leak site by exploiting an unauthenticated file upload vulnerability in the Grav CMS software running the site, claiming theft of source code, plugins, server logs, and the site's private Tor keys. The attack is retaliation over a dispute regarding the CVE-2025-61882 Oracle E-Business Suite zero-day, which ShinyHunters claims Clop obtained without authorization, and comes with a 72-hour extortion ultimatum against Clop.

How ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via works

On the night of Friday, September 18 into September 19, 2026, the extortion collective ShinyHunters compromised the Tor hidden-service infrastructure hosting Clop ransomware's "Cl0p^_- Leaks" data leak site. ShinyHunters told BleepingComputer it exploited an unauthenticated arbitrary file upload vulnerability in Grav CMS, the flat-file PHP content management system Clop uses to run its leak-site blog, to upload a small text file to the server. From that foothold the group claims it obtained full access to the underlying host, exfiltrating the site's source code, installed Grav CMS plugins, complete contents of /var/log (potentially including authentication records and visitor IP addresses), and the private cryptographic keys for Clop's Tor onion service. BleepingComputer independently confirmed the resulting defacement -- the leak site was replaced with ASCII art of Umbreon, the Pokemon character ShinyHunters uses as its branding, bearing the taunt "rooting your systems since '19 ;)" and a link to ShinyHunters' own leak site -- but could not independently verify the full extent of the data-theft and Tor-key-theft claims. The defacement also carried the message "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time," referencing an earlier incident in which ShinyHunters says a Clop representative threatened the group in Russian. ShinyHunters says it intends to publish extortion instructions on its own leak site giving Clop 72 hours to make contact, or have the stolen material released. The feud traces back to CVE-2025-61882, a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in the BI Publisher Integration component of Oracle E-Business Suite's Concurrent Processing module (versions 12.2.3-12.2.14), which Clop mass-exploited from around August 2025 to steal data from close to 100 organizations before Oracle shipped an emergency patch on October 4-5, 2025 and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 6, 2025. ShinyHunters -- part of the loosely federated "Scattered Lapsus$ Hunters" (also styled Trinity of Chaos), an alliance with Scattered Spider and Lapsus$ formed in 2025 -- alleges it originally possessed the Oracle EBS exploit and that Clop obtained it without authorization; exploit archives tied to the Oracle EBS campaign have circulated bearing filenames directly referencing this dispute (e.g. oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip) and containing Python exploitation scripts (exp.py, server.py) that drop a reverse shell to attacker-controlled infrastructure. Independent of this incident, Grav CMS has a documented history of unauthenticated-adjacent file handling flaws, most notably CVE-2024-27921 (an arbitrary file upload via path-traversal in the upload/backup handling, patched in Grav 1.7.45) and the earlier CVE-2021-21425 unauthenticated RCE in the admin panel; BleepingComputer's reporting did not confirm which specific CVE, if any, corresponds to the flaw ShinyHunters says it used against Clop's deployment.

MITRE ATT&CK techniques used in TL-2026-2584

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1059.006 Python

Command and Control

T1071.001 Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.002 External Defacement; T1657 Financial Theft

Persistence

T1505.003 Server Software Component

Discovery

T1518 Software Discovery

Credential Access

T1552.001 Unsecured Credentials; T1552.004 Private Keys

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.004 Server; T1588.005 Exploits

Reconnaissance

T1595.002 Active Scanning

Affected products and versions in ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via

  • Trilby Media / GetGrav — Grav CMS
    Vulnerable versions: versions predating the 1.7.45 arbitrary file upload / path traversal fix (CVE-2024-27921), specific version run by Clop unconfirmed
    Fixed in: 1.7.45+
  • Oracle — E-Business Suite (Concurrent Processing / BI Publisher Integration)
    Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
    Fixed in: patched per Oracle's October 4-5, 2025 emergency Security Alert

Remediation for ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via

Patches

  • Grav CMS 1.7.45 (patches CVE-2024-27921 arbitrary file upload / path traversal)
  • Oracle October 2025 emergency Security Alert patch for CVE-2025-61882

Immediate actions

  • Rotate or revoke any Tor onion-service private keys suspected of exposure and re-provision the hidden service under a new address
  • Patch or upgrade Grav CMS to the latest release (>=1.7.45) to close the known unauthenticated arbitrary file upload / path-traversal class of flaw (CVE-2024-27921) and disable unused upload endpoints
  • Apply Oracle's October 2025 emergency Security Alert patch for CVE-2025-61882 to any exposed E-Business Suite Concurrent Processing / BI Publisher Integration components
  • Review web server and application logs (including /var/log) for unexpected file writes outside intended upload directories and for connections to the identified reverse-shell IPs

Workarounds

  • Disable or restrict unauthenticated file upload endpoints on Grav CMS deployments where immediate patching is not possible
  • Apply Oracle's documented interim mitigations / CISA BOD 22-01 guidance for E-Business Suite where patching is delayed

Longer-term hardening

  • Harden and network-isolate any CMS or administrative software used to operate criminal or legitimate dark-web infrastructure, including authentication on upload endpoints
  • Adopt a vulnerability management process for third-party CMS components (Grav) rather than running unpatched long-lived installs
  • Monitor threat-actor Telegram channels and rival leak sites for early warning of extortion, data-theft, or defacement claims against infrastructure of interest
  • For defenders tracking Oracle EBS exposure, maintain detection for the documented CVE-2025-61882 exploitation chain independent of who currently possesses the exploit

CVEs associated with ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via

CVE-2025-61882

Weaknesses (CWE) in ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via

CWE-287, CWE-434

Timeline of ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via

  • Cl0p ransomware first identified in the wild, later adopting the taunt 'rooting your systems since 19' referenced in this incident's defacement.
  • Clop launches its Tor-hosted 'Cl0p^_- Leaks' data leak site, the same infrastructure later compromised by ShinyHunters.
  • ShinyHunters previously claimed a HackForums defacement using the same Umbreon-themed ASCII art branding later reused against Clop.
  • Clop begins mass-exploiting Oracle E-Business Suite servers using CVE-2025-61882 and related flaws, ultimately extorting close to 100 organizations.
  • Oracle ships an emergency Security Alert patch for CVE-2025-61882 after in-the-wild exploitation by Clop is confirmed.
  • CISA adds CVE-2025-61882 to its Known Exploited Vulnerabilities catalog with a ransomware-use flag.
  • Dispute emerges between ShinyHunters/affiliated actors and Clop over credit and methodology for the Oracle E-Business Suite campaign; ShinyHunters alleges a Clop representative issued threats during the dispute.
  • A Scattered Lapsus$ Hunters Telegram channel administrator using the alias 'Rey' is publicly identified as a 15-year-old from Jordan, tying ShinyHunters more directly to the SLSH/Trinity of Chaos alliance later referenced in this incident.
  • ShinyHunters exploits an unauthenticated file upload vulnerability in the Grav CMS software running Clop's Tor leak site to gain a foothold on the server.
  • ShinyHunters announces plans to publish extortion instructions on its own leak site, giving Clop a 72-hour window to make contact or have the stolen data released.
  • ShinyHunters claims to BleepingComputer that it obtained full server access and exfiltrated source code, Grav CMS plugins, the full contents of /var/log, and Clop's private Tor onion-service keys; the extent of these claims remains independently unverified.
  • Clop's leak site is defaced with Umbreon-themed ASCII art, the message 'rooting your systems since 19 ;)', and a link to ShinyHunters' own leak site; BleepingComputer independently confirms the defacement.

Update history for TL-2026-2584

Sources cited for ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via

More in data breach

Detection coverage for TL-2026-2584

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2584 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats