Skip to navigation

Threat reportData BreachTL-2026-2584

ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour Extortion

mediumACTIVE

Extortion group ShinyHunters breached and defaced Clop ransomware's Tor-based data leak site by exploiting an unauthenticated file upload vulnerability in the Grav CMS software running the site, claiming theft of source code, plugins, server logs, and the site's private Tor keys.

Key facts for ShinyHunters Clop ransomware breach

IdentifiersTL-2026-2584, CVE-2025-61882, CVE-2021-21425
Also known asClop leak site hack, ShinyHunters vs Clop feud
SeverityMEDIUM
Exploitation statusExploited in the wild; Listed in CISA KEV: CVE-2025-61882 (added )
EPSSCVE-2025-61882: 99.7% (99.9th percentile); CVE-2021-21425: 80.6% (99.6th percentile)
Affected productsTrilby Media / GetGrav Grav CMS; Oracle E-Business Suite (Concurrent Processing / BI Publisher Integration)
Weaknesses (CWE)CWE-287, CWE-434
AttributionShinyHunters (high confidence)
MalwareClop, scattered lapsus$ hunters
ToolsGrav CMS, Tor - S0183, Umbreon
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1059 Command and Scripting Interpreter, T1059.004 Unix Shell, T1059.006 Python, T1071.001 Web Protocols, T1190 Exploit Public-Facing Application, T1213 Data from Information Repositories, T1491.002 External Defacement, T1505.003 Server Software Component, T1518 Software Discovery, T1552.001 Unsecured Credentials and 6 more in the attack flow
MotivationFINANCIAL
Target sectorsdark-web-criminal-infrastructure
Target regionsGlobal
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage for ShinyHunters Clop ransomware breach

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2584 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Reverse Shell Execution and Sensitive Data Collection Post Grav CMS Compromise

Detects bash/python reverse-shell invocation (/dev/tcp redirection), execution of named exp.py/server.py exploit scripts, composer.json script-poisoning abuse, and archiving or reading of /var/log or Tor hidden-service private key material (hs_ed25519_secret_key) — the post-exploitation collection, execution, and private-key-theft behavior ShinyHunters claims it performed after breaching Clop's Grav CMS host.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1059.004, T1059.006, T1005, T1213, T1552.004
  • Data sources: auditd, sysmon for linux, EDR process telemetry, linux_secure
  • Severity: critical
  • Confidence: high

Splunk SPL

index=linux OR index=edr sourcetype IN ("linux_secure","auditd","sysmon_linux")
(process="*bash*" AND process="*-i*" AND process="*/dev/tcp/*")
OR (process="*python*" AND (process="*exp.py*" OR process="*server.py*"))
OR (process="*composer*" AND process="*composer.json*")
OR (process="*tar*" AND process="*/var/log*")
OR (process="*cat*" AND (process="*hs_ed25519_secret_key*" OR process="*private_key*"))
| eval technique=case(
    match(process,"/dev/tcp/"),"T1059.004 Reverse Shell",
    match(process,"exp\.py|server\.py"),"T1059.006 Python Exploit",
    match(process,"composer\.json"),"T1005 Local Collection via composer.json",
    match(process,"/var/log"),"T1213 Data from Information Repositories",
    match(process,"hs_ed25519_secret_key|private_key"),"T1552.004 Private Key Theft")
| stats count min(_time) as first_seen values(process) as commands by host, user, technique

Microsoft KQL

DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where (FileName in~ ("bash","sh") and ProcessCommandLine has "/dev/tcp/" and ProcessCommandLine has "-i")
    or (FileName =~ "python3" and (ProcessCommandLine has "exp.py" or ProcessCommandLine has "server.py"))
    or (ProcessCommandLine has "composer.json" and FileName =~ "composer")
    or (FileName =~ "tar" and ProcessCommandLine has "/var/log")
    or (ProcessCommandLine has_any ("hs_ed25519_secret_key", "private_key") and FileName in~ ("cat","cp","scp"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| summarize EventCount = count(), Commands = make_set(ProcessCommandLine) by DeviceName, AccountName

Sigma

title: Linux Reverse Shell and Post-Exploitation Collection Following Web Upload Compromise
id: 4c1a8e2f-9b3d-4a5c-8e1f-2b6d7c9e0a11
status: experimental
description: Detects bash/python reverse-shell invocation, execution of exp.py/server.py exploit scripts, composer.json abuse, and access/archiving of /var/log or Tor onion-service private key material, consistent with post-exploitation activity following an unauthenticated file-upload compromise of a web CMS.
references:
    - https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
    - attack.execution
    - attack.collection
    - attack.credential-access
    - attack.t1059.004
    - attack.t1059.006
    - attack.t1005
    - attack.t1213
    - attack.t1552.004
    - attack.tool.custom_python_exploit
logsource:
    category: process_creation
    product: linux
detection:
    selection_revshell:
        Image|endswith:
            - '/bash'
            - '/sh'
        CommandLine|contains|all:
            - '-i'
            - '/dev/tcp/'
    selection_pyexploit:
        Image|endswith: '/python3'
        CommandLine|contains:
            - 'exp.py'
            - 'server.py'
    selection_keytheft:
        CommandLine|contains:
            - 'hs_ed25519_secret_key'
            - 'private_key'
    selection_logtheft:
        Image|endswith: '/tar'
        CommandLine|contains: '/var/log'
    condition: 1 of selection_*
falsepositives:
    - Authorized red-team or penetration-test activity
    - Legitimate Tor relay administration/backup of hidden-service keys
level: critical

Known false positives:

  • Authorized red-team/penetration-test activity
  • Legitimate sysadmin backup of Tor hidden-service keys or /var/log archival for log rotation

Tuning notes: Exclude scheduled log-rotation jobs (logrotate) and known backup service accounts from the tar/var-log branch; require the /dev/tcp branch to alert regardless of user since legitimate bash rarely uses this redirection pattern.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Grav CMS Unauthenticated Arbitrary File Upload / Path Traversal Exploitation · unlock with TL Creds
  • Reverse Shell Execution and Sensitive Data Collection Post Grav CMS Compromise · unlock with TL Creds
  • C2 Callback to Known CVE-2025-61882 Exploit Toolkit Infrastructure and Web-Service Exfiltration · unlock with TL Creds
  • Grav CMS Unauthenticated Arbitrary File Upload / Path Traversal Exploitation · unlock with TL Creds
  • Reverse Shell Execution and Sensitive Data Collection Post Grav CMS Compromise · unlock with TL Creds
  • C2 Callback to Known CVE-2025-61882 Exploit Toolkit Infrastructure and Web-Service Exfiltration · unlock with TL Creds
  • Grav CMS Unauthenticated Arbitrary File Upload / Path Traversal Exploitation · unlock with TL Creds
  • C2 Callback to Known CVE-2025-61882 Exploit Toolkit Infrastructure and Web-Service Exfiltration · unlock with TL Creds

Indicators of compromise for ShinyHunters Clop ransomware breach

As of 2026-09-19, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-2584.

Sample indicators (2 of 19)

  • IP address: 200.107.207[.]26
  • IP address: 185.181.60[.]11

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

19 indicators of compromise · unlock with TL Creds. Compare plans

How ShinyHunters Clop ransomware breach works

The attack is retaliation over a dispute regarding the CVE-2025-61882 Oracle E-Business Suite zero-day, which ShinyHunters claims Clop obtained without authorization, and comes with a 72-hour extortion ultimatum against Clop.

On the night of Friday, September 18 into September 19, 2026, the extortion collective ShinyHunters compromised the Tor hidden-service infrastructure hosting Clop ransomware's "Cl0p^_- Leaks" data leak site. ShinyHunters told BleepingComputer it exploited an unauthenticated arbitrary file upload vulnerability in Grav CMS, the flat-file PHP content management system Clop uses to run its leak-site blog, to upload a small text file to the server. From that foothold the group claims it obtained full access to the underlying host, exfiltrating the site's source code, installed Grav CMS plugins, complete contents of /var/log (potentially including authentication records and visitor IP addresses), and the private cryptographic keys for Clop's Tor onion service. BleepingComputer independently confirmed the resulting defacement -- the leak site was replaced with ASCII art of Umbreon, the Pokemon character ShinyHunters uses as its branding, bearing the taunt "rooting your systems since '19 ;)" and a link to ShinyHunters' own leak site -- but could not independently verify the full extent of the data-theft and Tor-key-theft claims. The defacement also carried the message "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time," referencing an earlier incident in which ShinyHunters says a Clop representative threatened the group in Russian. ShinyHunters says it intends to publish extortion instructions on its own leak site giving Clop 72 hours to make contact, or have the stolen material released. The feud traces back to CVE-2025-61882, a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in the BI Publisher Integration component of Oracle E-Business Suite's Concurrent Processing module (versions 12.2.3-12.2.14), which Clop mass-exploited from around August 2025 to steal data from close to 100 organizations before Oracle shipped an emergency patch on October 4-5, 2025 and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 6, 2025. ShinyHunters -- part of the loosely federated "Scattered Lapsus$ Hunters" (also styled Trinity of Chaos), an alliance with Scattered Spider and Lapsus$ formed in 2025 -- alleges it originally possessed the Oracle EBS exploit and that Clop obtained it without authorization; exploit archives tied to the Oracle EBS campaign have circulated bearing filenames directly referencing this dispute (e.g. oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip) and containing Python exploitation scripts (exp.py, server.py) that drop a reverse shell to attacker-controlled infrastructure. Independent of this incident, Grav CMS has a documented history of unauthenticated-adjacent file handling flaws, most notably CVE-2024-27921 (an arbitrary file upload via path-traversal in the upload/backup handling, patched in Grav 1.7.45) and the earlier CVE-2021-21425 unauthenticated RCE in the admin panel; BleepingComputer's reporting did not confirm which specific CVE, if any, corresponds to the flaw ShinyHunters says it used against Clop's deployment.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1059.006 Python

Command and Control

T1071.001 Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1491.002 External Defacement; T1657 Financial Theft

Persistence

T1505.003 Server Software Component

Discovery

T1518 Software Discovery

Credential Access

T1552.001 Unsecured Credentials; T1552.004 Private Keys

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.004 Server; T1588.005 Exploits

Reconnaissance

T1595.002 Active Scanning

Remediation for ShinyHunters Clop ransomware breach

Patches

  • Grav CMS 1.7.45 (patches CVE-2024-27921 arbitrary file upload / path traversal)
  • Oracle October 2025 emergency Security Alert patch for CVE-2025-61882

Immediate actions

  • Rotate or revoke any Tor onion-service private keys suspected of exposure and re-provision the hidden service under a new address
  • Patch or upgrade Grav CMS to the latest release (>=1.7.45) to close the known unauthenticated arbitrary file upload / path-traversal class of flaw (CVE-2024-27921) and disable unused upload endpoints
  • Apply Oracle's October 2025 emergency Security Alert patch for CVE-2025-61882 to any exposed E-Business Suite Concurrent Processing / BI Publisher Integration components
  • Review web server and application logs (including /var/log) for unexpected file writes outside intended upload directories and for connections to the identified reverse-shell IPs

Workarounds

  • Disable or restrict unauthenticated file upload endpoints on Grav CMS deployments where immediate patching is not possible
  • Apply Oracle's documented interim mitigations / CISA BOD 22-01 guidance for E-Business Suite where patching is delayed

Longer-term hardening

  • Harden and network-isolate any CMS or administrative software used to operate criminal or legitimate dark-web infrastructure, including authentication on upload endpoints
  • Adopt a vulnerability management process for third-party CMS components (Grav) rather than running unpatched long-lived installs
  • Monitor threat-actor Telegram channels and rival leak sites for early warning of extortion, data-theft, or defacement claims against infrastructure of interest
  • For defenders tracking Oracle EBS exposure, maintain detection for the documented CVE-2025-61882 exploitation chain independent of who currently possesses the exploit

Affected and fixed versions

  • Trilby Media / GetGrav — Grav CMS
    Vulnerable versions: versions predating the 1.7.45 arbitrary file upload / path traversal fix (CVE-2024-27921), specific version run by Clop unconfirmed
    Fixed in: 1.7.45+
  • Oracle — E-Business Suite (Concurrent Processing / BI Publisher Integration)
    Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
    Fixed in: patched per Oracle's October 4-5, 2025 emergency Security Alert

Timeline of ShinyHunters Clop ransomware breach

Last updated · revalidated 1× · latest source

  • locked-ioc-17 ransomware first identified in the wild, later adopting the taunt 'rooting your systems since 19' referenced in this incident's defacement.
  • Clop launches its Tor-hosted 'Cl0p^_- Leaks' data leak site, the same infrastructure later compromised by locked-ioc-8.
  • locked-ioc-8 previously claimed a HackForums defacement using the same Umbreon-themed ASCII art branding later reused against Clop.
  • Clop begins mass-exploiting locked-ioc-14 E-Business Suite servers using CVE-2025-61882 and related flaws, ultimately extorting close to 100 organizations.
  • locked-ioc-14 ships an emergency Security Alert patch for CVE-2025-61882 after in-the-wild exploitation by Clop is confirmed.
  • CISA adds CVE-2025-61882 to its Known Exploited Vulnerabilities catalog with a ransomware-use flag.
  • Dispute emerges between locked-ioc-8/affiliated actors and Clop over credit and methodology for the locked-ioc-14 E-Business Suite campaign; locked-ioc-8 alleges a Clop representative issued threats during the dispute.
  • A locked-ioc-2 Telegram channel administrator using the alias 'locked-ioc-18' is publicly identified as a 15-year-old from Jordan, tying locked-ioc-8 more directly to the SLSH/Trinity of Chaos alliance later referenced in this incident.
  • locked-ioc-8 exploits an unauthenticated file upload vulnerability in the locked-ioc-12 software running Clop's Tor leak site to gain a foothold on the server.
  • locked-ioc-8 announces plans to publish extortion instructions on its own leak site, giving Clop a 72-hour window to make contact or have the stolen data released.
  • locked-ioc-8 claims to BleepingComputer that it obtained full server access and exfiltrated source code, locked-ioc-12 plugins, the full contents of locked-ioc-11, and Clop's private Tor onion-service keys; the extent of these claims remains independently unverified.
  • Clop's leak site is defaced with Umbreon-themed ASCII art, the message 'rooting your systems since 19 ;)', and a link to locked-ioc-8' own leak site; BleepingComputer independently confirms the defacement.

Update history

Sources cited for ShinyHunters Clop ransomware breach

More from ShinyHunters

Other reports on CVE-2025-61882

Previous and next in data breach

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats