# ShinyHunters Hacks Clop Ransomware Gang's Tor Leak Site via Grav CMS File Upload Flaw, Threatens 72-Hour Extortion

> Extortion group ShinyHunters breached and defaced Clop ransomware's Tor-based data leak site by exploiting an unauthenticated file upload vulnerability in the Grav CMS software running the site, claiming theft of source code, plugins, server logs, and the site's private Tor keys. The attack is retaliation over a dispute regarding the CVE-2025-61882 Oracle E-Business Suite zero-day, which ShinyHunters claims Clop obtained without authorization, and comes with a 72-hour extortion ultimatum against Clop.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-19T18:24:59.644Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2584
- **ID:** TL-2026-2584
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-61882, CVE-2021-21425

## Description

On the night of Friday, September 18 into September 19, 2026, the extortion collective ShinyHunters compromised the Tor hidden-service infrastructure hosting Clop ransomware's "Cl0p^_- Leaks" data leak site. ShinyHunters told BleepingComputer it exploited an unauthenticated arbitrary file upload vulnerability in Grav CMS, the flat-file PHP content management system Clop uses to run its leak-site blog, to upload a small text file to the server. From that foothold the group claims it obtained full access to the underlying host, exfiltrating the site's source code, installed Grav CMS plugins, complete contents of /var/log (potentially including authentication records and visitor IP addresses), and the private cryptographic keys for Clop's Tor onion service. BleepingComputer independently confirmed the resulting defacement -- the leak site was replaced with ASCII art of Umbreon, the Pokemon character ShinyHunters uses as its branding, bearing the taunt "rooting your systems since '19 ;)" and a link to ShinyHunters' own leak site -- but could not independently verify the full extent of the data-theft and Tor-key-theft claims. The defacement also carried the message "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time," referencing an earlier incident in which ShinyHunters says a Clop representative threatened the group in Russian. ShinyHunters says it intends to publish extortion instructions on its own leak site giving Clop 72 hours to make contact, or have the stolen material released. The feud traces back to CVE-2025-61882, a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in the BI Publisher Integration component of Oracle E-Business Suite's Concurrent Processing module (versions 12.2.3-12.2.14), which Clop mass-exploited from around August 2025 to steal data from close to 100 organizations before Oracle shipped an emergency patch on October 4-5, 2025 and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 6, 2025. ShinyHunters -- part of the loosely federated "Scattered Lapsus$ Hunters" (also styled Trinity of Chaos), an alliance with Scattered Spider and Lapsus$ formed in 2025 -- alleges it originally possessed the Oracle EBS exploit and that Clop obtained it without authorization; exploit archives tied to the Oracle EBS campaign have circulated bearing filenames directly referencing this dispute (e.g. oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip) and containing Python exploitation scripts (exp.py, server.py) that drop a reverse shell to attacker-controlled infrastructure. Independent of this incident, Grav CMS has a documented history of unauthenticated-adjacent file handling flaws, most notably CVE-2024-27921 (an arbitrary file upload via path-traversal in the upload/backup handling, patched in Grav 1.7.45) and the earlier CVE-2021-21425 unauthenticated RCE in the admin panel; BleepingComputer's reporting did not confirm which specific CVE, if any, corresponds to the flaw ShinyHunters says it used against Clop's deployment.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1552.004 Private Keys
- T1491.002 External Defacement
- T1657 Financial Theft
- T1567 Exfiltration Over Web Service
- T1059.006 Python
- T1059.004 Unix Shell
- T1588.005 Exploits
- T1583.004 Server
- T1071.001 Web Protocols
- T1595.002 Active Scanning
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component
- T1027 Obfuscated Files or Information
- T1552.001 Unsecured Credentials
- T1518 Software Discovery

## Sources

- [ShinyHunters hacks Clop leak site, threatens to extort ransomware gang](https://www.bleepingcomputer.com/news/security/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/)
- [ShinyHunters hacks Clop leak site, threatens to extort ransomware gang](https://databreaches.net/2026/09/19/shinyhunters-hacks-clop-leak-site-threatens-to-extort-ransomware-gang/)
- [Oracle patches EBS zero-day exploited in Clop data theft attacks](https://www.bleepingcomputer.com/news/security/oracle-patches-ebs-zero-day-exploited-in-clop-data-theft-attacks/)
- [CVE-2025-61882: Oracle E-Business Suite Zero-Day Exploited in Clop Extortion Campaigns](https://www.oligo.security/blog/cve-2025-61882-oracle-e-business-suite-zero-day-exploited-in-clop-extortion-campaigns)
- [Critical 0day in Oracle E-Business Suite exploited in-the-wild](https://www.rapid7.com/blog/post/etr-cve-2025-61882-critical-0day-in-oracle-e-business-suite-exploited-in-the-wild/)
- [CVE-2025-61882 FAQ: Oracle E-Business Suite Zero-Day, Cl0p, and July 2025 CPU](https://www.tenable.com/blog/cve-2025-61882-faq-oracle-e-business-suite-zero-day-cl0p-and-july-2025-cpu)
- [CISA Adds Seven Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2025/10/06/cisa-adds-seven-known-exploited-vulnerabilities-catalog)
- [CVE-2025-61882 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-61882)
- [Grav-ity of the situation: Unauthenticated Access to RCE in Grav CMS](https://tantosec.com/blog/grav/)
- [Grav CMS Unauthenticated RCE (CVE-2021-21425)](https://www.acunetix.com/vulnerabilities/web/grav-cms-unauthenticated-rce-cve-2021-21425/)
- [Trinity of Chaos: The LAPSUS$, ShinyHunters, and Scattered Spider Alliance Embarks on Global Cybercrime Spree](https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree)
- [Clop (hacker group)](https://en.wikipedia.org/wiki/Clop_(hacker_group))

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2584