Clop ransomware leak site defaced by ShinyHunters, BleepingComputer confirms
BleepingComputer (Lawrence Abrams; 19 September 2026) reports that the ShinyHunters extortion group breached the Clop (Cl0p) ransomware operation's data-leak Tor site.
BleepingComputer says it confirmed that a text file taunting Clop and linking to ShinyHunters' leak site had been uploaded to Clop's server and could be downloaded from Clop's Tor site, and that several hours later the site had been replaced with ASCII art of Umbreon, the Pokémon ShinyHunters uses as its logo, with a link to ShinyHunters' Tor site.
BleepingComputer says it has not independently verified ShinyHunters' further claims about how it got in and what it took. Crime-on-crime / threat-actor infrastructure compromise — not a victim organisation's breach notice. (source: BleepingComputer)
Correction (26 Oct 2026): removed ShinyHunters' own unverified claims (the access method, server access and stolen source code, logs and onion keys) from the title and summary; only what BleepingComputer confirmed remains. (source: BleepingComputer)
- Product
- Clop/Cl0p ransomware data-leak site (Grav CMS on Tor); ShinyHunters TA infrastructure dispute
- Versions
- n/a (threat-actor infrastructure)
- Exploited in Australia?
- unknown
- Patch to
- Defenders: no Clop-site patch action. Continue Clop/Oracle EBS extortion monitoring separately; treat TA DLS claims and stolen onion keys as threat-intel colour only.