Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Clop (aka Cl0p) hit by network compromise linked to ShinyHunters

Incident
First reported
Last updated
Happening score
H score 77
2 unique sources, 2 articles

Summary

Hide ▲

ShinyHunters breached and defaced Clop’s Tor-based data leak site on 18 September, replacing it with its own message and link after an alleged Grav CMS upload flaw. The group claimed full access to the server, said it stole server data, source code, /var/log files, and onion-service private keys, and threatened to extort Clop. The compromise is part of a 2025 feud between the groups tied to competing claims over Oracle E-Business Suite vulnerabilities, including CVE-2025-61882. The event disrupts Clop’s leak infrastructure and could expose operator activity and authentication records if the theft claims are accurate.

Related Happenings

Clop leak site hit by network compromise linked to ShinyHunters

Incident
H score31 First: 25.09.2026 23:57 Last: 25.09.2026 23:57 Sources 1

About this happening: The Clop leak site was breached and defaced by ShinyHunters, forcing the operation to shift to a new Tor address. The compromise was tied to Grav CMS 1.7.43 an...

Open Happening

IT services firm in South Asia hit by ransomware attack

Incident
H score31 First: 16.07.2026 13:00 Last: 16.07.2026 13:00 Sources 1

About this happening: The IT services firm in South Asia suffered a Spirals ransomware intrusion that moved from initial access to data theft and encryption in less than 24 hours, putti...

Open Happening

Oracle PeopleSoft PeopleTools zero-day RCE (CVE-2026-35273)

Vulnerability
H score58 First: 11.06.2026 22:39 Last: 11.06.2026 22:39 Sources 1

About this happening: Oracle PeopleSoft PeopleTools CVE-2026-35273 is a zero-day RCE affecting PeopleSoft Enterprise PeopleTools 8.61 and 8.62, and Oracle issued emergency mitigations w...

Latest development: 29.06.2026 23:40

Nissan says it suffered a data breach affecting current and former employees after attackers exploited an Oracle PeopleSoft zero-day associated with CVE-2026-35273. Oracle informed Nissan that personnel records of hundreds of companies may have been obtained and that Nissan was specifically targeted, with potentially exposed data including contact details, banking information, Social Security numbers, Social Insurance Numbers, National Identification Numbers, financial and tax information, and dependent and beneficiary data for employees in the United States, Canada, Mexico, and Brazil.

Open Happening

ShinyHunters Oracle PeopleSoft data theft and extortion campaign

Campaign
H score60 First: 10.06.2026 21:31 Last: 10.06.2026 21:31 Sources 1

About this happening: ShinyHunters/UNC6240 is running a renewed Oracle PeopleSoft campaign centered on CVE-2026-35273, using /%50SEMHUB/ requests to bypass WAF rules on the PSEMHU...

Latest development: 26.09.2026 14:46

Google says UNC6240 is running a renewed wave of mass exploitation against Oracle PeopleSoft CVE-2026-35273, bypassing WAF rules on the vulnerable PSEMHUB endpoint with /%50SEMHUB/ requests, dropping JSP web shells in PSEMHUB.war, and staging tools including Ple64.exe, SIDEEYE, Neo-reGeorg, and MeshAgent against entities across higher education, technology, IT services, healthcare, agriculture, transportation, and government.

Open Happening

Charter Communications hit by network compromise linked to ShinyHunters

Incident
H score70 First: 26.05.2026 22:46 Last: 26.05.2026 22:46 Sources 1

About this happening: Charter Communications confirmed a data breach tied to ShinyHunters extortion, with the company saying it is alerting authorities and that no sensitive personal...

Latest development: 29.05.2026 11:29

Have I Been Pwned analyzed leaked Charter Communications data and confirmed that the incident affected 4.9 million accounts, with exposed records including names, email addresses, job titles, phone numbers, and physical addresses. The published data also included a subset of about 85,000 records from an internal employee directory.

Open Happening

Timeline

  1. 19.09.2026 16:48 1 articles · 14d ago

    ShinyHunters defaces Clop's Tor leak site through a Grav CMS upload flaw

    Exploitation Observed

    ShinyHunters is reported to have used an alleged unauthenticated file upload flaw in Grav CMS to place a text file on Clop's Tor-based leak site, then replace the page with Umbreon ASCII art and a link to its own leak site. BleepingComputer confirmed the upload and the defacement on the affected Clop infrastructure.

    Show sources
    Open in new tab
  2. 19.09.2026 16:48 3 articles · 14d ago

    ShinyHunters claims server data and onion keys after the Clop breach

    Victim Impact Update

    ShinyHunters said it had "full access" to the server and was reviewing allegedly stolen data while planning to extort Clop within 72 hours. The group claimed to have taken source code, Grav CMS plugins, system logs, /var/log files, and the private keys for Clop's onion service, but those theft claims were not independently verified.

    Show sources
    Open in new tab