ShinyHunters compromised and defaced Clop's dark web leak site, replacing content with ShinyHunters branding. The group claims to have obtained Clop's source code, server logs, and onion service private keys for extortion purposes, though these deeper access claims remain unverified.
ShinyHunters exploited a Grav CMS vulnerability to breach Clop's ransomware leak site, defacing it with Pokémon artwork and claiming to have stolen server data, source code, and private keys for Clop's Tor onion service. The attack is retaliation for threats allegedly made by Clop during an ongoing feud between the cybercrime groups, with ShinyHunters now planning to extort Clop.