A Rift in the Cyber Underground: ShinyHunters Claims Takeover of Cl0p Site

What Happened

Reuters reported an unusual public conflict between two well-known cybercriminal groups: ShinyHunters and Cl0p.

According to the report, ShinyHunters claims it exploited a vulnerability in Cl0p’s software and took control of the group’s dark web site. Cl0p’s site was inaccessible, while shared screenshots showed a message stating that the domain had been “seized by ShinyHunters.”

Cl0p did not comment to Reuters. Two experts cited by the agency said the confrontation appeared authentic, although public information remains limited.

Why This Is Unusual

Cybercriminal groups often compete for victims, access, data and reputation. It is less common for that conflict to become so public and to involve the infrastructure of another group.

In this case, the dispute appears to be connected to a vulnerability in Oracle E-Business Suite and competing claims over which group first discovered or used the weakness. According to Reuters, ShinyHunters claims Cl0p used a vulnerability that ShinyHunters found first.

This changes the focus. The story is not only “one group attacked another.” It shows how vulnerabilities, exploits, access and reputation have value in the underground cybercrime economy.

The Broader Context

Cl0p is known for data theft and extortion campaigns, including the mass exploitation of the MOVEit Transfer vulnerability in 2023. CISA and FBI described at the time how the group used a previously unknown vulnerability to target organizations using managed file transfer software.

ShinyHunters has also been linked to data theft, extortion and attacks against large organizations.

What these groups have in common is that they do not rely only on traditional ransomware. Increasingly, the model includes data theft, public leak pressure, access trading and exploitation of vulnerabilities in widely used business systems.

What This Conflict Reveals

When cybercriminal groups fight over vulnerabilities, it signals the value of exploits in the criminal ecosystem.

A critical weakness in widely used business software can become a tool for a large-scale campaign. It can be sold, used for extortion, shared between groups or become the cause of conflict between them.

For organizations, this means the time between discovery, exploitation and public discussion of a vulnerability may be very short. While businesses are still assessing risk, attackers may already be arguing over who gets to use the weakness.

The Operational Signal

The main signal is not the conflict between ShinyHunters and Cl0p itself. The important point is what sits behind it: vulnerabilities, access, infrastructure and data.

Organizations cannot control what happens between criminal groups. But they can control their own readiness:

• whether they know which critical systems they use;
• whether they track actively exploited vulnerabilities;
• whether they have a process for fast patching;
• whether they can detect data exfiltration;
• whether they have sufficient logs for investigation;
• whether they know which systems are internet-facing;
• whether suppliers and partners introduce additional risk.

For groups that rely on data extortion, a breach often does not begin with encryption. It begins with access, quiet environment review and data extraction.

What Organizations Should Check

Practical checks:

• which systems are critical for file exchange, business processes and customer data;
• whether internet-facing applications have known vulnerabilities;
• whether fixes are applied based on real risk, not only schedule;
• whether large unusual data downloads are monitored;
• whether administrator logins and permission changes are tracked;
• whether external providers with system access are controlled;
• whether logs are collected from applications, servers, accounts and networks;
• whether there is a response plan for data extortion;
• whether leadership knows how decisions are made when data leak threats appear.

The key question is not only “do we have ransomware protection.” It is “can we detect data theft before it becomes public pressure.”

DIAMATIX Comment

From the DIAMATIX perspective, this case shows why defense needs to look beyond the individual attack.

The cybercriminal ecosystem moves around access, data, vulnerabilities and reputation. When these elements have value, they become objects of trade, competition and conflict between groups.

For businesses, this means vulnerabilities are not only technical problems. They can quickly become part of a criminal chain — from initial access, to data extraction, to extortion and public pressure.

SOC (Security Operations Center) and MDR (Managed Detection and Response) processes help in exactly this area. They connect vulnerabilities, account behavior, network activity, logs, data movement and external signals to provide an earlier view of risk.

With groups such as Cl0p and ShinyHunters, speed and context are critical. An organization needs to know not only whether a vulnerability exists, but whether there are signs that someone is already using it.

Questions for CISO, IT and Leadership Teams

• Do we have a full view of internet-facing business applications?
• Which systems would be most valuable to a data extortion group?
• Can we detect unusual data extraction?
• Do we track exploited vulnerability catalogs and vendor warnings?
• Do we know which suppliers have access to critical systems?
• Do we have a communication plan for data leak threats?
• Can we prove what was accessed and when?
• Has the response process been tested for data theft, not only encryption?

The practical takeaway: when criminal groups fight over vulnerabilities, organizations should treat it as a prioritization signal. The priority is to know which systems are exposed, what is happening inside them and whether there are signs of abuse already underway.

Check whether vulnerabilities have already become business risk

DIAMATIX can help assess exposure, vulnerability management, data exfiltration monitoring and response readiness for cyber extortion campaigns.

Request an exposure and response readiness review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Reuters. Cybercrime feud erupts on dark web as notorious group claims hijack of rival’s website.
• CISA/FBI. #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability.
• Reuters. Google says ShinyHunters hackers targeting education sector via Oracle exploit.

This article summarizes publicly available information as of September 2026.