ShinyHunters Rooted Clop's Leak Site Through Grav CMS, and Now Wants to Extort the Extortionists

The crew behind one of the most aggressive mass exploitation operations of the last two years spent Friday night watching its own extortion infrastructure get taken apart. On September 19, 2026, ShinyHunters compromised the Clop ransomware operation's dark web data leak site, the page Clop uses to name victims and squeeze them into paying. The way in was not a zero day in a hardened appliance. It was an unauthenticated file upload vulnerability in Grav CMS, the flat file content management system Clop was running its own public site on.

A leak site with a CMS problem

ShinyHunters started small. The first sign of trouble was a single text file dropped onto Clop's site reading "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time", along with a link back to ShinyHunters' own leak site. Hours later the whole site was gone, replaced with ASCII art of Umbreon, the Pokemon ShinyHunters uses as its logo, above the line "rooting your systems since '19 ;)". BleepingComputer confirmed the defacement. That two stage pattern, prove write access first and come back later for full control, is the classic shape of an unauthenticated upload bug that leads to code execution. It is also the shape you should expect to see in your own web logs.

The grudge started with Oracle E-Business Suite

This was not a random hit. The conflict traces to Clop's October 2025 campaign against Oracle E-Business Suite, which exploited CVE-2025-61882. ShinyHunters claims that exploit was originally theirs and that Clop took it, and says Clop representatives later followed up with violent threats. The defacement message answers that directly. What is on display is a criminal ecosystem doing what it does under pressure, turning on itself, except the property being fought over here is an exploit chain that hit real enterprise ERP deployments and real victim organizations.

What ShinyHunters says it walked away with

• The leak site source code along with Clop's Grav CMS plugins
• System logs pulled from /var/log, the files most likely to hold operator IP addresses, tooling paths, and access patterns
• The private cryptographic keys for Clop's Tor onion service, the credential that lets whoever holds it stand up a site at Clop's exact onion address

The group gave Clop 72 hours to make contact and said flatly that it is going to extort them. If the onion key claim holds, that is the item that matters. Whoever controls those keys controls the address victims are pointed to, which means a Clop victim negotiating at that onion address can no longer be sure who is on the other end. The logs matter for a different reason: they are exactly what law enforcement wants, and unlike a password, an operator cannot revoke them after the fact.

The RedEye take

The funny part of this story is the smallest part. A gang that built its entire brand on breaking file transfer products and ERP stacks was running its own public infrastructure on a content management system with an unauthenticated upload flaw, and had not fixed it. That is not irony, it is a usable data point about the people on the other side of your incidents. They are operators working under time pressure, and they take the same shortcuts and leave the same forgotten public endpoints your own teams do. Stop modeling ransomware crews as uniformly disciplined, because that assumption inflates their capability and deflates the value of basic hygiene.

The second takeaway is harder. If ShinyHunters is right that Clop lifted the Oracle E-Business Suite chain, then the capability behind CVE-2025-61882 sat in at least two sets of hands before most enterprises had it patched. Exploits move between crews the way tools move between contractors, which makes attribution by exploit a weak signal and makes any defense built on one group's known tooling brittle by design. The third takeaway: the 72 hour countdown is theater. Clop is not going to pay. But if those logs are real, they have a long shelf life, and the people most interested in them do not negotiate over Tor.

What defenders should learn

• Inventory your microsites and marketing CMS installs with the same rigor as production. Clop lost root through a flat file CMS serving a public page, not through a core application. Most enterprises run several of those and cannot name an owner for any of them.
• Treat unauthenticated file upload as a pre-auth code execution class, not a content handling bug. The early stage in this intrusion was a harmless looking text file appearing in a writable web directory, and that is the alert you realistically get before the defacement.
• Rotate service identity keys on a schedule rather than after an incident. Clop's onion private key had no rotation path once it was out the door. Your equivalents are TLS private keys, SSH host keys, code signing keys, and API signing secrets. Pick one today and ask how fast you could actually replace it.
• Assume /var/log is an attacker objective and not only your evidence. Ship logs off host in real time so the surviving copy is the one you control, and so the copy an intruder reads on the box is not a complete map of your operations.
• Do not anchor detections to a single actor's toolkit. The exploit at the center of this feud was contested property between two crews. Behavior based detection survives that kind of hand off. Named actor attribution does not.

The check worth running this week

Grav is a flat file CMS, which means content, uploads, and executable PHP frequently live under the same writable tree. That is what turns an upload primitive into a shell. Find your Grav installs, confirm the core and plugin versions, and look for PHP files that appeared recently in directories that are supposed to hold only content and images.

find /var/www /srv /opt -maxdepth 5 -type f -path '*/bin/gpm' 2>/dev/null
bin/gpm version
bin/gpm index -i
find user/pages user/data user/images -type f -name '*.php' -newermt '2026-09-01' 2>/dev/null

find / -xdev -maxdepth 6 -type f -path '*/system/defines.php' 2>/dev/null

bin/gpm version && bin/gpm index -i

find user/pages user/data user/images user/accounts -type f -name '*.php' -mtime -14 -printf '%T+ %s %p\n' 2>/dev/null | sort

bin/gpm selfupgrade && bin/gpm update

printf '<FilesMatch "\\.(php|phar|phtml)$">\n  Require all denied\n</FilesMatch>\n' > user/images/.htaccess

mkdir -p /var/tmp/quarantine && mv -n user/images/suspect.php /var/tmp/quarantine/ && grep -F 'suspect.php' /var/log/nginx/access.log