Control of Clop leak site remained unclear after apparent response to ShinyHunters

An apparent message from the Clop cyber-extortion operation, also styled Cl0p, appeared on its dark-web leak site on 21 September, after the address displayed material and demands attributed to rival group ShinyHunters. The change indicates that access to a central Clop communications channel remained contested, but it does not prove that Clop had recovered the site or that its established operators wrote the message.

Hackread, which observed the change, said the earlier ShinyHunters material had been replaced by a short message presented as coming from Clop and asking the rival group to make contact. The outlet cautioned that the new content did not establish full recovery of the underlying infrastructure.

The apparent response was the latest in a series of different site states observed between 19 and 21 September. Those changes provide evidence that someone gained enough access to replace content served through Clop’s onion address. They do not independently demonstrate ShinyHunters’ broader claims about control of Clop systems, access to internal records or the theft of data.

A takeover observed in stages

ShinyHunters told Reuters that it entered the site on 18 September after finding a software vulnerability. Reuters could not independently verify the group’s wider account of the intrusion or the feud it said preceded the takeover.

On 19 September, Hackread reported directly observing ShinyHunters branding, replacement content and a link to the group’s own site at Clop’s address. Reuters also reported that an eCrime.ch screenshot preserved the seizure notice displayed that day. Reuters found the service unreachable when it checked on 20 September.

The Register then reported viewing the defaced site on 21 September, when ShinyHunters was using it to make escalating monetary and public-apology demands. Hackread’s observation of the apparent Clop response came later that day. At the evidence cutoff on 22 September, the available reporting did not establish which side retained access.

These snapshots are not necessarily contradictory. They were recorded at different times while both the content and availability of the Tor service were changing. An unreachable site also does not, on its own, show whether access changed hands. The observations therefore need to be tied to their dates rather than treated as a single, stable picture of control.

Site control is not proof of wider system access

The clearest supported finding is that unauthorised changes were made to content delivered through Clop’s public leak site. That confirms access sufficient to alter what visitors saw, but nothing more by itself. No public forensic report, server logs or authenticated technical account identified in the available reporting establishes that Clop’s wider infrastructure was compromised.

Hackread reported ShinyHunters’ claim that its initial access involved an unauthenticated file-upload weakness in the Grav content management system used by the site. That account remains unverified. No affected software version, CVE, vendor confirmation or authoritative patch guidance was identified, so the visible takeover should not be presented as confirmation of a particular product flaw or exploitation method.

The lack of public proof of deeper access does not establish that the incident stopped at the publishing layer. It means only that wider control, internal data access and exfiltration have not been independently demonstrated. Likewise, the later message attributed to Clop does not authenticate its author or show whether ShinyHunters lost all access.

More than a cosmetic defacement

Although the depth of access remains uncertain, the takeover had operational effects beyond changing a logo or posting a taunt. The Register observed ShinyHunters issuing demands through Clop’s address. Hackread also reported that visitors could download Salesforce-related data that was available through ShinyHunters’ own leak site.

That use of Clop’s established address turned the compromised publishing channel into a distribution and pressure mechanism. It also disrupted a site used by the Clop operation to communicate publicly about its extortion activity. The reporting does not establish how long that capability lasted or the original source of the redistributed data.

ShinyHunters also threatened to identify organisations that allegedly paid Clop, along with claimed payment amounts and Bitcoin addresses. Hackread and The Register said possession of those records had not been independently verified. No organisations should therefore be treated as confirmed payers on the strength of the threat.

The alleged feud remains unverified

ShinyHunters attributed the confrontation to a dispute over an Oracle E-Business Suite zero-day that it claimed to have discovered before Clop obtained and used it. The group also alleged that Clop had threatened to identify its members. Reuters reported the account but could not independently verify it.

That distinction matters because the visible takeover confirms neither the claimed origin of the dispute nor the technical narrative offered by ShinyHunters. Branding and demands consistent with the group’s claim support attribution at the level of the public operation, but there is no cited forensic or law-enforcement finding independently identifying who acted behind the group name.

For previous Clop victims, the unresolved issue is whether the intruder obtained records beyond what could already be published through the site. ShinyHunters’ threat raises concern about possible renewed exposure of payment information, but the evidence currently supports only the observed site takeover and redistribution of data. As of 22 September, authorship of the apparent Clop response, the site’s current controller, the access method and the existence of any stolen internal records all remained unresolved.

A changing Tor service presents separate questions about reachability, message authorship and control. If you want to examine the broader technical context, The Hack Academy's online cybersecurity training programme lists networking, internet vulnerabilities and cybersecurity fundamentals, with a self-paced format that pairs practical exercises and theory.