Rival hackers seize cl0p's dark web site in extortion gang feud

According to Mediacorp, one of the world's most active cybercrime groups has had its own dark web site taken over, not by police, but by a rival gang.

ShinyHunters, a group known for large scale data theft, says it broke into the dark web site belonging to cl0p on Friday. It found a vulnerability in cl0p's software and used it to take wide control of the group's infrastructure. "We basically own them now," ShinyHunters told Reuters in an online chat. Cl0p did not respond to messages seeking comment.

What actually happened

The dark web site was unreachable when Reuters tried to visit it on Sunday. A screenshot preserved by cybercrime research platform eCrime.ch shows the site displaying the words "Domain Seized By ShinyHunters" on Saturday.

Two cybersecurity experts told Reuters the clash looks genuine. Brandon Parsons, a threat intelligence manager at Ascent Solutions, said dark web disputes between criminal groups are a real thing. Joe Roosen, senior director of security research at SpyCloud, said he had never seen one cybercrime group take another on quite so openly.

Why the two groups were already at odds

The feud traces back to a stolen software exploit. ShinyHunters says it discovered a then-unknown flaw in Oracle's E-Business Suite before cl0p did, and accuses cl0p of taking that discovery. Cl0p used the flaw to steal data from what a Google analyst estimated was more than 100 companies. As the dispute grew, cl0p reportedly threatened to expose the identities of ShinyHunters members, and ShinyHunters threatened to reveal details of cl0p's internal workings.

Reuters could not independently verify ShinyHunters' account of the feud.

Why this matters beyond the two groups

Cl0p is one of the most capable cybercrime operations active today. In 2023 it used a bug in MOVEit file management software to take data on tens of millions of people from more than 600 companies. Last month alone it claimed to have stolen data from nearly 50 companies worldwide, including Philips, Shell, Fiserv and GE. ShinyHunters has its own record, including a claimed theft of millions of records from Rockstar Games and a hack in May centred on education targets.

What this changes for anyone tracking these groups is risk rather than closure. A rival hijacking cl0p's own site threatens to expose the internal workings of a gang that has, until now, largely operated behind its own infrastructure. Two of the most damaging data theft operations currently active are now turning their own tools against each other, in public, which is not something law enforcement engineered but something a reader following either group's activity should know has happened.