ShinyHunters Hacks and Defaces Clop Ransomware Leak Site

ShinyHunters defaced Clop’s Tor leak site—allegedly via an unauthenticated file-upload flaw in the Grav CMS—replacing content with its own messaging and escalating extortion demands (including claims about Clop’s earnings from its Oracle EBS campaign). The compromise is confirmed visually but the report emphasizes uncertainty about the depth of access or whether additional systems or victim data were obtained; Clop remains a high-profile ransomware actor responsible for major data-theft campaigns (e.g., MOVEit).