A rare turf war erupted on the dark web on September 18, when prolific digital extortion syndicate ShinyHunters claimed it seized control of rival cybercrime gang cl0p’s infrastructure. According to cybercrime research platform eCrime.ch and threat intelligence specialists, the breach exploited a software vulnerability, bringing a long-simmering rivalry between major criminal factions into public view.
The Bottom Line
- The Incident: Extortion syndicate ShinyHunters allegedly hijacked the dark web infrastructure of rival group cl0p following a software exploit discovered on September 18.
- The Trigger: Both groups had been locked in a prolonged dispute over the initial discovery and deployment of a zero-day software exploit targeting Oracle’s E-Business Suite (EBS) in 2025.
An Unprecedented Digital Turf War
The digital underworld witnessed a dramatic escalation on September 20, when cl0p’s primary dark web portal became unreachable. On September 19, visitors to the site encountered a static notice reading, “Domain Seized By ShinyHunters,” as captured by eCrime.ch. ShinyHunters stated in an online chat with Reuters that it exploited a vulnerability in cl0p’s systems to establish sweeping operational control.
“We basically own them now,” ShinyHunters declared regarding the takeover. Cl0p did not respond to repeated requests for comment from journalists, and independent verification of the full scope of the breach remains ongoing.
Industry specialists tracking underground syndicates noted the unusual nature of the clash. Brandon Parsons, a threat intelligence manager at Minnesota-based Ascent Solutions, confirmed to Reuters that “street beefs on the dark web are a real thing.” Joe Roosen, senior director of security research at Texas-based SpyCloud, added, “This was a twist for sure. It is rare I get to see these criminals fight each other.”
The Oracle Zero-Day Catalyst and Enterprise Toll
According to ShinyHunters, the public confrontation stems from a protracted dispute over the theft of a software exploit targeting an unknown vulnerability—a zero-day—in the E-Business Suite (EBS) manufactured by Oracle (NYSE: ORCL). Zero-day flaws are heavily prized within hacker networks because security teams have had zero days to deploy patches.
Cl0p, recognized as a Russian-speaking cybercrime operation, previously leveraged the EBS vulnerability to compromise data across more than 100 companies, based on an estimate by a Google analyst. However, ShinyHunters maintains that it identified the zero-day flaw first. As tensions escalated, cl0p allegedly threatened to expose the identities of several ShinyHunters members, prompting ShinyHunters to retaliate with threats to reveal cl0p’s internal operational architecture.
Both syndicates maintain extensive histories of large-scale corporate extortion. In 2023, cl0p utilized a file-transfer bug in MOVEit software to compromise data from more than 600 companies affecting tens of millions of individuals. More recently, cl0p claimed responsibility for extracting large volumes of data from nearly 50 global enterprises, including Shell (NYSE: SHELL), General Electric (NYSE: GE), Fiserv (NYSE: FISV), and Philips.
Similarly, ShinyHunters drew widespread media attention in April for claiming the theft of millions of business records from video game developer Rockstar Games, creator of the Grand Theft Auto series. In May, the group launched a campaign targeting the Canvas education tool, causing substantial operational disruption across U.S. school districts. Earlier in September, artificial intelligence firm Anthropic reported catching hackers linked to ShinyHunters attempting to abuse its proprietary AI tools.
Underground Infrastructure Breakdown
| Syndicate | Notable Historical Campaigns | Reported Recent Targets |
|---|---|---|
| Cl0p | MOVEit (2023 – 600+ companies) | Shell, GE, Fiserv, Philips (August) |
| ShinyHunters | Rockstar Games (April), Canvas (May) | Anthropic platform attempts (September) |
Economic Impact and Enterprise Risk Management
Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute financial advice.
