On September 20, the digital extortion collective known as ShinyHunters announced it successfully hijacked the dark web infrastructure of rival cybercrime gang cl0p, exploiting a software vulnerability to seize control in an escalation of underground hostility, according to reporting by Reuters journalists AJ Vicens and Raphael Satter.
The Dark Web Infighting and Oracle Software Disclosures
A rift inside the cybercriminal underworld broke into public view when the data theft group ShinyHunters declared dominance over its competitor, cl0p. According to statements given to Reuters by ShinyHunters, the group located a vulnerability in cl0p’s software on Friday and utilized the flaw to establish wide-ranging control over the rival organization’s digital assets. “We basically own them now,” ShinyHunters stated in an online chat with Reuters. When Reuters attempted to access cl0p’s dark web site on Sunday, the domain was entirely unreachable. A day prior, the site featured a stark message captured in a screenshot by cybercrime research platform eCrime.ch: “Domain Seized By ShinyHunters.”
Cl0p, a Russian-speaking cybercrime operation recognized for targeting enterprise software, did not respond to repeated requests for comment. Industry analysts verified the authenticity of the clash. “Street beefs on the dark web are a real thing,” said Brandon Parsons, a threat intelligence manager at Ascent Solutions. Joe Roosen, senior director of security research at SpyCloud, noted the unusual nature of the conflict. “This was a twist for sure,” Roosen said. “It is rare I get to see these criminals fight each other.”
The Zero-Day Dispute Fueling the Hacker Clash
The hostility centers on a contested software exploit targeting an unpatched flaw in the E-Business Suite (EBS) manufactured by Oracle. Such vulnerabilities, known as zero-days because security teams have had zero days to fix them, hold value within hacking circles for their capacity to breach vulnerable networks. Cl0p previously leveraged the EBS flaw to compromise data across more than 100 corporate entities, an impact estimated by a Google analyst. However, ShinyHunters maintains it discovered the zero-day first.
As the dispute escalated behind the scenes, tensions boiled over into threats. According to ShinyHunters, cl0p threatened to expose the real-world identities of several members within the rival organization. In retaliation, ShinyHunters threatened to leak the internal workings and operational mechanisms of cl0p. Independent verification of ShinyHunters’ precise timeline remains pending, as cl0p has maintained radio silence.
The Bottom Line
- Infrastructure Takeover: ShinyHunters exploited a software weakness to seize control of cl0p’s dark web site, disrupting one of the cyber underground’s most prolific extortion channels.
- The Core Catalyst: The feud stems from a disputed zero-day vulnerability in Oracle’s E-Business Suite, which both gangs claimed to have discovered first.
- Target Profile Escalation: Both groups boast track records of corporate compromises, including cl0p’s MOVEit attacks and ShinyHunters’ recent operations.
Comparative Threat Profiles of Two Extortion Collectives
To understand the magnitude of this digital turf war, one must examine the scale of the victims left in the wake of both syndicates. Cl0p earned notoriety in 2023 by exploiting a file management flaw in MOVEit tool, impacting tens of millions of individuals across more than 600 companies. More recently, cl0p claimed responsibility for extracting substantial data volumes from nearly 50 global organizations, including Philips, Shell, Fiserv, and GE.
Meanwhile, ShinyHunters maintains a disruptive profile. The group drew media coverage in April following claims that it stole millions of business records from Rockstar Games, developer of the “Grand Theft Auto” franchise. This was followed by a May breach centered on educational tool Canvas that disrupted operations across U.S. schools, and an incident this month where AI developer Anthropic intercepted ShinyHunters-linked hackers attempting to use its tools.
| Cybercrime Group | Notable Prior Attacks | Recent Activity |
|---|---|---|
| cl0p | MOVEit (600+ companies affected in 2023); Oracle EBS zero-day thefts across 100+ firms. | Claimed data thefts from 50 global corporations, including Shell and Philips. |
| ShinyHunters | Rockstar Games data theft; Canvas education platform disruption. | Intercepted by Anthropic using AI tools; claimed hijack of cl0p dark web infrastructure. |
Market Implications and Corporate Defense Strategies
Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute financial advice.
