A high-profile cybercrime feud has erupted on the dark web, with ShinyHunters, a well-known digital extortion group, claiming to have hijacked the dark web site of rival gang cl0p. According to ShinyHunters, the breach occurred on Friday after discovering a vulnerability in cl0p's software, allowing them to gain wide-ranging control over the group's infrastructure. This bold move has brought the simmering feud between the two groups out into the open.
The hijacking was confirmed by a screenshot preserved by cybercrime research platform eCrime.ch, which showed the words "Domain Seized By ShinyHunters" displayed on cl0p's dark web site. Two cybersecurity experts, Brandon Parsons and Joe Roosen, told Reuters that the clash appeared to be genuine, with Parsons noting that "street beefs on the dark web are a real thing." This public display of hostility is rare in the cybercrime world.
The feud between ShinyHunters and cl0p reportedly centers around the alleged theft of a software exploit for an Oracle E-Business Suite vulnerability. ShinyHunters claims to have discovered the "zero day" first, but cl0p used it to steal data from over 100 companies. The dispute escalated, with cl0p threatening to reveal the identities of ShinyHunters members, and ShinyHunters responding with threats to expose cl0p's internal workings.
Cl0p is considered one of the most prolific and innovative cybercrime groups, known for finding and exploiting vulnerabilities in enterprise software. In 2023, they leveraged a bug in MOVEit file management software to steal data on tens of millions of people from over 600 companies. More recently, they claimed to have stolen data from nearly 50 companies worldwide, including Philips, Shell, Fiserv, and GE.
ShinyHunters is also a prolific group, having drawn media attention in April for stealing millions of business records from Rockstar Games, the maker of "Grand Theft Auto." They also caused widespread disruption across U.S. schools in May with a hack centered on education tool Canvas. This month, AI company Anthropic reported that it had caught ShinyHunters-linked hackers trying to use its tools.
The hijacking of cl0p's dark web site has significant implications for the cybercrime world, highlighting the rivalries and tensions between groups. According to Joe Roosen, it is rare to see cybercrime groups fight each other openly, making this clash a notable exception. The incident demonstrates the complex and often treacherous nature of the dark web.
The incident raises questions about the validity of ShinyHunters' claims and the potential consequences for both groups. While MTN has denied the validity of recent hacker claims, the feud between ShinyHunters and cl0p highlights the ongoing threat of cyberattacks, often driven by xenophobia and other factors. As the situation continues to unfold, cybersecurity experts will be monitoring the developments closely.
Key points
- ShinyHunters claims to have hijacked cl0p's dark web site after discovering a vulnerability in their software.
- The feud between ShinyHunters and cl0p centers around the alleged theft of a software exploit for an Oracle E-Business Suite vulnerability.
- The incident highlights the rivalries and tensions between cybercrime groups, demonstrating the complex and often treacherous nature of the dark web.
