In the shadowed corridors of the digital underworld, two of the world's most formidable cybercrime organizations have turned their weapons on each other. On September 18, ShinyHunters seized control of rival gang cl0p's dark web infrastructure, transforming a long-running dispute over a stolen Oracle vulnerability into a rare, public confrontation. What typically unfolds in secrecy — the rivalries, the betrayals, the territorial claims of criminal empires — has surfaced briefly into view, reminding observers that even those who prey on the world's institutions are not immune to the same hunger
Cybercrime groups clash openly as ShinyHunters claims hijack of rival cl0p's dark web site
We basically own them now
Mark
So ShinyHunters actually took over cl0p's website? That seems almost impossible—these groups are supposed to be invisible.
Mimi
They claim they found a vulnerability in cl0p's own software and used it to break in. The takeover message appeared on September 18, and by the time Reuters checked on the 20th, the site was down.
Luke
But we should be careful here—ShinyHunters is making the claim. Reuters talked to two security experts who said it looks genuine, but Reuters also says they couldn't verify ShinyHunters' account of the feud itself.
Mark
What's the feud actually about?
Mimi
A zero-day exploit in Oracle software from 2025. Both groups say they discovered it first. Cl0p used it to hit over 100 companies. ShinyHunters says cl0p stole it from them.
Luke
Again, that's ShinyHunters' version. Cl0p hasn't responded to any of this—they're silent.
Mark
Why would ShinyHunters go public with this? Doesn't that draw attention from law enforcement?
Mimi
That's the striking part. These groups usually operate in complete secrecy. One expert said he'd never seen a cybercrime group attack another one so openly. It suggests the feud is serious enough that ShinyHunters was willing to break that rule.
Luke
Or it's a show of force—a way to humiliate a rival and maybe scare off other groups from crossing them. We don't really know the strategic calculation.
Mark
Both groups have threatened to expose each other's members and operations?
Mimi
Yes. Cl0p threatened to reveal ShinyHunters members' identities. ShinyHunters threatened to expose cl0p's internal structure. It's escalation.
Luke
But again, we only have ShinyHunters' word on what cl0p threatened. Cl0p hasn't confirmed any of this.
Mark
So what happens next?
Mimi
That's unclear. If ShinyHunters really does control cl0p's infrastructure, they could release stolen data, expose members, or just keep the site down. Cl0p could try to reclaim it, or they could disappear and rebuild elsewhere.
Luke
And law enforcement is presumably watching all of this very closely now.
O Pulso
- ShinyHunters dealt a stunning blow on September 18, seizing cl0p's dark web site and replacing it with a blunt declaration of ownership — 'Domain Seized By ShinyHunters' — visible to anyone who dared look.
- The attack exposed a festering war rooted in 2025, when cl0p allegedly stole a zero-day Oracle vulnerability that ShinyHunters claims to have discovered first — a piece of digital weaponry valuable enough to fuel genuine rage between criminal rivals.
- Both groups have escalated beyond hacking: cl0p threatened to unmask ShinyHunters members by name, while ShinyHunters countered by threatening to expose the full inner workings of cl0p's operation.
- Two independent cybersecurity experts confirmed the clash is real, with one senior researcher noting he had never before witnessed one major cybercrime group attack another so openly.
- As of September 20, cl0p's dark web site remained unreachable, ShinyHunters declared total control, and cl0p offered no public response — leaving the outcome suspended in an uneasy, unresolved silence.
In the shadowed corridors of the digital underworld, two of the world's most formidable cybercrime organizations have turned their weapons on each other. On September 18, ShinyHunters seized control of rival gang cl0p's dark web infrastructure, transforming a long-running dispute over a stolen Oracle vulnerability into a rare, public confrontation. What typically unfolds in secrecy — the rivalries, the betrayals, the territorial claims of criminal empires — has surfaced briefly into view, reminding observers that even those who prey on the world's institutions are not immune to the same hunger for power and recognition that drives conflict everywhere.
On September 18, a cybercrime group called ShinyHunters announced it had broken into the dark web infrastructure of cl0p, one of the world's most prolific digital extortion operations. Within hours, visitors to cl0p's site were met with a single message: "Domain Seized By ShinyHunters." By September 20, the site was unreachable entirely. "We basically own them now," ShinyHunters told Reuters.
Cybersecurity researchers say the conflict is genuine and long-festering. ShinyHunters claimed it exploited a vulnerability in cl0p's own software to seize broad control of their systems. Brandon Parsons of Ascent Solutions confirmed such dark web feuds do occur, while Joe Roosen of SpyCloud called the open attack unprecedented in his experience. "This was a twist for sure," he said. "It is rare I get to see these criminals fight each other."
The feud traces back to a zero-day vulnerability in Oracle's E-Business Suite — a flaw so potent that cl0p allegedly used it to steal data from more than 100 companies. ShinyHunters insists it discovered the exploit first and that cl0p stole it from them. As tensions mounted, cl0p threatened to expose the identities of ShinyHunters members; ShinyHunters responded by threatening to lay bare cl0p's entire operation.
Both groups carry formidable records of destruction. Cl0p's 2023 exploitation of MOVEit software affected tens of millions of people across more than 600 companies. ShinyHunters, meanwhile, has targeted Rockstar Games, disrupted U.S. schools through an attack on the Canvas education platform, and was linked to attempted misuse of AI tools at Anthropic.
Cl0p did not respond to requests for comment, and Reuters could not independently verify which group first discovered the Oracle flaw. What remains undeniable is that two of the world's most dangerous criminal organizations have dragged their private war into public view — a rare and unsettling glimpse into the rivalries that simmer beneath the surface of the digital underworld.
On September 18, a cybercrime group called ShinyHunters announced it had broken into the dark web infrastructure of cl0p, one of the world's most prolific digital extortion operations. The takeover was not subtle. Within hours, visitors to cl0p's dark web site saw a message: "Domain Seized By ShinyHunters." By September 20, when Reuters tried to access the site, it was unreachable. ShinyHunters told Reuters in an online chat that the breach was complete. "We basically own them now," the group said.
The hijacking brought into the open what cybersecurity researchers say was a genuine, long-festering conflict between two major criminal organizations. ShinyHunters claimed it had discovered a vulnerability in cl0p's software and used that flaw to gain wide-ranging control over the group's systems. Two independent cybersecurity experts confirmed to Reuters that the clash appeared real. Brandon Parsons, a threat intelligence manager at Minnesota-based Ascent Solutions, noted that public feuds between dark web criminals do happen. Joe Roosen, senior director of security research at Texas-based SpyCloud, said he had never witnessed one cybercrime group attack another so openly before. "This was a twist for sure," he said. "It is rare I get to see these criminals fight each other."
The root of the conflict traces back to 2025 and a stolen piece of software code. Both groups had been fighting over who first discovered a zero-day vulnerability in Oracle's E-Business Suite—a flaw so valuable because cybersecurity teams had zero days to patch it before attackers could exploit it. Cl0p, a Russian-speaking cybercrime gang, used that Oracle vulnerability to steal data from more than 100 companies, according to a Google analyst's estimate. But ShinyHunters claimed it had found the zero day first and that cl0p had stolen it from them. As the dispute escalated, cl0p threatened to publicly reveal the identities of several ShinyHunters members. ShinyHunters responded with its own threat: it would expose the internal workings of cl0p's entire operation.
Cl0p has built a reputation as one of the most skilled and prolific cybercrime organizations in operation. In 2023, the group exploited a vulnerability in MOVEit file management software to steal data affecting tens of millions of people across more than 600 companies. In August of this year, cl0p claimed to have stolen large volumes of data from nearly 50 companies worldwide, including Philips, Shell, Fiserv, and GE. ShinyHunters is similarly aggressive and prolific. In April, it claimed to have stolen millions of business records from Rockstar Games, the maker of the Grand Theft Auto series. In May, ShinyHunters targeted Canvas, an education tool, causing widespread disruption across U.S. schools. Earlier in September, AI company Anthropic reported that it had detected hackers linked to ShinyHunters attempting to misuse its tools.
Cl0p did not respond to Reuters' repeated requests for comment about the hijacking. Reuters could not independently verify ShinyHunters' account of the feud or confirm which group actually discovered the Oracle vulnerability first. What is clear is that two of the world's most dangerous cybercrime operations have moved their conflict from the shadows into a public display of dominance—a rare moment when the criminal underworld's internal wars become visible to the outside world.
Citações Notáveis
We basically own them now— ShinyHunters, in online chat with Reuters
It is rare I get to see these criminals fight each other— Joe Roosen, SpyCloud senior director of security research
Quer a matéria completa?
Leia o original em The Straits Times ↗
Technology