In the shadowed corridors of the dark web, two criminal empires have turned their weapons upon each other. ShinyHunters, a prolific cybercriminal group, claims to have exploited a vulnerability in rival cl0p's infrastructure to seize control of its domain — a confrontation rooted in a disputed zero-day Oracle exploit that cl0p allegedly stole and used to breach over a hundred companies. The conflict surfaced publicly in September 2026, and while such open warfare between criminal organizations is rare, cybersecurity experts confirm it appears genuine. It is a reminder that the architects of di
ShinyHunters claims takeover of rival cl0p's dark web infrastructure
Such public disputes between criminal groups are uncommon
Mark
So ShinyHunters is saying they hacked cl0p's dark web site. How do we know that actually happened?
Mimi
They told Reuters they found a vulnerability on Friday and took control. By Sunday, cl0p's site was down. There's a screenshot from eCrime.ch showing a message saying ShinyHunters had taken over.
Luke
But we're relying on ShinyHunters' own claim here, right? And a screenshot of a message. Cl0p won't comment. We don't have independent confirmation that ShinyHunters actually controls the infrastructure now.
Mimi
That's fair. Reuters couldn't verify it independently. But two cybersecurity experts said the confrontation appears genuine, which lends some credibility.
Mark
What started this fight between them?
Mimi
ShinyHunters says it discovered a zero-day vulnerability in Oracle E-Business Suite first, then cl0p stole the exploit and used it to breach over 100 companies.
Luke
Again, that's ShinyHunters' version. Reuters explicitly says they couldn't verify that account. We don't know if cl0p actually stole it or if there's a different story.
Mark
And then what—they started threatening each other?
Mimi
According to ShinyHunters, cl0p threatened to expose the identities of ShinyHunters members, so ShinyHunters threatened to reveal cl0p's internal operations.
Luke
But we only have ShinyHunters' side of that threat exchange. Cl0p hasn't confirmed any of this.
Mark
Why is this confrontation unusual?
Mimi
Cybercriminal groups don't typically fight openly like this. One expert said he'd never seen such a public confrontation between two criminal organizations.
Mark
That makes sense—it draws attention. Does this tell us anything about how vulnerable these groups are?
Mimi
It suggests they're not invulnerable. If ShinyHunters could find a flaw in cl0p's software, it raises questions about the security of dark web infrastructure itself.
Luke
Though we should note: we don't have independent verification that ShinyHunters actually exploited a vulnerability. We have their claim and a downed website.
Der Puls
- ShinyHunters claims it found a flaw in cl0p's dark web software on a Friday and used it to seize control of the site — which was offline by Sunday, lending credibility to the takeover claim.
- The feud traces back to a stolen zero-day Oracle vulnerability: ShinyHunters says it discovered the exploit first, only to watch cl0p weaponize it against more than 100 companies.
- The standoff escalated into mutual threats of exposure — cl0p allegedly threatened to unmask ShinyHunters members, who fired back by threatening to leak cl0p's internal operational secrets.
- Cybersecurity researchers describe this public confrontation as highly unusual, warning that such visibility risks drawing law enforcement scrutiny to both groups.
- Open questions remain: whether cl0p can reclaim its infrastructure, whether stolen data will be released, and how authorities will respond to this rare, visible criminal conflict.
In the shadowed corridors of the dark web, two criminal empires have turned their weapons upon each other. ShinyHunters, a prolific cybercriminal group, claims to have exploited a vulnerability in rival cl0p's infrastructure to seize control of its domain — a confrontation rooted in a disputed zero-day Oracle exploit that cl0p allegedly stole and used to breach over a hundred companies. The conflict surfaced publicly in September 2026, and while such open warfare between criminal organizations is rare, cybersecurity experts confirm it appears genuine. It is a reminder that the architects of digital predation are not immune to the vulnerabilities they so readily exploit in others.
Two rival cybercriminal organizations have turned on each other in what experts are calling an unusually public confrontation. ShinyHunters announced it discovered a vulnerability in cl0p's dark web software and used it to take over the group's site. The claim was made to Reuters on a Friday; by Sunday, cl0p's site was offline. A screenshot captured by the eCrime.ch platform showed a Saturday message indicating ShinyHunters had assumed control of the domain. Cl0p, a Russian-speaking criminal organization, offered no comment.
The roots of the conflict lie in a disputed zero-day vulnerability in Oracle E-Business Suite — a flaw with no available patch at the time of exploitation. ShinyHunters claims it found the vulnerability first, only to have cl0p allegedly steal the exploit and use it to breach data from more than 100 companies, according to a Google analyst's assessment. The dispute hardened into threats: cl0p allegedly threatened to expose ShinyHunters members' identities, prompting ShinyHunters to threaten disclosure of cl0p's internal operations. Reuters could not independently verify either side's account.
What distinguishes this episode is its visibility. Threat intelligence professionals noted they had rarely, if ever, seen two criminal groups clash so openly — a dynamic that cuts against the instinct for secrecy that typically governs dark web operations. The exposure itself carries risk, potentially inviting law enforcement attention to both parties.
Cl0p's record includes the 2023 MOVEit attack, which compromised data from tens of millions of people across more than 600 organizations. ShinyHunters, meanwhile, has recently extended its reach into emerging technology — Anthropic disclosed this month that hackers linked to the group attempted to use its AI tools for criminal purposes. Whether cl0p recovers its infrastructure, whether ShinyHunters releases any seized data, and how authorities respond to this rare public rupture remain unresolved.
Two rival cybercriminal groups are locked in what appears to be an escalating confrontation on the dark web, with one claiming to have seized control of the other's infrastructure. ShinyHunters announced this week that it discovered a vulnerability in the software running cl0p's dark web site and used that opening to take over the group's operations. The takeover claim emerged after ShinyHunters told Reuters it had found the flaw on Friday. By Sunday, when Reuters attempted to access cl0p's site, it was offline. A screenshot captured by the eCrime.ch platform showed a message posted Saturday indicating that ShinyHunters had assumed control of the domain. Cl0p, a Russian-speaking cybercriminal organization, did not respond to multiple requests for comment from Reuters.
The conflict between these two groups traces back to a dispute over who first discovered a critical vulnerability in Oracle E-Business Suite—a zero-day flaw, meaning security researchers had no time to patch it before it could be exploited. ShinyHunters claims it made the discovery first, then watched as cl0p allegedly stole the exploit and weaponized it. According to a Google analyst's assessment, cl0p used this vulnerability to breach and steal data from more than 100 companies. The situation escalated into a standoff of threats: ShinyHunters says cl0p threatened to expose the identities of several of its members, so ShinyHunters responded by threatening to reveal internal operational details about cl0p. Reuters was unable to independently verify either side's account of these threats or the original discovery dispute.
What makes this confrontation noteworthy is its openness. Cybersecurity experts confirmed to Reuters that the conflict appears genuine, but such public disputes between criminal groups are uncommon. Brandon Parsons, a threat intelligence manager at Ascent Solutions, acknowledged that conflicts do happen within the dark web criminal ecosystem. Joe Rousen, senior director of security research at SpyCloud, said he had not previously encountered such an openly conducted confrontation between two cybercriminal organizations. The visibility itself is unusual—these groups typically operate in the shadows, and direct confrontation risks drawing law enforcement attention.
Cl0p's history includes other high-profile attacks. In 2023, the group exploited a vulnerability in MOVEit, a file transfer program, to steal data from tens of millions of people across more than 600 companies. That operation demonstrated the group's capability and reach. More recently, this month, Anthropic disclosed that it had identified hackers associated with ShinyHunters attempting to use its AI tools, suggesting that ShinyHunters' activities extend beyond traditional cybercrime infrastructure into emerging technology platforms.
The takeover claim, if accurate, would represent a significant shift in the balance of power between these two groups. It also raises questions about the stability of dark web criminal infrastructure and the extent to which these organizations are vulnerable to the same kinds of attacks they deploy against legitimate targets. Whether cl0p can recover its site, whether the data ShinyHunters claims to control will be released, and how law enforcement agencies respond to this rare public conflict remain open questions.
Bemerkenswerte Zitate
Conflicts between cybercriminals on the dark web do occur— Brandon Parsons, threat intelligence manager at Ascent Solutions
He had not previously seen such an open confrontation between two cybercriminal groups— Joe Rousen, senior director of security research at SpyCloud
Möchten Sie die ganze Geschichte?
Das Original lesen bei UA.NEWS ↗
Technology