Aug 27 – September 21, 2026 · 2 reports
- ShinyHunters has compromised and defaced the Cl0p leak site, replacing the page behind Cl0p's CAPTCHA with its own Umbreon-branded imagery, per DarkFeed's Ido Cohen (earlier coverage). What's new today is the demand: an updated 20 September message addressed to "Likhogray & Tarasov" demands all proceeds from the Oracle EBS campaign "plus more AND WITH INTEREST," threatening to publish which companies paid, how much, and to which Bitcoin addresses, with 66 hours on the clock (Dark Web Informer). Catalin Cimpanu frames it as ShinyHunters demanding the money Cl0p made from EBS. · Sep 21 · claimed · as shinyhunters · Threat Activity
- ShinyHunters breached and defaced the Cl0p ransomware gang's Tor leak site, then demanded an eight-figure payment. The intrusion started Friday night via what ShinyHunters claims is an unauthenticated file upload flaw in Grav CMS, used to plant a text file ("Maybe don't try to threaten us next time") on Cl0p's server; hours later the site was replaced with the group's Umbreon ASCII art. ShinyHunters told BleepingComputer it took source code, Grav plugins, everything under
/var/log, and the private keys for Cl0p's onion service — which would let it rehost the same .onion address. BleepingComputer confirmed the defacement and the uploaded file but has not verified the data-theft or key claims. BleepingComputer, DarkWebInformer · Sep 20 · attempted · as shinyhunters · Threat Activity