SHINY HUNTERS BREACHES CLOP RANSOMWARE OPERATION

SECURITY DESK■ 1 MIN READ

SUN, SEP 20, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

The ShinyHunters extortion gang has compromised the Clop ransomware operation's data leak site, defacing it and stealing server data and private encryption keys.

ShinyHunters breached Clop's Tor-hosted leak site in what appears to be a direct attack on the ransomware group itself. The breach included defacement of the site and theft of sensitive infrastructure, including private keys for the onion service. ShinyHunters has threatened to extort Clop, leveraging stolen data as leverage. The move represents a rare instance of criminal groups targeting each other's operations rather than focusing exclusively on external victims. Clop has been among the most prolific ransomware operations globally, responsible for attacks on hundreds of organizations across multiple sectors. The group has generated significant revenue through victim extortion. Details regarding the extent of compromised data and ShinyHunters' specific extortion demands remain limited. The incident underscores vulnerabilities even within criminal infrastructure and demonstrates the lack of trust within the ransomware ecosystem.

■ SOURCES

► Bleeping Computer

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

P852NPM MALWARE BYPASSES INSTALL DEFENSES

A malicious npm campaign demonstrates how threat actors are evading supply chain protections by embedding malware in package runtime behavior instead of installation scripts. The 'indexed-btree' package exemplifies this evolving attack technique.

1H AGO— Industry Desk

P851HOMOGLYPH ATTACKS: THE TYPO SCAM YOU CAN'T SEE

Cybercriminals are exploiting lookalike characters from different alphabets to create fake URLs that appear legitimate to the naked eye. These homoglyph attacks bypass traditional security checks and trick users into visiting malicious sites.

2H AGO— Industry Desk

P843HUMAN ERROR REMAINS TOP THREAT TO ENERGY GRID

Despite growing concerns about AI-driven cyberattacks, human actors remain the primary cybersecurity risk to critical energy infrastructure. Security experts warn vulnerabilities in power systems continue to expand.

4H AGO— AI Desk

P837LASER ATTACK BYPASSES RP2350 SECURE DEBUG

Researchers at Ledger Donjon have demonstrated a photon-emission-guided laser fault injection attack that defeats the Raspberry Pi RP2350's secure debug protections, according to technical analysis published this week.

6H AGO— Industry Desk

◄ BACK TO NEWS

SHINY HUNTERS BREACHES CLOP RANSOMWARE OPERATION

■ MORE FROM THE SECURITY DESK

■ SUBSCRIBE TO THE DAILY BRIEF