One of the world’s best-known cybercrime groups has claimed it hacked one of its principal rivals, exposing an unusually open confrontation within the underground world of digital extortion. ShinyHunters, a group known for aggressive data theft campaigns, said it breached the dark web site of the Russian-speaking cybercrime gang cl0p on Friday after discovering a vulnerability in its software and using it to gain broad control of the group’s infrastructure.
“We basically own them now,” ShinyHunters told Reuters in an online chat. Cl0p did not respond to repeated requests for comment. Its dark web site was unreachable when Reuters attempted to access it on Sunday, while a screenshot preserved by cybercrime research platform eCrime.ch showed that it had displayed the message, “Domain Seized By ShinyHunters” on Saturday.
Two cybersecurity experts told Reuters that the confrontation appeared to be genuine, highlighting how unusual it is for rival cybercrime organisations to attack each other so openly. Brandon Parsons, a threat intelligence manager with Minnesota-based Ascent Solutions, said conflicts between criminal groups on the dark web were a real phenomenon. Joe Roosen, senior director of security research at Texas-based SpyCloud, said he had never seen one cybercrime group confront another so directly, describing the development as “a twist for sure”.
The dispute is reportedly rooted in a battle over a software exploit linked to Oracle’s E-Business Suite (EBS). ShinyHunters said it had been in conflict with cl0p over the alleged theft last year of an exploit for a previously unknown EBS vulnerability. Such vulnerabilities, known as “zero days”, are highly valuable to hackers because security teams have had no opportunity to develop a fix before the flaw is exploited.
Cl0p used the EBS vulnerability to steal data from more than 100 companies, according to an estimate by a Google analyst. ShinyHunters has told Reuters that it discovered the zero day first, a claim Reuters could not immediately verify. According to ShinyHunters, the dispute escalated after cl0p threatened to expose the identities of several members of its rival group. ShinyHunters then threatened to reveal details of cl0p’s internal operations.
The broader significance of the confrontation lies in the capabilities of both groups. Cl0p is regarded as one of the most prolific and innovative cybercrime organisations, particularly for its ability to identify and exploit vulnerabilities in enterprise software. In 2023, it exploited a vulnerability in MOVEit file-management software, compromising data involving tens of millions of people across more than 600 companies.
Cl0p has continued to claim major operations. Last month, it said it had stolen large volumes of data from nearly 50 companies worldwide, including Philips, Shell, Fiserv and GE. Those claims form part of a pattern of attacks that has made the group a significant presence in the cybercrime ecosystem.
ShinyHunters has also carried out high-profile campaigns. In April, it attracted attention after claiming to have stolen millions of business records from Rockstar Games, the developer of “Grand Theft Auto”. In May, a hack centred on the education tool Canvas caused widespread disruption across US schools. This month, AI company Anthropic said it had disrupted hackers linked to ShinyHunters who had attempted to use its tools.
The latest clash remains clouded by uncertainty. While cybersecurity experts cited by Reuters believe the confrontation appears genuine, Reuters said it could not independently establish the veracity of ShinyHunters’ account of the feud. For now, the apparent attack has turned a normally concealed rivalry within the cybercrime world into an unusually public dispute between two groups better known for targeting organisations outside their own ranks.
