ShinyHunters says it hijacked Cl0p’s dark web leak site

https://media.thenextweb.com/2026/05/Grafana-Labs-Hackers.jpg

On the night of Friday, September 18, the Tor leak site that the Cl0p ransomware gang used to name and pressure its victims was defaced. Another criminal group claimed responsibility, according to BleepingComputer.

When people visited the site, they saw Pokémon artwork, an ASCII Umbreon, above the message “THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS” and the sign-off “rooting your systems since ’19”.

The post also included a link to ShinyHunters’ own leak platform. BleepingComputer confirmed that the defacement was active on Cl0p’s infrastructure and that the attackers uploaded a downloadable file.

The artwork acts as a kind of signature. The researcher VXDB matched the same Umbreon image to a HackForums defacement in August 2020, which ShinyHunters also claimed. This is a clue for attribution, not proof, and it marks the end of what this story can verify.

The group says it got in through an unauthenticated file-upload flaw in...

Copyright of this story solely belongs to thenextweb.com. To see the full text click HERE

Read more