Clop gets a taste of its own medicine after ShinyHunters hijack leak site

Clop has discovered what life is like on the receiving end of an extortion demand after rival crew ShinyHunters hijacked its leak site and demanded an eight-figure payout.

The takeover surfaced over the weekend, when Clop's dark web leak site displayed a large "DOMAIN SEIZED BY SHINYHUNTERS" banner and the tagline "rooting your systems since '19 ;)." ShinyHunters told Reuters that it broke into the site on Friday by exploiting a vulnerability in the software powering it.

The crew claimed this gave it extensive access to Clop's infrastructure.

"We basically own them now," it said.

Clop has not responded publicly, although two security researchers told Reuters that the clash appeared genuine.

The Register has also viewed the defaced site, where ShinyHunters is posting increasingly colorful demands.

According to ShinyHunters, the feud dates back to Clop's attacks on Oracle E-Business Suite (EBS) customers last year.

ShinyHunters claims it discovered the zero-day first, only for Clop to obtain the exploit and use it against corporate networks.

It now wants a share of the proceeds.

In a message posted on September 19, ShinyHunters demanded an eight-figure payment, claiming the sum represented 2.333 percent of its own net worth.

A later update raised the demand to "all the money you made off the EBS campaign plus more AND WITH INTEREST." ShinyHunters also threatened to identify companies that allegedly paid Clop and publish the sums and Bitcoin addresses involved.

ShinyHunters turned the screw again on September 21, warning that its demands would increase with every 24 hours that Clop failed to respond.

It now also wants a public apology, because apparently having your dark web extortion site hijacked isn't embarrassing enough.

Clop is one of the most prolific data extortion groups in cybercrime.