BOSTON, September 24 — Two of the most notorious names in cybercrime spent the third week of September fighting each other instead of their usual targets, and the scuffle has handed security researchers a rare public look at how the ransomware economy polices itself. ShinyHunters, a group known for large-scale data thefts, claimed it breached the infrastructure of rival ransomware outfit Clop and seized control of its dark-web leak site. For a time, Clop’s page displayed a blunt message — “Domain Seized by ShinyHunters” — before going dark altogether.
Cybersecurity researchers cited by Reuters said the confrontation appeared genuine, making it an unusually visible feud between two criminal syndicates that normally prefer to stay in the shadows.
A dispute over a stolen exploit
Here’s what it means, in plain terms. The fight reportedly traces back to a stolen “zero-day” exploit — a software flaw that nobody has patched yet — in Oracle’s E-Business Suite. ShinyHunters claims Clop misappropriated that exploit, which Clop allegedly used to hack data from more than 100 companies.
In retaliation, the two sides escalated to threats of exposing rival members and operational secrets. Think of it like two rival shopkeepers who can’t call the police on each other.
Ransomware groups have no courts, no contracts and no regulators to settle their disagreements, so disputes get resolved through reputation, threats or technical retaliation. That’s the practical upshot of an ecosystem where criminals have to cooperate with people they can’t necessarily trust. Affiliates drift between groups, stolen vulnerabilities change hands, and inside knowledge about criminal operations becomes a bargaining chip.
Both groups bring serious track records to the fight. Clop’s recent breaches include data theft from Shell and GE, among others.
ShinyHunters has targeted Rockstar Games and U.S. educational platforms.
Why victims should pay attention
An attack on another criminal group can serve several purposes at once — gathering intelligence, disrupting a competitor, exposing weaknesses, or simply showing off technical superiority. In this case, ShinyHunters also demanded payment from its rival. The takeover of Clop’s leak site carried a particular sting.
That site was part of Clop’s extortion infrastructure, the mechanism it used to pressure victims by threatening to publish stolen information. Having a rival flip that tool against its owner turned Clop’s own weapon around.
There’s a bigger risk lurking for legitimate organizations. If data sitting inside a ransomware group’s infrastructure falls into another criminal group’s hands, details about negotiations, payments or victims could be exposed or used for fresh extortion. Companies previously targeted by one group may face new exposure when criminal outfits turn on each other.
An ecosystem that evolves, not shrinks
Ransomware is a business driven by money, and it increasingly behaves like one. Groups compete for valuable vulnerabilities, stolen data, affiliates, victims and access to compromised networks. They develop specialized skills, partnerships, infrastructure and financial incentives — the trappings of competing firms, minus the legal system that normally keeps competition in bounds.
Internal conflict doesn’t mean ransomware is going away. These groups have repeatedly shown they can reorganize, rebrand and form new partnerships when disrupted.
Rebranding has become more frequent as AI and automated tools make it easier to trace known hacker patterns, pushing groups to adopt new names, infrastructure, payment systems and communication methods. Researchers point to continuity between older and newer operations — GodDamn Ransomware and Helix, for instance, showing links to earlier groups like Beast, Monster and BlackFile — suggesting rebranding rather than a wave of brand-new actors. Enforcement can backfire too.
Targeted groups like Evil Corp have simply changed names to dodge sanctions. Analysts say the lesson for defenders is flexibility.
The cybercrime ecosystem doesn’t shrink; it evolves. Watch for whether the ShinyHunters–Clop feud stays contained or pulls other groups into the fray — and for what happens to any victim data caught in the middle.
