MANILA, September 25 — A cybercrime feud has erupted between two notorious hacking groups, ShinyHunters and Clop, after ShinyHunters claimed it hijacked Clop’s dark web site in the third week of September 2026. ShinyHunters, known for large-scale data thefts, said it exploited a vulnerability in Clop’s infrastructure to seize control. Clop’s website displayed a message stating “Domain Seized by ShinyHunters” before becoming inaccessible.
Cybersecurity experts confirmed the authenticity of the conflict, noting its rare public nature.
What Sparked the Feud
The feud reportedly stems from a dispute over a stolen “zero-day” exploit in Oracle’s E-Business Suite. ShinyHunters claims Clop misappropriated the exploit, which Clop allegedly used to hack data from over 100 companies. In retaliation, threats of exposing rival members and operational secrets escalated the conflict.
Both groups have been involved in significant cyberattacks. Clop’s recent breaches include data theft from Shell, GE, and others, while ShinyHunters targeted Rockstar Games and U.S. educational platforms.
Why This Matters for Victims
Clop’s leak site was part of its extortion infrastructure, used to pressure victims by threatening to publish stolen information. Having that site taken over by a rival effectively turned Clop’s own extortion mechanism against it. There is potentially an even greater consequence for victims.
If stolen information from a ransomware group’s infrastructure is obtained by another criminal group, data concerning negotiations, payments, or victims could potentially be exposed or used for further extortion. That means organizations previously targeted by one cybercrime group may face additional risks when criminal groups fight among themselves.
Cybersecurity researchers cited by Reuters said the confrontation appeared genuine, though the claims cannot all be independently verified.
The Bigger Picture
The growing professionalization of cybercrime means ransomware groups increasingly operate like competing businesses, complete with specialized skills, partnerships, infrastructure, and financial incentives. As the ecosystem becomes more crowded, attacks between groups could become another method of eliminating competitors or acquiring valuable assets. This internal conflict does not necessarily mean ransomware itself will disappear.
Cybercrime groups have repeatedly demonstrated their ability to reorganize, rebrand, and form new partnerships when disrupted. Ransomware hackers are increasingly rebranding to elude enhanced cybersecurity defenses and law enforcement.
This tactic, while not new, has become more frequent due to AI and automated tools making it easier to trace known hacker patterns. Rebranded groups adopt new names, infrastructure, payment systems, and communication methods to avoid detection. Experts cite a rise in ransomware attacks globally—from 1,186 in 2024 to 1,885 in the last three months—underscoring the threat’s growth.
Groups like GodDamn Ransomware, Helix, and others have shown continuity with earlier groups (e.g., Beast, Monster, BlackFile), suggesting rebranding rather than new actors. Cybercriminals use similar tactics, often disabling security systems and using deepfakes and social engineering to infiltrate networks.
Rebranding is also a marketing tactic in dark web markets to attract buyers. Enforcement can backfire, with targeted groups like Evil Corp simply changing names to avoid sanctions. Analysts emphasize the need for organizations to stay flexible and adaptive, as the cybercrime ecosystem doesn’t shrink—it evolves.
The ShinyHunters-Clop confrontation offers a revealing glimpse into the darker side of the ransomware economy. When criminals become both attackers and targets, the boundaries of cyber warfare blur, and the consequences for victims and defenders alike become more complex.
