# Hacker gang ShinyHunters hits rival Cl0p in cyber turf war

> Data leak collective ShinyHunters has hacked ransomware gang Cl0p, stealing source code and threatening to leak files unless paid. The attack echoes a 2022 cybercrime feud that toppled a major criminal group.
- Title: Hacker gang ShinyHunters hits rival Cl0p in cyber turf war
- Summary: Data leak collective ShinyHunters has hacked ransomware gang Cl0p, stealing source code and threatening to leak files unless paid. The attack echoes a 2022…
- Keywords: shinyhunters, cl0p, ransomware, data breach, cybercrime, hacking, tor onion service, grav cms, technology, Hacker, gang, hits
- Source: TechRadar — https://techradar.com/pro/security/cybercrime-civil-war-brewing-shinyhunters-reportedly-hacks-cl0p-ransomware-gang-and-threatens-further-damage
- Published: 2026-09-21T16:05:00+00:00
- Read time: 1 min
- Topics: shinyhunters, cl0p, ransomware, data breach, cybercrime, hacking, tor onion service, grav cms, technology
## ShinyHunters breaches Cl0p servers
Data leak collective ShinyHunters has hacked rival ransomware gang Cl0p, adding them to their leak site and giving them seventy-two hours to pay ransom or face full data exposure.
## What ShinyHunters stole
The stolen files include source code, Grav CMS plugins, system logs, authentication records, and IP addresses from the server's /var/log directory, ShinyHunters told BleepingComputer.

> The data we stole includes source codes, gravCMS plugins, and other things. We are still downloading and reviewing them.
## ShinyHunters took Cl0p's Tor keys
ShinyHunters stole the private keys for Cl0p's Tor onion service, meaning they can host the same onion URL even if Cl0p tries to shut them out.

> We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL.
## Website defaced with taunts
ShinyHunters exploited an unauthenticated file upload flaw in Grav CMS to deface Cl0p's website with their logo and a message: THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p.

> THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p - Maybe don't try to threaten us next time.
## Attack follows Cl0p's threat
A Cl0p member threatened ShinyHunters with violence and exposure during Cl0p's Oracle E-Business Suite attacks last year, saying they had more money and would kill them soon.

> I have more money than you and all of your people combined, I'll kill you soon.
## Cybercriminals rarely stay allied
Criminal groups often work together but are marriages of convenience that collapse easily. The last major feud was in two thousand twenty-two when Conti declared support for Russia during Ukraine invasion.
## Conti's collapse and aftermath
Conti's announcement caused affiliates to abandon it and attack it openly. A Ukrainian researcher leaked over sixty thousand messages exposing the group, leading to its collapse later that year.
## Conti members scattered
Conti's members did not disappear but splintered into multiple groups including Black Basta, Royal, and Quantum, with some allegedly still active today.
## Key takeaway

ShinyHunters has hacked rival ransomware gang Cl0p and given them seventy-two hours to pay ransom or face full data leak, escalating tensions between criminal groups.