Cybercrime feud erupts on dark web as notorious group claims hijack of rival’s website

Cybersecurity concerns have intensified across Europe after GCHQ warned of increasing hostile activity linked to Russia targeting infrastructure, supply chains and public institutions.(Representative image: Unsplash@hidd3n)

One of the world’s best-known cybercrime groups said on Sunday it had hijacked one of its chief rivals’ dark web site, bringing what it said was a long-simmering feud out into the open.

ShinyHunters, a digital extortion group known for aggressive data theft campaigns, said it broke into the dark web site of cybercrime gang cl0p on ⁠Friday ​after discovering a vulnerability in cl0p’s software and using it to establish wide-ranging control over the group’s infrastructure.

“We basically own them now,” ShinyHunters said in an online chat with Reuters.

Cl0p did not respond to repeated messages seeking comment. The group’s dark web site was unreachable when Reuters tried to visit it on Sunday, but on Saturday it displayed the ​words, “Domain ​Seized By ShinyHunters,” according to a screenshot preserved by cybercrime research platform ⁠eCrime.ch.

Two cybersecurity experts told Reuters the clash appeared to be genuine.

“Street beefs on the dark web are a real thing,” said Brandon Parsons, a threat intelligence manager with Minnesota-based ‌Ascent Solutions.

Joe Roosen, the senior director of security research at Texas-based SpyCloud, said that he had never seen one cybercrime group take another head-on quite so openly. “This was a twist for sure,” he said. “It is rare I get to see these criminals fight each other.”

Story continues below this ad

Oracle software exploit clash

ShinyHunters said it had been at loggerheads with cl0p over the alleged theft last year of a software exploit taking advantage of what was a then-unknown flaw in the E-Business Suite (EBS) made by Oracle.

Such “zero days” — so-called because cybersecurity teams have had zero ⁠days to fix them — are ⁠particularly treasured by hackers because they can be used to gain sweeping access to vulnerable networks.

Cl0p, a Russian-speaking cybercrime gang, used the EBS vulnerability to steal ⁠data from what a Google ‌analyst estimated was more than 100 companies, but ShinyHunters told Reuters it had discovered the ​zero day first.

As the dispute festered, cl0p threatened to reveal ‌the identities of several of its rival’s members, according to ShinyHunters.

Story continues below this ad

ShinyHunters in turn threatened to reveal the details of cl0p’s internal workings.

Reuters could not immediately establish the veracity of ShinyHunters’ account of the feud.

Cl0p ‌is counted as one ​of the most ​prolific and innovative cybercrime ​groups, largely because of its skill in finding and exploiting vulnerabilities in enterprise software.

In 2023, cl0p leveraged a bug in MOVEit file management software to steal data on ​tens of millions of people from more than 600 companies. Just last ⁠month it claimed to have stolen large volumes of data from nearly 50 companies worldwide, including Philips, Shell, Fiserv and GE.

Story continues below this ad

ShinyHunters is similarly prolific. It drew media attention in April for its claim to have stolen millions of ‌business records from video game ⁠developer Rockstar Games, the maker of “Grand Theft Auto”, and for a hack in May centered on education tool Canvas that caused widespread disruption across U.S. schools.

This month, AI ​company Anthropic said it had caught ShinyHunters-linked hackers trying to use its tools.