Cybercriminal Infighting: ShinyHunters Hijacks Clop’s Infrastructure in Escalating Rivalry A feud between two prominent cybercrime groups has exposed vulnerabilities even within hacker operations. ShinyHunters, a notorious ransomware collective, claimed to have compromised the website and infrastructure of rival group Clop, taking its dark web site offline. The attack followed a reported threat from Clop, marking a rare instance of cybercriminals targeting each other’s systems. According to Bleeping Computer, ShinyHunters exploited an unauthenticated file upload flaw in Grav CMS a content management system used by Clop to upload a warning message. The group later defaced Clop’s site with ASCII art and added its rivals to its own data leak list, demanding a ransom and an apology for the site’s return. A note left on the defaced page included a sarcastic apology for the "unprofessionalism." Security experts weighed in on the incident, noting its irony. Steven Thomson of Barrier Networks called it a "funny twist" but cautioned that ShinyHunters may have staged the breach for publicity. Others, including Jamie Akhtar of CyberSmart, highlighted that cybercriminals are just as susceptible to the same security flaws they exploit in legitimate organizations. Clop’s alleged compromise reportedly extended beyond defacement, potentially exposing source code, operational logs, and Tor service keys critical components of its infrastructure. Both groups have established reputations for high-profile attacks. ShinyHunters, active since at least 2020, has targeted major platforms, including a February vishing campaign flagged by Google and a breach of Salesforce’s Experience Cloud. Clop, meanwhile, has orchestrated widespread ransomware campaigns, notably exploiting vulnerabilities in MOVEit File Transfer and print management software. The clash underscores the competitive nature of cybercrime, with experts like Javvad Malik of KnowBe4 noting that criminal enterprises operate like businesses complete with betrayals and power struggles. For defenders, the incident serves as a reminder that understanding threat actors’ motivations and behaviors is as critical as securing technical defenses.