ShinyHunters Breaches Cl0p Ransomware Gang in High-Stakes Cyber Feud In a rare case of cybercriminals turning on one another, the ransomware group ShinyHunters successfully hacked its rival, Cl0p, by exploiting an unauthenticated file-upload vulnerability in Grav, the content management system (CMS) powering Cl0p’s data leak site. The breach allowed ShinyHunters to deface Cl0p’s public-facing platform, replacing it with a "domain seized" message before taking the site offline. The attack stemmed from a critical flaw in Grav, a PHP-based, flat-file CMS that stores content without a database. Poor server and application configurations can leave Grav installations vulnerable, as seen in this incident. ShinyHunters claimed to have exfiltrated sensitive data, including server logs, source code, Grav plugins, and Cl0p’s Tor service private keys potentially enabling impersonation of the rival gang’s dark web operations. In a twist, Cl0p attempted to negotiate, reaching out to ShinyHunters via an old platform after failing to establish contact through email. Meanwhile, ShinyHunters repurposed Cl0p’s leak site to publish stolen Salesforce data, demanding an eight-figure ransom plus interest from the profits Cl0p allegedly earned by exploiting the Oracle E-Business Suite (EBS) zero-day vulnerability (CVE-2025-61882). Both gangs have claimed discovery of the flaw, which allows unauthenticated attackers to take over Oracle’s Concurrent Processing system. The feud highlights the escalating rivalry between top-tier ransomware groups. Cl0p, known for large-scale data exfiltration via managed file transfer (MFT) systems, has previously exploited MOVEit Transfer (2023), GoAnywhere MFT (2023), Accellion FTA (2021), and Cleo (2024), impacting nearly 200 organizations. ShinyHunters, meanwhile, has built a reputation for breaching enterprise software, SaaS platforms, and cloud environments, often using phishing and stolen OAuth credentials. Recent high-profile targets include Salesloft (1.5B records stolen in 2025), Salesforce (285M records), and major corporations like AT&T, Cisco, and the European Commission. The breach underscores the growing sophistication of cybercriminal infighting, where even threat actors are not immune to exploitation.

Cl0p Ransomware Exploits PTC Windchill Servers in Targeted Data Theft Campaign Cl0p ransomware affiliates are actively exploiting unpatched PTC Windchill and FlexPLM servers to steal sensitive engineering and product-design data from manufacturers, automotive firms, aerospace organizations, and retail apparel companies. The campaign, identified by Ransom-ISAC in collaboration with eCrime.ch and DEFUSED, leverages critical vulnerabilities to gain unauthorized access, exfiltrate intellectual property, and pressure victims through double-extortion tactics. ### Attack Method & Vulnerabilities The intrusion begins with the exploitation of two flaws: 1. CVE-2026-12569 (CVSS 9.8) – A critical deserialization vulnerability in PTC Windchill PDMLink and FlexPLM versions before 11.0 M030, disclosed on June 17 and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on June 25. 2. A pre-authentication information disclosure in the FlexPLM WSDL endpoint, chained with a Windchill login servlet weakness to enable remote code execution (RCE) without credentials. Once inside, attackers deploy JSP webshells, inspect server files, and stage engineering data for theft bypassing traditional phishing or malware delivery methods. ### Extortion & Impact Following initial access (dating back to early June), Cl0p operators send mass extortion emails to employees, using compromised accounts to amplify pressure. The emails, observed from July 20, warn of a "Windchill PDMLink module serious data leak", forcing organizations to investigate while exposing staff to follow-on phishing attempts. The breach poses severe risks, as Windchill systems often store unreleased product designs, specifications, and development workflows data that, if leaked, could benefit competitors or criminal buyers. The double-extortion model ensures leverage even if victims restore from backups. ### Indicators of Compromise (IoCs) Security teams are advised to monitor for: - C2 IP addresses: `216.152.148.54`, `216.152.151.204`, `104.243.35.63`, `5.180.41.35` - Malicious JSP webshells: `Windchill/login/[0-9a-f]{16}.jsp` - Reconnaissance requests: `GET /Windchill/rfa/jsp/login.jsp?wsdl` (response size: 40,454 bytes) - File artifacts: `flst.txt` (file listing) ### Mitigation & Response Organizations should: - Patch vulnerable Windchill/FlexPLM servers immediately. - Hunt for compromise dating back to early June using published IoCs. - Review access logs for unusual outbound activity and unexpected JSP files. - Preserve extortion emails for forensic analysis. The campaign underscores the risks of unauthenticated RCE flaws in business-critical systems, where delayed patching can lead to rapid data theft and extortion.

LockBit Data Reveals Paying Ransoms Increases Public Exposure for Victims An analysis of seized LockBit ransomware data suggests that companies paying ransoms face greater negative publicity than those that refuse. Max Smeets, author of Ransom War, examined data from LockBit 3.0—obtained by the UK’s National Crime Agency (NCA) during Operation Chronos—alongside leaked LockBit 4.0 records. His findings challenge ransomware gangs’ claims that payment prevents exposure. Smeets compared media coverage of 100 companies that paid ransoms with 100 that refused, revealing that paying victims were more likely to be reported on. The phenomenon mirrors the Streisand effect, where efforts to suppress publicity backfire. Speaking at the Black Hat security conference in London, Smeets noted that law enforcement’s long-standing advice against payment—due to funding criminal operations and no guarantee of data recovery—now extends to reputational risks. The data also exposed poor negotiation tactics by victims. Some disclosed desperation, admitting to lacking backups, while others shared insurance documents or pleaded financial hardship—moves that weakened their position. LockBit affiliates follow a predictable playbook: demanding ransoms, offering token decryption tests, and threatening data leaks. However, Smeets found they rarely analyze stolen data for leverage, prioritizing volume over tailored extortion. If victims delay payment, affiliates may settle for smaller sums to avoid prolonged negotiations. The takedown of LockBit’s infrastructure in February 2024 provided a rare glimpse into ransomware operations, underscoring the need for better preparedness in handling extortion demands.