Cybercrime feud erupts on dark web as notorious group claims hijack of rival’s website

One of the world's most notorious cybercrime groups, ShinyHunters, claimed on Sunday that it had taken control of one of its main rivals' dark web site, cl0p. This action was seen as a long-standing feud coming to light. ShinyHunters, known for aggressive data theft, discovered a vulnerability in cl0p's software and used it to gain control over the rival's infrastructure. ShinyHunters stated, "We basically own them now."

Cl0p, a Russian-speaking cybercrime group, did not respond to inquiries for comment. The rival group's dark web site was inaccessible on Sunday, but previously displayed the message, "Domain Seized By ShinyHunters," according to a screenshot from a cybercrime research platform. Two cybersecurity experts confirmed to Reuters that this was a genuine dispute.

Brandon Parsons, a threat intelligence manager, and Joe Roosen, senior director of security research, both expressed surprise at the open confrontation between cybercrime groups.

The dispute originated from a software exploit issue, which ShinyHunters claimed they discovered first. Cl0p had exploited this zero-day vulnerability to steal data from over 100 companies. ShinyHunters threatened to expose the identities of some of cl0p's members, and cl0p threatened to reveal its internal workings.

Cl0p is known for its skill in finding and exploiting vulnerabilities in enterprise software. In 2023, it used a bug in MOVEit file management software to steal data from tens of millions of people across over 600 companies. This month, ShinyHunters was also in the news for allegedly stealing millions of business records from video game developer Rockstar Games and causing widespread disruption in U.S. schools through an education tool hack.