Ransomware Gang Cyberwar: ShinyHunters Attacks Cl0p, Seizes Onion Keys

ShinyHunters, a widely known data theft collective, claims to have hacked rival ransomware group Cl0p. This attack marks an escalation of open hostilities between two of the most feared cybercriminal actors, potentially triggering a full-scale cyberwar.

According to reports from Cybernews and BleepingComputer, ShinyHunters successfully accessed Cl0p's servers through an unauthenticated file upload vulnerability in a Grav CMS plugin used by Cl0p. From there, they stole source code, plugins, system logs, and even Cl0p's private Tor (onion) service keys. ShinyHunters then added Cl0p to their data leak site and gave them a 72-hour deadline to pay a ransom. The ransom amount was not disclosed.

This attack was not just a typical hack. ShinyHunters also replaced Cl0p's website with their ASCII logo and a challenging message: "This site has been PWN3D by SHINYHUNTERS... Maybe next time don't try to threaten us." The message referred to a death threat made by a Cl0p member against ShinyHunters in 2025. "Someone from Cl0p sent a private message: 'I have more money than all of you, I will kill you,'" ShinyHunters told BleepingComputer.

This incident highlights the fragile nature of alliances in the cybercriminal underworld. Perpetrators often collaborate to share resources and services, but these relationships are brittle and easily fractured. Historically, in 2022, the Conti gang collapsed after declaring support for Russia in the invasion of Ukraine. That decision triggered an affiliate rebellion and the leak of over 60,000 internal messages, ultimately disbanding the group. Conti members then dispersed into groups like Black Basta, Royal, and Quantum.

For Indonesia, this conflict between ransomware gangs is not just a spectacle. Both groups have a track record of attacks against organizations in Southeast Asia, including Indonesia. Cl0p is known for frequently targeting file transfer servers like MOVEit and GoAnywhere, which are used by many companies and government agencies. Meanwhile, ShinyHunters has previously breached user data from several e-commerce and fintech platforms. When they attack each other, the compromised infrastructure could be repurposed to launch new attacks, including against less protected regions.

Cybersecurity experts believe this inter-gang war could benefit defenders in the short term, as enemy resources are depleted. However, the long-term risk is the fragmentation of groups into smaller, harder-to-track cells, similar to what happened post-Conti. "When large gangs break up, their members disperse and are often more aggressive," said an unnamed threat intelligence analyst.

The question is, will Cl0p retaliate and trigger an open cyberwar that spills over to public targets? Or will Cl0p's demise pave the way for new, more dangerous gangs? What is clear is that organizations in Indonesia need to heighten their vigilance, especially against vulnerabilities in file transfer services and CMS that are often overlooked.