Control of Cl0p's public leak site is verified. ShinyHunters' claim that it also holds the onion-service private keys would be more serious, but that deeper access remains unproven.
ShinyHunters has taken control of the dark-web leak site used by rival ransomware group Cl0p and is using the same endpoint to demand an eight-figure payment from its former operator. Recorded Future News observed the altered site and the extortion messages on September 21.
The compromised address matters because Cl0p has used it for years to name alleged victims, publish stolen material and apply pressure during extortion negotiations. ShinyHunters has therefore seized a public component of the workflow through which Cl0p establishes its identity and threatens publication.
Malwarebytes reported that ShinyHunters claims the attack began with exploitation of an unauthenticated file-upload flaw in the Grav content-management software. The group also claims to possess Cl0p's onion-service private keys. The visible site takeover is independently observable; the private-key claim remains an assertion by the attacker.
That technical boundary determines what Cl0p can recover from. A compromised web server can be rebuilt at another host. Possession of the onion-service keys could allow a rival to continue presenting the same established onion identity after the backend moved, making recovery of the trusted endpoint substantially harder.
Current evidence does not establish comprehensive access to Cl0p's ransomware infrastructure, victim communications or member identities.
The verified compromise has already changed one enterprise assumption. A message appearing at Cl0p's familiar leak-site address no longer demonstrates that the same operator controls the communication channel.
Sources
Recorded Future News. Malwarebytes.