Full Report
The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...]
Analysis Summary
# Incident Report: ShinyHunters Compromise of Clop Ransomware Leak Site
## Executive Summary
The Clop ransomware gang's data leak site was compromised and defaced by the ShinyHunters extortion group. The attackers exploited an unauthenticated path traversal vulnerability in an unpatched version of Grav CMS to gain access. While ShinyHunters claims to have stolen source code and private keys, Clop maintains the breach was limited to public-facing content, though Clop has since migrated to a new Tor address.
## Incident Details
- **Discovery Date:** September 2026
- **Incident Date:** Early September 2026
- **Affected Organization:** Clop Ransomware Group
- **Sector:** Cybercrime / Ransomware-as-a-Service (RaaS)
- **Geography:** International (Tor-based infrastructure)
## Timeline of Events
### Initial Access
- **Date/Time:** Early September 2026
- **Vector:** Path Traversal / Unauthenticated File Upload
- **Details:** Attackers exploited CVE-2026-42608 in Grav CMS (v1.7.43). By manipulating the `__unique_form_id__` POST parameter with directory traversal sequences (e.g., `../../../`), the attackers bypassed intended upload directories to write files elsewhere on the server.
### Lateral Movement
- **Details:** Specific lateral movement within the server was not detailed, but the attackers gained sufficient permissions to access CMS plugins, server logs, and the Tor service private keys.
### Data Exfiltration/Impact
- **Impact:** The site was defaced with the "Umbreon Pokémon" logo.
- **Exfiltration Claims:** ShinyHunters claims to have stolen source code, Grav CMS plugins, server logs, and private onion service keys.
- **Extortion:** ShinyHunters issued a ransom demand to Clop to prevent the leak of this data.
### Detection & Response
- **Discovery:** ShinyHunters publicly defaced the site and listed Clop on their own leak site.
- **Response Actions:** Clop eventually patched the Grav CMS installation, migrated their data leak site to a new Tor onion address, and denied the value of the stolen data.
## Attack Methodology
- **Initial Access:** Exploitation of unauthenticated path traversal vulnerability in Grav CMS core.
- **Persistence:** Not explicitly detailed, but likely achieved via uploaded web shells through the path traversal flaw.
- **Defense Evasion:** Use of Tor to obfuscate the origin of the attack.
- **Collection:** Gathering of server-side files, logs, and cryptographic keys.
- **Exfiltration:** Transfer of stolen data to ShinyHunters' infrastructure.
- **Impact:** Public defacement and reputational damage to a high-profile ransomware group.
## Impact Assessment
- **Financial:** Unknown; Clop denies paying a ransom, though their removal from ShinyHunters' site suggests possible negotiation.
- **Data Breach:** Compromise of server logs and potentially private cryptographic keys.
- **Operational:** Forced migration to new infrastructure; disruption of the Clop leak site.
- **Reputational:** High; a "hack-the-hacker" scenario undermining Clop's perceived security.
## Indicators of Compromise
- **Behavioral indicators:**
- Unexpected directory creation in Grav CMS root (e.g., `shhq`).
- POST requests containing `../` sequences in the `__unique_form_id__` parameter.
- **Web Defacement:** Display of the Umbreon Pokémon logo.
## Response Actions
- **Containment:** Clop decommissioned the compromised Tor onion service.
- **Eradication:** Updated Grav CMS to a version containing the backported fix.
- **Recovery:** Launched a new data leak site at a different onion address.
## Lessons Learned
- **Patch Management:** Failure to backport security fixes to legacy branches (Grav 1.7.x) leaves a significant attack surface even if the main branch (2.x) is secure.
- **Infrastructure Hardening:** Even threat actors are susceptible to common web vulnerabilities if they rely on third-party CMS platforms without rigorous maintenance.
- **Extortion Dynamics:** Extortion groups are increasingly targeting one another, showing that no entity is exempt from the threat landscape.
## Recommendations
- **Upgrade CMS:** All Grav CMS users on the 1.7 branch should immediately upgrade to version 1.7.53.4.
- **Input Validation:** Ensure all form-related parameters are sanitized using allowlists (e.g., `[A-Za-z0-9,_-]`) rather than blocklists.
- **Least Privilege:** Run web services with minimal filesystem permissions to prevent path traversal from affecting sensitive directories like those containing private keys.