According to reporting on the incident, the attackers replaced the contents of Clop's leak site with their own message and are now threatening to extort the ransomware crew itself — an unusual turn of events in which one criminal group targets another.

Key details reported so far:

• The target was Clop's Tor-based data leak site, which was defaced.
• ShinyHunters claims to have exfiltrated server data from the site's infrastructure.
• The private keys for the onion service were allegedly stolen, potentially giving ShinyHunters control over the hidden service's address.
• ShinyHunters is now threatening to extort the Clop operation.

The article does not provide a specific CVE identifier for this incident, and no advisory or tracking number is cited in the source material.

The development is notable because Clop has been one of the more prolific ransomware and extortion operations in recent years, so a breach of its own leak infrastructure by a rival group raises questions about operational security within these crews and how such intragroup conflicts may play out.

Source: BleepingComputer

Do you think rival-gang attacks like this will become a bigger trend in the ransomware ecosystem, or is this an isolated incident?