According to the reporting, the ShinyHunters group was behind the hack of the Clop leak site. The defacement prompted Clop to move its operations to a fresh Tor hidden service address, indicating the gang treated the compromise as serious enough to abandon the original infrastructure rather than simply restore it.

Key points from the incident:

• The vulnerable software is Grav CMS, and the flaw is an unauthenticated path traversal issue.
• The Clop leak site was both compromised and defaced before being moved.
• ShinyHunters has been credited with carrying out the attack.
• Clop has since shifted its leak site to a new Tor address.

For defenders, this incident is a reminder that extortion groups are not immune to the same classes of bugs they exploit in others. An unauthenticated path traversal in a content management system can expose or allow manipulation of files on an internet-facing server, which is exactly the kind of exposure that can lead to a site being taken over or defaced.

There is no specific CVE identifier or patch reference provided in the source report, so administrators running Grav CMS should monitor the project's official channels for updates rather than relying on a specific advisory number here.

Source: Unknown

If your organization runs Grav CMS, have you checked whether it is fully patched and whether any instances are exposed directly to the internet?