ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
-
The Clop ransomware gang has relocated its data leak site to a new Tor address after confirming that its previous server was compromised and defaced. The intrusion was carried out through an unpatched flaw in Grav CMS, which BleepingComputer has learned is an unauthenticated path traversal vulnerability.
According to the reporting, the ShinyHunters group was behind the hack of the Clop leak site. The defacement prompted Clop to move its operations to a fresh Tor hidden service address, indicating the gang treated the compromise as serious enough to abandon the original infrastructure rather than simply restore it.
Key points from the incident:
- The vulnerable software is Grav CMS, and the flaw is an unauthenticated path traversal issue.
- The Clop leak site was both compromised and defaced before being moved.
- ShinyHunters has been credited with carrying out the attack.
- Clop has since shifted its leak site to a new Tor address.
For defenders, this incident is a reminder that extortion groups are not immune to the same classes of bugs they exploit in others. An unauthenticated path traversal in a content management system can expose or allow manipulation of files on an internet-facing server, which is exactly the kind of exposure that can lead to a site being taken over or defaced.
There is no specific CVE identifier or patch reference provided in the source report, so administrators running Grav CMS should monitor the project's official channels for updates rather than relying on a specific advisory number here.
Source: Unknown
If your organization runs Grav CMS, have you checked whether it is fully patched and whether any instances are exposed directly to the internet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login