decrypted · 21 september 2026 · ransomware and cybercrime · vulnerabilities and patching · uk policy and law

ShinyHunters hijacks Cl0p's leak site through an unauthenticated upload

The ShinyHunters extortion crew spent the weekend defacing the leak site of the Cl0p ransomware gang, and by Monday it was demanding money from it. Cl0p ran the 2025 Oracle E-Business Suite campaign that the NCSC warned UK organisations about, so this criminal feud has a UK footnote. It is also a free lesson in what an unauthenticated upload form is worth.

What happened

On Friday night, according to BleepingComputer, ShinyHunters uploaded a text file to Cl0p's Tor site telling the gang not to threaten it again, then replaced the whole page hours later. BleepingComputer confirmed the defacement and file, but has not verified the bigger claims: that ShinyHunters took Cl0p's source code, server logs and the private keys behind the site's onion address. Treat those as claims.

By Monday, The Record reported, the demands had grown to include a public apology, an unspecified eight-figure sum, and a threat to publish records showing which companies paid Cl0p, how much, and from which Bitcoin addresses. The defaced page was then replaced by a message apparently from Cl0p, saying ShinyHunters' email was not working and asking it to come online.

How the door was left open

ShinyHunters says it got in through an unauthenticated file-upload flaw in Grav, the content management system running the site. Picture a letterbox that accepts any parcel from anyone in the street, then unpacks it inside the building and follows the instructions it finds. Upload a file the server treats as a program and you are running your own code on someone else's machine.

The NCSC described a cousin of that mistake in its October 2025 alert on CVE-2025-61882, saying an unauthenticated attacker could send specially crafted HTTP requests to the affected Oracle component, resulting in full system compromise. Different products, same design failure: a door facing the internet that never asked who was knocking.

The defender sees little: an upload is one ordinary web request. The tell is afterwards, such as a new file in a static folder or a web server starting processes it should not.

What UK organisations should take from it

Payment does not buy privacy. If ShinyHunters' claims are true, a list of payers now sits with a third party that owes Cl0p nothing. Assume anything you paid to keep quiet can resurface.
Policy is heading the same way. The government has said it will keep developing a targeted ban on ransomware payments by public sector bodies and regulated critical national infrastructure, plus mandatory incident reporting, with a 72-hour initial window still under consideration. Proposals, not law, but cheap to plan for.
Exposure is the real risk. The NCSC's Oracle advice included minimising public internet exposure.

The Secure by Design lesson

Secure by Design puts the burden on the builder: the safe state should be the default. For an upload endpoint that means authentication before anything is accepted, uploaded files stored where they cannot run, and secrets such as hosting keys kept off the web server. If the key-theft claim holds, Cl0p missed that third rule too, because one compromised machine would have given up the identity of the whole site.

Applying it is cheap and mostly a procurement question. Ask each supplier, in writing, whether any endpoint accepts anonymous uploads. Then look at your own estate from outside and list what answers.

Also this week

Microsoft is switching off its own SMS and voice sign-in codes in Entra ID. Passkeys became the default on 1 September, and users enabled for SMS or voice are being nudged to register one. From 1 February 2027, Microsoft-provided SMS and voice delivery ends for everyone except Global Administrators and external users, who follow on 1 July 2027. After those dates anyone in scope whose only method is SMS or voice must register a passkey to sign in, and Microsoft says there is no opt-out from that enforcement. A temporary opt-out covers the automatic enablement, and organisations with a regulatory need can use a customer-managed telecom provider through the Microsoft Security Store from 30 October 2026. Microsoft's documentation says SMS and voice are no longer positioned as secure authentication methods. For UK tenants the practical step is to find your SMS and voice users now. The wider point is that a US vendor is setting your sign-in timetable, so read the notices.

A US court has ordered two firms to stop scraping LinkedIn and delete what they took. LinkedIn sued ProAPIs, Netswift and their CEO in October 2025, alleging millions of fake accounts harvesting member profiles, and The Record reports the order also bars them from selling or transferring the data. The Record notes it is LinkedIn's second such win in five months. It is a US order, so it says nothing about what UK GDPR expects of anyone holding scraped personal data. But scraped professional profiles are ready-made fuel for targeted phishing, so UK firms buying data enrichment or lead lists should ask where the data came from.

Sources

Want help checking what your own estate exposes to the internet? Get in touch and we will talk it through.