ShinyHunters Hijacks Cl0p Domain in Oracle Zero-Day Feud; 100+ Firms Impacted

For security operations and threat intelligence teams, a public high-stakes conflict between two top cybercrime groups is more than dark web drama: it is a potential source of leaked internal tooling, victim lists, and operational details. The ShinyHunters-cl0p clash centers on an Oracle E-Business Suite zero-day, and the already compromised 100+ organizations could be re-exposed. Defenders should assume that any data held on cl0p's seized infrastructure is now in rival hands.

On September 20, 2026, ShinyHunters publicly claimed it hijacked the dark web site of rival cybercrime gang cl0p, pulling a long-simmering dispute into the open. The group told Reuters in an online chat that it breached cl0p's infrastructure on Friday, September 18, after discovering a vulnerability in cl0p's own software. By Saturday, September 19, a screenshot preserved by research platform eCrime.ch showed cl0p's dark web domain displaying 'Domain Seized By ShinyHunters.' When Reuters tried to visit the site on Sunday, September 20, it was unreachable, and cl0p did not respond to requests for comment.

“

The ShinyHunters-cl0p clash centers on an Oracle E-Business Suite zero-day, and the already compromised 100+ organizations could be re-exposed.

Two independent researchers told Reuters the clash appeared genuine. Brandon Parsons, a threat intelligence manager at Minnesota-based Ascent Solutions, called it 'street beefs on the dark web.' Joe Roosen, senior director of security research at Texas-based SpyCloud, said he had never seen one cybercrime group take on another so openly, describing the event as 'a twist for sure.' The fact that security professionals validated the claim matters, because dark web defacements and seizure messages can be staged or fabricated; here, observable infrastructure control and an archived screenshot gave the incident credibility.

The root of the feud is an alleged theft of a zero-day exploit targeting Oracle's E-Business Suite. ShinyHunters says it discovered the flaw first, but cl0p, a Russian-speaking cybercrime gang, allegedly stole the exploit last year and used it to compromise data from more than 100 companies, according to an estimate attributed to a Google analyst. Zero-day exploits are among the most prized tools in cybercrime because they target vulnerabilities that defenders have had no time to patch, allowing broad and stealthy access to networks. Ownership disputes over exploit code are not new, but they rarely escalate into domain seizure and public claims of total infrastructure control.

Cl0p is a prolific extortion group known for mass exploitation campaigns, and its apparent failure to secure its own dark web infrastructure is a significant operational security failure. For ShinyHunters, saying it now owns cl0p's infrastructure is both retaliation and a demonstration of technical capability to other criminals and potential buyers of stolen data. The move also raises the immediate risk of an escalation spiral: both sides have reportedly threatened to expose each other's members and internal workings, and cl0p may now attempt countermeasures against ShinyHunters.