“On August 10, 2025, the Telegram channel ‘scattered lapsu$ hunters – The Com HQ SCATTERED SP1D3R HUNTERS,’ associated with the actors also tracked as ShinyHunters, advertised a large number of vulnerabilities. Among them was an image showing a request to the path /OA_HTML/configurator/UiServlet, which is targeted by the server-side request forgery function in the exploit script.

“On October 3, 2025, the actor shared the post again, claiming it was the same vulnerability Clop used against Oracle. The exploit contains Python scripts that let an attacker run arbitrary commands or open a reverse shell on a vulnerable system. A member of Scattered LAPSUS$ Hunters told BleepingComputer the exploit was originally theirs, and that they leaked it because Clop had taken it and was using it ‘in an unsuccessful way.’

“That dispute resurfaced on September 19, 2026, when ShinyHunters defaced Clop’s leak site. The group says it got in through an unauthenticated file upload flaw in Grav, the content management system hosting the site, and frames the attack as retaliation for a threat of violence it says a Clop representative made during the Oracle campaign.

“The demand has escalated daily: an eight-figure payment, and as of September 21 a public apology on top of it. ShinyHunters also claims to hold the private keys to Clop’s onion service, nif that holds up, it could stand up a site at Clop’s exact address, leaving past Clop victims facing a second actor with the same leverage over the same data.

“ShinyHunters clearly demonstrated access and succeeded in publicly embarrassing a major extortion group. But we haven’t seen evidence that it obtained the negotiation records, payment data or other material that would give it the leverage it claims. We’ll continue to watch as this feud unfolds.”

Why Organizations Need to Stay Alert

While the cybercriminal groups are targeting each other, this doesn’t mean security leaders should let their guard down. 

Pierre-Loïc Kuhn, Cybersecurity Specialist at Filigran states, “Organizations must stay on high alert, because when rival groups clash, tactics shift rapidly and the threat landscape evolves faster than ever.”

Jeff Wichman, Senior Director of Breach Preparedness & Response at Semperis, predicts this trend of hackers targeting each other will continue in the coming months. 

“Hacker-on-hacker crime is poetic justice against the criminal gangs that have been causing years of pain by ransoming public and private organizations,” he points out. “Ironically, threat actors often fall victim to the same phishing emails and scams they use against their innocent victims because of a lack of security hygiene within their own criminal enterprises. In addition, because the barrier to entry into the ransomware economy is lower than ever and the number of low-skilled threat actors continue to enter the industry, we can expect the egos and personal disputes between rival gangs to lead to more hacker-on-hacker crime in the months ahead.”

As criminal groups continue to clash, organizations are encouraged to pay close attention to how this activity shifts the threat landscape.