ShinyHunters Breaches Clop's Own Data Leak Site via Grav CMS Path Traversal Flaw

According to BleepingComputer, the Clop ransomware gang has relocated its Tor-hosted data leak site after confirming that its previous server was compromised and defaced. BleepingComputer reports the intrusion was attributed to the ShinyHunters group and traced to an unpatched, unauthenticated path traversal vulnerability in Grav CMS, which Clop was apparently using to run the leak site's infrastructure.

Why It Matters

This is a rare case of a ransomware operator's own extortion infrastructure being hacked and defaced, which is notable less for the flaw itself and more for what it reveals: threat actors, including major ransomware brands, run their public-facing infrastructure on ordinary CMS software that can be just as vulnerable to unpatched flaws as any enterprise deployment. Organizations running Grav CMS — or any self-hosted CMS exposed to the internet — should treat this as a reminder that unauthenticated path traversal bugs remain a live, exploitable class of vulnerability, regardless of who is operating the server.

Who Is Affected

• Organizations self-hosting Grav CMS instances, particularly older or unpatched deployments exposed to the internet
• Indirectly, this reflects ongoing friction and rivalry between threat actor groups (ShinyHunters vs. Clop), which can affect the timing and reliability of leak-site-based extortion pressure

What Defenders Should Do Now

• Inventory any internet-facing Grav CMS instances and confirm they are on the latest patched release
• Review web server and application logs for anomalous path traversal patterns (e.g., repeated ../ sequences, requests to unexpected file paths, attempts to reach configuration or credential files outside the web root)
• Restrict direct internet exposure of CMS admin panels and back-end file paths where possible, using a WAF or reverse proxy allowlist
• Monitor for unexpected file modifications or new files dropped on CMS-hosted web roots, which could indicate defacement or webshell activity following a traversal exploit
• Treat this as a general prompt to review path traversal detection coverage across any self-hosted CMS platforms in your environment, not just Grav

Developing Story

Details here are still emerging, including the specific CVE or patch status for the Grav CMS flaw in question — BleepingComputer's report does not confirm a CVE identifier at this time. This is net-new intel and we'll update coverage if a specific vulnerability identifier or technical write-up is published. Read the original report at BleepingComputer.