A rare and unusually public feud between two of the world's most prominent cybercrime organisations erupted into the open on Sunday, when the hacking group ShinyHunters claimed to have seized control of a dark web site belonging to its rival, the Russian-speaking gang cl0p. ShinyHunters, a digital extortion group known for large-scale data theft campaigns, said it had discovered a vulnerability in cl0p's software on Friday and used it to establish broad control over the gang's online infrastructure. "We basically own them now," ShinyHunters told Reuters in an online chat. Cl0p's dark web site was inaccessible by Sunday, but had reportedly displayed the message "Domain Seized By ShinyHunters" the day before, according to a screenshot preserved by cybercrime research platform eCrime.ch. Cl0p did not respond to requests for comment.

The dispute at the heart of the conflict centres on a so-called zero-day exploit — a software flaw unknown to its developers and therefore unpatched — targeting Oracle's E-Business Suite (EBS), a widely used enterprise software platform. ShinyHunters claims it discovered the vulnerability first, only for cl0p to allegedly steal the exploit and use it to extract data from more than 100 companies, according to a Google analyst's estimate. As tensions escalated, cl0p reportedly threatened to unmask the identities of ShinyHunters members, while ShinyHunters countered by threatening to expose cl0p's internal operations. Reuters was unable to independently verify ShinyHunters' account of events.

Cybersecurity experts described the open confrontation as highly unusual. Brandon Parsons, a threat intelligence manager at Minnesota-based Ascent Solutions, noted that "street beefs on the dark web are a real thing," while Joe Roosen, senior director of security research at Texas-based SpyCloud, said he had never seen one cybercrime group confront another so publicly. "It is rare I get to see these criminals fight each other," he said.

Both groups have lengthy and damaging track records. Cl0p gained notoriety in 2023 when it exploited a flaw in MOVEit file management software to steal data on tens of millions of people from more than 600 organisations worldwide. More recently, it claimed responsibility for breaching nearly 50 companies, including Shell, Philips, Fiserv, and GE. ShinyHunters, meanwhile, has claimed hacks against video game developer Rockstar Games and disrupted US schools through a breach of the education tool Canvas. AI company Anthropic this month disclosed that hackers linked to ShinyHunters had attempted to use its tools.

The public nature of this clash is significant beyond the criminal underworld. When two prolific hacking groups threaten to expose each other's members and methods, the resulting disclosures — if they materialise — could provide law enforcement and cybersecurity researchers with rare intelligence about the inner workings of organisations that have collectively caused billions of dollars in damage to governments, corporations, and ordinary people worldwide.