Clop

It also insists that they're not sextortionists.

That's a reputation management campaign from a group that's also recently breached ransomware gang Cl0p's leak site this week and hit the Florida DMV the week before.

Experts expect a leak since the FBI isn't likely to withdraw the notice.

Andrew Brant, an incident responder at Huntress, says the bigger risk is ShinyHunters selling the data to other criminal or nation state groups.

[laughs]

Um, now look, speaking of victimless crimes, uh, ShinyHunters is beefing with Cl0p, and I just love this, right?

[laughs]

Uh, so apparently, like, Shi- ShinyHunters took over the Cl0p ransomware site, like their leak site, and has defaced it and said, "You gotta give us an eight-figure ransom," and blah, blah, blah, blah, blah.

"Be sure to bring an English interlocutor so you can comprehend my literacy in acquiring your bank account," uh, the message stated.

Um, w- you know, I...

What? [laughs] Like-

[laughs]

I'm Sarah Lane.

ShinyHunters hijacks Cl0p's own leak site.

ShinyHunters turned Cl0p's dark web leak site against the ransomware gang, defacing it with an eight-figure extortion demand that would rise every twenty-four hours.

The group also threatened to publish records showing which companies paid Cl0p, how much they paid, and the Bitcoin addresses that were used.

ShinyHunter says the feud began after Cl0p used an Oracle E-Business Suite exploit without permission and threatened one of its members.

[slide whooshing] Fake LastPass installers kill security tools.

A fake LastPass authenticator page promoted through GitHub search results is delivering Rapunzel infostealer malware, but LastPass says none of its own systems were compromised.

This comes on the back of revelations that OpenAI agents were behind a wave of malicious packages published on the RubyGems package repository in May.

The ShinyHunters hacking group has breached and defaced the Cl0p ransomware gang's leak site.

The ShinyHunters group is demanding all the money that Cl0p made from its Oracle EBS hacking campaign.

The hack appears to have taken place after a disagreement between the leaders of both groups.

Hackers have breached image sharing service Gyazo and stolen data on more than twenty-three million of its users.

Top story number three.

Shiny Hunters has breached the CLOP ransomware gang's data leak site, defacing the Tor page and claiming to have stolen server data, logs, source code and private Onion service keys.

The group says it used a Grav CMS upload flaw to plant the attack, and if verified, the stolen keys could let it control CLOP's existing leak site address.

The incident matters because it signals an escalating feud between major cybercrime groups and could expose operational details about CLOP and its affiliates.

In other news, Google's Gemini AI was found to have accessed real company systems during a cybersecurity test in May after a domain naming Mixup exposed the model to the open Internet, according to reporting on the evaluation.

In one case, it repeatedly guessed a password, and in two others, it used credentials found in a public repository before stopping once it realized it had breached a real system.

Paper cut print servers have a grim precedent.

Prior paper cut flaws were abused by CLOP and lock bit affiliates and a compromised application server is a ready made foothold for lateral movement and ransomware because it sits at the intersection of user networks and sensitive document workflows.

This matters because paper cut NG and MF is deployed in thousands of offices and schools, usually as a single central application server.

One compromise compromises the print layer of an entire organization.

So a couple of things for our listeners.

DFIR, if you don't know, is their digital forensics and incident response team, just in case some of our listeners weren't tracking that acronym.

And CLOP and LockBit, for those that don't know, are some of the top ransomware as a service actors.

They don't just do ransomware, but data theft, right? Take it and then hold it hostage until they pay.