The public feud between two prominent groups in the cybercrime arena has gone into an unusual direction, as ShinyHunters claim it managed to breach and control a dark web website being operated by another cybercrime group named cl0p. The alleged attack has brought to light tensions inside the cybercrime underground, with groups that usually function within their own closet engaged in open warfare against each other.
On Friday, cyber arm ShinyHunters claimed that it had breached cl0p’s dark web infrastructure. The group said the breach could have been achieved with a software vulnerability that cl0p had exploited. ShinyHunters said it was able to take deep control of the rival group’s infrastructure and access because of its weakness.
The group’s description of the alleged takeover was quite to-the-point. We now, basically, own them,” ShinyHunters said in an online chat with Reuters.
Cl0p has yet to respond to the allegations publicly. Attempts to reach the group for comment were unsuccessful. The dark web version of the site was also not accessible Sunday. On the previous day, however, the domain was said to have been given the message “Domain Seized By ShinyHunters,” as per a screenshot captured by the cybercrime research platform eCrime.ch.
It has been a showdown that has caught the eyes since it seems cybercriminal organizations are not in the business of having public confrontations that may reveal their infrastructure, identities, or operations. Winners and losers in criminal operations often butt heads when it comes to sharing the victims, the data stolen, and the technical know-how, but when there is an actual attack on another operation, it’s more noticeable.
The conflict looked like it was real, cybersecurity experts said. According to threat intelligence manager Brandon Parsons from Ascent Solutions, “Clashes between cybercriminal communities are a reality in the underground economy. They’re real, he said, referring to “street beefs on the dark web.”
Joe Roosen, senior director of security research at SpyCloud, said that he had rarely seen “rival cybercriminal groups facing off against one another in such an open manner. “This was a twist for sure,” he said. “It’s unusual that I get to see these criminals get into a fight.
The petty feud between ShinyHunters and cl0p seems to be more of an old one. The two sides were said to have been feuding over the theft of a sophisticated software exploit associated with Oracle’s E-Business Suite (EBS), a system often used for ERP.
This was a big security hole, as it was apparently a “zero-day”—a flaw in a security system that has not yet been discovered. The weaknesses of such flaws can actually be useful in cybercrime to give attackers first access to systems before the defenders have time to build and deploy a security patch.
ShinyHunters’ account says cl0p exploited the EBS vulnerability in an attack on organizations and the theft of data. One Google analyst earlier estimated that over 100 companies were impacted by the activity. However, ShinyHunters said that they had found the vulnerability beforehand, and blamed the other group for stealing the exploit.
The disagreement seems to have been a major point of contention between the two operations. The confrontation was not just a criminal affair but later on escalated to threats of disclosure of the identities and internal operations of the groups.
ShinyHunters claimed they threatened to expose the identities of several people related to their operation, according to the Japanese web page. That’s when ShinyHunters are said to have threatened to reveal details regarding cl0p’s operations and organization.
It shows that the cybercrime economy can be a competitive market even though the activities themselves are certainly not. Valuable vulnerabilities, targets, stolen information and reputation are fiercely contested by cybercriminal groups. Trust is also important as criminal activities often require partnerships, affiliates and underground services. One can thus see how a disagreement over a worthy exploit can escalate from a mere hacker-to-hacker thing to a more serious issue.
The alleged takeover also shows the dangers of cybercriminal groups using intricate online infrastructure. All dark web sites and systems are software environments and can have vulnerabilities. Criminal organisations can be attacked with the same technical weaknesses that are used against businesses and public institutions.
Such an insiders’ battle can present an unusual look into an otherwise hard-to-penetrate portion of the digital underworld for cybersecurity researchers. During conflicts, information may be made public that can help shed light on how criminal groups communicate, organize their crimes or maintain their infrastructure. Meanwhile, researchers have to sort out what is true from what is claimed by rival criminal groups.
