Our takeShinyHunters breached Clop's leak site via an unauthenticated Grav CMS file upload, defaced it, and stole the Tor keys. Ransomware operators getting ransomed is the kind of poetic justice that doesn't change your risk posture one bit.Cyber Resilience desk
Sources (2)
- bleeping · bleeping
- databreaches · databreaches
What this means for you — Security leader:This is a supply-chain compromise of a ransomware operation's leak site via an unauthenticated file upload in Grav CMS. Review any internal use of Grav CMS or similar flat-file CMS platforms and ensure they are not internet-exposed without authentication.
What this means for you — Lean IT orgs:If you run a website on Grav CMS, take it offline immediately, apply the latest updates, and re-enable only after confirming the unauthenticated file upload flaw is fixed.
What this means for you — MSP:Scan client internet-facing web properties for Grav CMS instances; patch or restrict unauthenticated access on any found, as this vector was used to breach Clop's leak site.
What this means for you — Researcher:ShinyHunters exploited an unauthenticated file upload in Grav CMS to breach and deface Clop's Tor leak site, stealing server data and onion keys. The incident is corroborated by multiple independent reports.