Clop Moves Ransomware Leak Site After ShinyHunters Exploits Grav CMS Vulnerability

The Clop ransomware gang has moved its data leak site to a new Tor address after confirming that its previous server was compromised and defaced through an unpatched Grav CMS path traversal vulnerability.

ShinyHunters compromised the Clop leak site earlier this month. The group initially uploaded a small text file before replacing the site with a full-page defacement featuring the Umbreon Pokémon logo and a link to the ShinyHunters data leak site.

ShinyHunters later claimed on its own data breach site that it had stolen Clop’s source code, Grav CMS files, server logs and private keys used by the group’s Tor onion service. The attackers demanded a ransom and threatened to publish the stolen files if Clop did not pay.

Clop launches new Tor addresses

Clop has announced new onion addresses and said its previous domain will remain accessible temporarily before being retired.

Clop also denied having any relationship or ongoing negotiations with ShinyHunters.

“We don’t know them, we haven’t worked with them and we have no contact with them at this time. Furthermore, we have not provided them with any information, nor do we intend to provide it to them now or in the future,” Klopp told BleepingComputer.

When asked how ShinyHunters gained access to the leak site, Clop acknowledged that its Grav installation had not been fully updated.

However, the Russian ransomware group disputed ShinyHunters’ claims that valuable operational or financial data had been stolen from the compromised server.

“We didn’t update the Grav plugin, and we eventually did, but the server contained only content (i.e. there was no data or financial activity there at all, and there was no possibility of there being any). Therefore, their claims are worthless, and so are their words,” Klopp said.

Although Clop said it had not communicated with ShinyHunters, the group was later quietly removed from the ShinyHunters data breach site. Such removals typically occur when negotiations are underway.

When asked about the removal, ShinyHunters told BleepingComputer that it did not want to answer further questions.

Grav confirms the vulnerability used in the attack

Grav CMS has confirmed that the vulnerability and exploit details shared by ShinyHunters and BleepingComputer are accurate.

ShinyHunters told BleepingComputer that the compromised Clop server was running Grav CMS 1.7.43 and had been exploited through an unauthenticated file upload vulnerability in Grav’s form upload process.

According to the attacker, vulnerable code used a value supplied through a form-related POST parameter to create a temporary upload directory without first validating it as a secure filesystem path component.

The parameter, __unique_form_id__, was used to create a temporary path similar to:

tmp/forms/<session_id>/<unique_id>

By supplying directory traversal sequences such as ../../../shhq as the unique form identifier, an attacker could cause Grav to create an unintended upload path outside the expected tmp/forms directory.

This allowed uploaded files to be written to other locations within the Grav installation.

After BleepingComputer shared the technical details with Grav, the CMS developer confirmed that the threat actor’s description was accurate.

“Yes, this is a legitimate flaw and the attacker’s description is accurate,” Grav told BleepingComputer.

CVE-2026-42608 affects older Grav 1.7 installations

Grav is tracking the vulnerability as CVE-2026-42608. The path traversal vulnerability was privately reported and fixed in Grav 2.0.0-beta.2, released on April 27.

The fix adds the sanitizeId() function, which accepts only identifiers matching the following whitelist:

[A-Za-z0-9,_-]{1,64}

Grav confirmed that this sanitization method matches the mitigation described by ShinyHunters to BleepingComputer.

Although the current Grav 2.x release was already protected, the fix had not been backported to the older Grav 1.7 branch. This left installations such as Clop’s Grav 1.7.43 deployment vulnerable.

“The difference was 1.7 lines,” Grubb told BleepingComputer. “Although Grav 2.0 is the current major version, many sites are still on 1.7 and the fixes have not yet been backported.”

After BleepingComputer shared details of the exploit with Grav, the developer backported the fix to the 1.7 branch and released Grav 1.7.53.4.

The flaw is in Grav core, not the Form plugin

Grav also clarified that the vulnerability exists in Grav core rather than the Form plugin.

“This bug exists in Grav core, not the Form plugin, so the version of the Form plugin (7.3.0 in our example) does not make a difference whether your site is vulnerable or not. It’s the core version that matters,” Grav said.

Grav is urging users still running the 1.7 branch to upgrade to version 1.7.53.4. Users of the current Grav 2.x release have already been protected from the vulnerability for several months.

Join Mikko Hypponen and security leaders from the NFL, Chanel and Atlassian for a two-hour digital summit about AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix and revalidate at machine speed.

Reserve your seat