Rival extortion groups weaponizing each other's leak-site infrastructure¶

Signal card · maintained from public sources · last updated 2026-09-28

CategoryThreat-Actor Behaviour

StatusWatching

Confidence🟨

First observed2026-04-14

Last updated2026-09-28

Overview¶

Two separate, dated incidents five months apart show rival ransomware/extortion crews compromising and weaponizing each other's own backend infrastructure — leak sites, server logs, source code, victim/payment data — rather than only competing for affiliates and headlines. This is distinct from ordinary DLS rivalry or trash-talk: it is one criminal operation gaining unauthorized technical access to another's infrastructure and using the stolen data as extortion leverage, the same playbook groups use against corporate victims, now turned on each other. Promoted from the watchlist (seeded 2026-09-22 on the ShinyHunters/Clop incident alone) after recurrence mining surfaced an earlier, independent instance — 0APT's April 2026 compromise and doxxing threat against rival group KryBit — that the Sep-22 seed did not yet capture. Two instances, five months apart, documented by entirely distinct sets of named sources, is the "connective pattern across time" SIG-13 is designed to catch.

The open question is whether this is now a recurring feature of the ransomware ecosystem's own internal dynamics (as leak-site software, hosting, and backend tooling are increasingly commoditized and therefore similarly exploitable) or two isolated grudge matches. If it recurs a third time, it starts to look like a structural byproduct of a crowded, cannibalistic RaaS market rather than coincidence — with the second-order effect that ransom-payment confidentiality (a core part of the "pay quietly and it stays quiet" logic victims and insurers rely on) is no longer guaranteed even when the criminals keep their word, since a rival gang can expose it instead.

Evidence log¶

2026-04-12/14 — First instance. 0APT, a ransomware group launched January 2026, posted on its own leak site threatening to expose the identities, photos, names and locations of individuals affiliated with rival group KryBit unless KryBit paid — turning the standard double-extortion playbook against a fellow criminal operation rather than a corporate victim. 0APT leaked a sample of allegedly stolen KryBit member data as proof. KryBit retaliated within 48 hours, compromising 0APT's own server and publishing its complete operational dataset (PHP source code, bash history, 652,813 lines of nginx access logs, /etc/passwd//etc/shadow//etc/gshadow) — which also revealed that 0APT's original 190+ claimed January victims were fabricated with no data ever exfiltrated, undercutting 0APT's own credibility in the same exchange. The Register · Halcyon — "0APT vs. KryBit" · Infosecurity Magazine
2026-09-18/22 — Second, independent instance — higher-profile targets, stakes escalated from doxxing members to exposing corporate victims' payment history. ShinyHunters defaced and claims to have fully compromised Clop's dark-web leak site (exploiting an alleged Grav CMS file-upload flaw), stealing Clop's source code, server logs, and Tor private keys. ShinyHunters gave Clop a 72-hour, eight-figure extortion deadline plus a demand for a public apology, threatening to disclose which companies paid Clop during its 2025 Oracle E-Business Suite campaign, the amounts, and the crypto wallets used — i.e., not just doxxing operators (the 0APT/KryBit model) but exposing named corporate victims' ransom-payment history. As of Sep 24 no payment data has been published and Clop has not paid. The Register · Dark Reading — "ShinyHunters Hacked Cl0p. Now What About Cl0p's Victims?" · Malwarebytes
2026-09-25/27 — Continuation of the second instance: Clop confirms and relocates rather than disputing the intrusion outright. Clop moved its leak site to a new Tor address after confirming ShinyHunters' compromise, but disputes the scope of the theft claim, saying the seized server held only static content rather than operationally sensitive data. No payment-history data has been published by ShinyHunters as of this check. This is evidentiary continuation of the same Sep-18/22 incident, not a third independent instance. BleepingComputer · SC Media
2026-09-2x — Continuation, not the watched outcome. ShinyHunters repurposed Clop's hijacked leak site to publish data from ShinyHunters' own, separate Salesforce-customer extortion campaign ("Scattered LAPSUS$ Hunters," threatening ~39 companies with an Oct 10 deadline) — not Clop's own stolen 2025 Oracle E-Business Suite victim-payment data, which remains unpublished. Clop reportedly reached out to negotiate directly with ShinyHunters. This is evidentiary continuation of the same Sep-18/22 incident (using seized infrastructure as a publishing platform for unrelated leverage), not the specific "watch for" event named in this card (Clop's own alleged victim-payment history being exposed). SOCRadar · Hackread

Review note (2026-10-15): Overdue review (15 days since the last, no checkpoint logged in between) — checked this run's threat-actor/case research for a third named gang-on-gang infrastructure compromise or for ShinyHunters publishing Clop's alleged payment-history data; found neither. No status or confidence change.

Review note (2026-10-26): Second consecutive quiet review — checked again for a third named gang-on-gang infrastructure compromise or for ShinyHunters publishing Clop's alleged payment-history data; found neither. No status or confidence change. 11 days of active checking since the first quiet review (Oct 15); not yet at the ≥21-day Fading bar.

Review note (2026-11-01): Third consecutive quiet review — no third named gang-on-gang infrastructure compromise and no publication of Clop's alleged payment-history data found. 17 days of active checking since the first quiet review (Oct 15); approaching the ≥21-day Fading bar — priority follow-up next review cycle (alongside surveillance-vendor-procurement-backlash). No status or confidence change.

Assessment¶

Confidence: 🟨 Moderate. Two independent, well-separated (five-month gap) incidents, each corroborated by multiple named outlets and at least one CTI vendor (Halcyon for the first; broad trade press for the second), with no source overlap between the two clusters. That clears the bar for a real recurring behavior rather than a single grudge match, but two data points is still a thin sample — it is not yet clear whether this is becoming routine or remains rare enough that each instance is still individually newsworthy specifically because it's unusual.

Estimate: Likely that a third instance lands within the next two quarters, given the pattern has now recurred with escalating stakes. Roughly even chance the next instance targets a top-5 leaderboard group rather than a mid-tier brand, given the trajectory from a january-2026 startup pair (0APT/KryBit) to a top-tier incumbent (Clop) as the second target.

Watch for: a third named instance of one extortion/ransomware group compromising a rival's backend infrastructure (leak site, negotiation panel, server) rather than only claiming credit or trash-talking; ShinyHunters actually publishing Clop's alleged victim-payment data (which would be the first confirmed case of ransom-payment confidentiality broken by a criminal rival rather than by researchers or law enforcement); a named corporate victim or its insurer publicly reacting to a rival-gang payment-history leak; any CTI vendor characterizing gang-on-gang infrastructure compromise as an emerging TTP category rather than isolated incidents.

Portfolio relevance: Any portfolio company that has quietly paid a ransom is relying on the paid group's own operational security and word to keep that fact private — this pattern shows that assumption now also depends on a third criminal group's restraint, not just the original attacker's and law enforcement's. Incident-response and legal teams that advised a client based on "the group we paid doesn't publish payment confirmations" should treat that as no longer a safe assumption.

Sources¶

← All signals