The Clop ransomware operation has migrated its data leak portal to a fresh Tor address following confirmation that its previous server fell victim to a breach orchestrated by the ShinyHunters extortion group. The attack exploited an unauthenticated path traversal flaw in an outdated Grav CMS installation, according to details shared with BleepingComputer.
ShinyHunters initially uploaded a small text file to the compromised Clop leak site earlier this month, then proceeded to replace the entire site with a full-page defacement featuring its Umbreon Pokémon logo alongside a link directing visitors to its own data leak portal.
The threat actors subsequently claimed on their leak site that they obtained source code, Grav CMS plugins, server logs, and the private cryptographic keys underpinning Clop's Tor onion service. ShinyHunters demanded payment in exchange for not publishing the stolen materials.
Clop has announced a replacement onion address for its leak site, with the previous domain remaining temporarily available before decommissioning. The Russian ransomware gang stated it has no affiliation with ShinyHunters and denied any ongoing contact or negotiations with the group.
We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so—either now or in the future.
Clop, in a statement to BleepingComputer
When pressed about how the breach occurred, Clop acknowledged that its Grav installation lacked complete security updates. The group disputed ShinyHunters' assertions regarding the value of stolen data, contending that the compromised server held only website content with no operational or financial information.
We didn't update the Grav plugin — though it happened eventually—but the server contained nothing but content (meaning there was absolutely no data or financial activity there, nor could there have been). Therefore, their claim is worthless—as are their words.
Clop
Despite Clop's public denial of contact with ShinyHunters, the ransomware gang has been quietly removed from the threat actors' data leak site—a pattern typically associated with behind-the-scenes negotiations. When questioned about the removal, ShinyHunters declined to provide further comment to BleepingComputer.
Grav confirms vulnerability details
Grav CMS has validated the technical accuracy of the vulnerability and exploitation methodology disclosed by ShinyHunters to BleepingComputer.
ShinyHunters indicated that the compromised Clop server operated Grav CMS version 1.7.43 and exploited what it characterized as an unauthenticated file upload flaw in Grav's form submission handling. According to the threat actors, the vulnerable code failed to validate form-related POST parameter values before using them to construct temporary upload directories.
The group pinpointed the __unique_form_id__ parameter as the attack vector, explaining that its value was incorporated into a temporary path structure:
tmp/forms//
By injecting directory traversal sequences such as ../../../shhq into the unique form identifier, ShinyHunters stated it could force Grav to construct an upload path outside the intended tmp/forms directory, allowing arbitrary file placement within the Grav installation.
After BleepingComputer provided these technical specifics to Grav, the CMS development team confirmed the accuracy of the threat actors' analysis.
Yes, it's a legitimate flaw, and the threat actor's description is accurate.
Grav
The flaw carries the designation CVE-2026-42608 and represents a path traversal vulnerability that was privately disclosed and remediated in Grav 2.0 (2.0.0-beta.2) earlier in the year, with the security advisory released on April 27.
The patch introduced a sanitizeId() function that restricts identifiers to an allowlist pattern:
[A-Za-z0-9,_-]{1,64}
Grav verified that this sanitization approach matches the mitigation strategy identified by ShinyHunters.
A critical gap emerged in the distribution of this fix: while Grav 2.x releases had received protection, the patch was not applied to the older Grav 1.7 branch, leaving deployments like Clop's version 1.7.43 exposed to exploitation.
The gap was the 1.7 line. Grav 2.0 is the current major version, but plenty of sites are still on 1.7, and that fix hadn't been backported there yet.
Grav
Following BleepingComputer's disclosure of the exploitation technique, Grav backported the fix to the 1.7 branch and released version 1.7.53.4 the following day.
Grav also clarified that the vulnerability resides in Grav core rather than in the Form plugin component.
The bug lives in Grav core, not the Form plugin, so the Form plugin version (7.3.0 in their example) doesn't change whether a site is vulnerable. It's the core version that matters.
Grav
Grav is recommending that all operators still using the 1.7 branch upgrade immediately to version 1.7.53.4. Organizations running current Grav 2.x releases have benefited from protection against this vulnerability for several months.