#clop

ShinyHunters defaced the Clop ransomware gang's Tor leak site with its Umbreon logo and claims it stole the source code, /var/log, and Clop's onion private keys — retaliation over the 2025 Oracle EBS exploit dispute. Only the defacement is independently confirmed; the theft claims are not.

Cl0p exploited an unauthenticated deserialization flaw in PTC Windchill as a zero-day in June 2026, deployed a purpose-built web shell that decrypts the application's keystore, and named 43 manufacturers, including Shell, Philips and GE. It was the second such flaw in three months.