#zero-day · Cascadity

CCybersecurity #Clop #cybercrime #ransomware #ShinyHunters #zero-day

ShinyHunters claims it hijacked Clop’s dark-web site in an escalating cybercrime feud

Two major criminal groups openly fighting over infrastructure and a disputed zero-day offers a rare view into the economics and trust relationships of cybercrime.

A public feud erupted between ShinyHunters and Clop, with ShinyHunters claiming it exploited a vulnerability to seize Clop's dark-web leak site.

Reuters reported that the dispute involved accusations around a stolen zero-day exploit and threats to expose rivals' identities or operational details.

Why it matters

Cybercrime groups depend on reputation, infrastructure, access brokers and shared exploit ecosystems. Open conflict between major actors can expose internal relationships and may disrupt criminal operations—or simply push them to rebuild with stronger operational security.

Read it at the source

ReutersCybercrime feud erupts on dark web as notorious group claims hijack of rival's website Independent ↗

Cascadic Analysis 3

UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

Criminal groups fighting each other can look like good news for defenders, but fragmentation does not necessarily reduce capability. Tooling, stolen data and tactics can spread when groups split, creating more actors rather than fewer.

UndertowDelayed Consequence / False Success Problem

What hidden risk could pull against this, even if the news is good?

A feud may temporarily disrupt operations and produce visible arrests or leaks, while the underlying ecosystem adapts. The mistake would be measuring success by short-term chaos instead of whether attacker capacity actually declines.

UndertowMulti-agent systems can create cascading failures

What hidden risk could pull against this, even if the news is good?

Cybercrime increasingly behaves like a supply chain: access brokers, ransomware operators, data thieves and money launderers depend on one another. Conflict in one node can simply reroute activity through another.

Rabbit Holes 2

Who ShinyHunters is

The extortion group active since 2019, with a running list of its claimed breaches, including the Snowflake and Salesforce data hacks.

Wikipedia · Wade · 5 min

0
The 2023 MOVEit data breach

The other side of the feud at its peak: Cl0p is the suspect in the file-transfer hack that hit over 2,700 organizations and exposed data on roughly 93 million people.

Wikipedia · Swim · 30 min

0

CCybersecurity #Check-Point #CVE #network-security #RCE #zero-day

Check Point patches actively exploited gateway and management-server flaws

Attackers were exploiting critical flaws in security infrastructure itself, including a pre-authentication path into systems meant to protect enterprise networks.

Check Point disclosed active exploitation of critical vulnerabilities affecting Security Gateways and management servers, including a pre-authentication remote-code-execution path.

The company released fixes and urged customers to update affected systems.

Why it matters

Security appliances occupy privileged positions at network boundaries. When attackers compromise the defensive layer itself, they can potentially bypass controls, observe traffic or use trusted infrastructure as a foothold deeper inside the environment.

Read it at the source

Check PointSecurity Advisory – Active Exploitation of CVE-2026-85102 and CVE-2026-93616 ↗ BleepingComputerCheck Point warns of hackers exploiting Security Gateway VPN RCE flaw Independent ↗

Cascadic Analysis 3

UndertowDelayed Consequence / False Success Problem

What hidden risk could pull against this, even if the news is good?

Emergency patching after active exploitation is necessary, but 'patched' can create false confidence. Compromise may have happened before remediation, and persistence or stolen credentials can survive after the vulnerable code is fixed.

UndertowPrivilege escalation + credential propagation

What hidden risk could pull against this, even if the news is good?

Gateway and management-plane flaws are especially dangerous because they sit near privileged control paths. A vulnerability there can become a launch point for credential theft and lateral movement rather than a single isolated compromise.

UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

Once a vulnerability is public and weaponized, AI can compress the time between disclosure and broad exploitation by automating target discovery, exploit adaptation and validation.