Seceon Team · Security · September 2026
Most Companies Spend Their Security Budget Trying to Stop Attackers From Getting In. What Happens When the Attackers Themselves Become the Target?
That sounds like something from a movie.
This week, it happened on the dark web.
One cybercrime group reportedly breached another cybercrime group's infrastructure, stole access to its systems, and turned the attack into an extortion campaign.
Hackers Hacking Hackers
On September 19, BleepingComputer reported that ShinyHunters had breached the data leak site operated by Clop, also known as Cl0p.
The attackers reportedly exploited an unauthenticated file-upload vulnerability in the Grav CMS used by the site. They initially uploaded a small file, then later claimed they had gained broader access to the server.
Reuters subsequently reported that ShinyHunters claimed it had discovered a vulnerability in Clop's software and used it to gain control of parts of the group's infrastructure. Cybersecurity researchers interviewed by Reuters said the clash appeared genuine, although some of the attackers' claims could not be independently verified.
Then the unusual part happened.
The attacker became the victim.
ShinyHunters began demanding money from Clop and threatened to publish information it claimed to have stolen.
The Same Security Problems Still Apply
There is an interesting lesson here.
Cybercriminal groups don't have some magical security layer that makes them immune to the vulnerabilities they exploit against everyone else.
They still have:
Vulnerable web applications
Exposed services
Authentication weaknesses
Misconfigured systems
Valuable credentials
Sensitive logs
Privileged accounts
Software dependencies
The difference is that attackers are constantly looking for these weaknesses.
So when one criminal group finds a weakness in another group's infrastructure, the same attack lifecycle applies.
Discover. Exploit. Gain access. Expand control. Steal information.
The names of the organizations involved may change, but the underlying security problem doesn't.
A Vulnerability Is Only the Beginning
The Grav CMS vulnerability reportedly gave ShinyHunters an initial way into Clop's infrastructure.
But an initial foothold doesn't automatically explain the entire incident.
Security teams need to understand what happened after the first successful action.
Did the attacker access other systems?
Did they obtain credentials?
Did they modify applications?
Did they access logs?
Did they move laterally?
Did they establish persistence?
Did they access data that wasn't required for the original exploit?
This is why simply knowing that a vulnerability exists isn't enough.
The real security question is what that vulnerability allows an attacker to do.
This Is Where Attack Paths Matter
Imagine a vulnerability rated as high risk.
On its own, that tells you something.
Now add context.
The vulnerable application is internet-facing.
It has privileged access.
It connects to an internal database.
The same environment contains sensitive credentials.
An attacker has already started interacting with the system.
Suddenly, the vulnerability isn't just a CVE on a spreadsheet.
It's part of an attack path.
That distinction matters for modern security operations because attackers rarely stop after the first successful exploit.
The Hard Part Is Connecting the Signals
A vulnerability scanner might identify the vulnerable application.
An identity system might show an unusual login.
A network tool might detect suspicious traffic.
An endpoint tool might flag a new process.
A cloud platform might record a configuration change.
Each alert can look manageable on its own.
Put them together, and they can tell a very different story.
This is one reason unified security visibility matters.
Seceon OTM brings together security signals across network, endpoint, identity, cloud, and application environments so security teams can investigate activity with broader context instead of treating every alert as an isolated event.
The goal isn't simply to collect more alerts.
It's to understand how individual events connect to an attack.
Cybercrime Is Becoming More Like an Ecosystem
There is another interesting takeaway from this incident.
Cybercrime isn't a collection of completely independent attackers anymore.
Groups share exploits.
They compete for access.
They steal from each other.
They use common infrastructure.
They target the same vulnerabilities.
And sometimes they attack the infrastructure of their own competitors.
Reuters reported that the current dispute between ShinyHunters and Clop is connected to an earlier conflict involving an Oracle E-Business Suite exploit. Clop later used that vulnerability in data-theft campaigns affecting numerous organizations.
That means threat intelligence isn't only about identifying who is attacking your organization.
It is also about understanding how the broader threat ecosystem is behaving.
What Security Teams Should Take Away
The unusual part of this story shouldn't distract from the familiar lesson underneath it.
Attackers look for weak points.
They exploit exposed systems.
They abuse credentials.
They move when they find opportunities.
And they don't care whether the target considers itself a "security-conscious" organization.
That means security teams need visibility across the full chain:
Vulnerability → Exposure → Access → Behavior → Movement → Impact
If you can see only the first step, you're seeing the vulnerability.
If you can see the whole chain, you're seeing the attack.
FAQ
Can hackers attack other hackers?
Yes. Cybercriminal groups can target each other's infrastructure, credentials, applications, or data. In September 2026, Reuters reported that ShinyHunters claimed to have breached rival group Clop's infrastructure. Researchers quoted by Reuters said the conflict appeared genuine, although some claims from the attackers could not be independently verified.
What happened between ShinyHunters and Clop?
ShinyHunters reportedly breached Clop's data leak infrastructure and defaced its site. BleepingComputer confirmed the initial file upload and defacement, while some broader claims about stolen data and private keys remained unverified.
Why isn't vulnerability management enough?
A vulnerability tells you that a weakness exists. It doesn't necessarily tell you whether the vulnerable asset is exposed, what access it provides, whether attackers are using it, or what could happen after exploitation.
What is an attack path in cybersecurity?
An attack path describes how an attacker can move from an initial weakness or access point toward higher-value systems, identities, data, or other assets.
Why does security correlation matter?
Security correlation connects signals from different parts of an environment. A suspicious login, vulnerable application, unusual process, and unexpected network
