One of the world’s best-known cybercrime groups said on Sunday it had hijacked one of its chief rivals’ dark web site, bringing what it said was a long-simmering feud out into the open.

ShinyHunters, a digital extortion group known for aggressive data theft campaigns, said it broke into the dark web site of cybercrime gang cl0p on Friday after discovering a vulnerability in cl0p’s software and using it to establish wide-ranging control over the group’s infrastructure.

“We basically own them now,” ShinyHunters said in an online chat with Reuters.

Cl0p did not respond to repeated messages seeking comment. The group’s dark web site was unreachable when Reuters tried to visit it on Sunday, but on Saturday it displayed the words, “Domain Seized By ShinyHunters”, according to a screenshot preserved by cybercrime research platform eCrime.ch.

Two cybersecurity experts said the clash appeared to be genuine.

“Street beefs on the dark web are a real thing,” said Brandon Parsons, a threat intelligence manager with Minnesota-based Ascent Solutions.

Joe Roosen, the senior director of security research at Texas-based SpyCloud, said that he had never seen one cybercrime group take another head-on quite so openly. “This was a twist for sure,” he said. “It is rare I get to see these criminals fight each other.”

At loggerheads

ShinyHunters said it had been at loggerheads with cl0p over the alleged theft last year of a software exploit taking advantage of what was a then-unknown flaw in the E-Business Suite (EBS) made by Oracle.

Such “zero days” — so-called because cybersecurity teams have had zero days to fix them — are particularly treasured by hackers because they can be used to gain sweeping access to vulnerable networks.

Cl0p, a Russian-speaking cybercrime gang, used the EBS vulnerability to steal data from what a Google analyst estimated was more than 100 companies, but ShinyHunters claimed it had discovered the zero day first.

Read: Customers of 45 insurers exposed in South African cyber breach

As the dispute festered, cl0p threatened to reveal the identities of several of its rival’s members, according to ShinyHunters. ShinyHunters in turn threatened to reveal the details of cl0p’s internal workings.

Cl0p is counted as one of the most prolific and innovative cybercrime groups, largely because of its skill in finding and exploiting vulnerabilities in enterprise software.

In 2023, cl0p leveraged a bug in MOVEit file management software to steal data on tens of millions of people from more than 600 companies. Just last month it claimed to have stolen large volumes of data from nearly 50 companies worldwide, including Philips, Shell, Fiserv and GE.

ShinyHunters is similarly prolific. It drew media attention in April for its claim to have stolen millions of business records from video game developer Rockstar Games, the ‌maker of Grand Theft Auto, and for a hack in May centred on education tool Canvas that caused widespread disruption across US schools.