Loading story…
The Clop ransomware group publicly claimed responsibility for breaching The Washington Post, adding the prominent American newspaper to its Tor-based data leak site. The group alleged that the breach resulted from the company's neglect of security responsibilities and threatened to leak stolen data if their demands were not met. Clop's standard tactic involves shaming victims who do not pay by posting accusatory messages and threatening public exposure of sensitive information.
Clop, a Russian-speaking ransomware-as-a-service operation, is known for targeting high-profile organizations using double-extortion methods. The group has a history of exploiting zero-day vulnerabilities in third-party software and leveraging initial-access brokers to infiltrate networks. The Washington Post incident follows a pattern of Clop's attacks on major entities, with the group using its leak site to pressure victims and maximize ransom payments.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Security reporting linked the Oracle EBS attacks to the financially motivated FIN11 group, which is associated with Clop ransomware operations. The suspected campaign involved data theft and extortion rather than only disruptive encryption.
Clop publicly claimed responsibility for breaching The Washington Post and added the newspaper to its Tor-based data leak site, threatening to publish stolen data. The group also criticized the organization over customer security in its posting.
The Oracle EBS attack wave impacted multiple organizations, including The Washington Post, Harvard University, Schneider Electric, Envoy Air, Wits University, and Emerson. The campaign was described as a large-scale intrusion leveraging a widely used enterprise platform to hit numerous victims.
Attackers began exploiting the Oracle E-Business Suite zero-day CVE-2025-61882 in a campaign that security experts said organizations should investigate for signs of compromise dating back to August. The activity enabled long-term access, credential theft, and data exfiltration from affected environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Clop ransomware group exploited a zero-day vulnerability in Oracle E-Business Suite to gain unauthorized access to the Washington Post's internal systems, resulting in the theft of sensitive personal and financial data belonging to nearly 10,000 current and former employees and contractors. The attackers accessed the environment between July 10 and August 22, 2025, and subsequently attempted to extort the company in late September after contacting the Post to claim responsibility for the breach. The compromised data included names, bank account numbers, routing numbers, and Social Security numbers, and the breach was confirmed after an internal investigation prompted by the extortion attempt. The Washington Post is one of several major organizations targeted in this campaign, with other confirmed victims including Envoy Air and GlobalLogic. Oracle has since disclosed the vulnerability, now tracked as CVE-2025-61882 and CVE-2025-61884, and released patches to address the issue. The incident highlights the risks posed by zero-day vulnerabilities in widely used enterprise software and the increasing trend of ransomware groups leveraging such flaws for data theft and extortion campaigns against high-profile targets.
Jun 29, 2026
The **Clop** ransomware operation has repeatedly targeted enterprise networks with intrusions that begin with phishing or exploitation of exposed systems, followed by manual lateral movement, credential theft, and domain-wide deployment. Reporting from ANSSI and AhnLab linked earlier campaigns to **TA505**, describing attacks in which operators used tools such as **Cobalt Strike** and **Mimikatz**, encrypted files with `.Clop` or `.CIop` extensions, and disrupted business operations at victims including **E-Land Group**, **Software AG**, and reportedly **Indiabulls Group**. Analysts also observed Clop using signed malware components, targeting Active Directory environments, stopping business-critical services before encryption, and in some cases preserving shadow copies depending on the variant. The group increasingly shifted from encryption-only attacks to **double extortion** and broader data-leak pressure tactics. Clop operators published stolen files on leak sites, demanded multimillion-dollar payments, contacted victims' customers directly to intensify pressure, and were tied to mass data-theft campaigns exploiting managed file transfer flaws such as **`CVE-2023-0669`** in **Fortra GoAnywhere MFT**, which was linked to theft from about 130 companies. More recent victim listings attributed to Clop include organizations in the **U.S., Canada, Peru, China, Taiwan, and Europe** across technology, manufacturing, retail, and other sectors, underscoring the group's continued global focus on enterprise-scale ransomware and data-breach operations.
Aug 15, 2026
The **Clop** ransomware and data-extortion operation has been linked to the TA505 ecosystem and has targeted organizations since 2019 through a mix of spear-phishing, stolen or compromised `RDP` credentials, and exploitation of internet-facing applications. Reporting on the group describes a shift from conventional ransomware deployment toward large-scale data theft and extortion, with victims pressured through leak-site exposure after sensitive information was exfiltrated. Clop has been repeatedly tied to attacks on managed file transfer software, including **Accellion FTA**, **GoAnywhere MFT**, and **MOVEit Transfer**. In the MOVEit campaign, attackers exploited a `SQL injection` flaw, deployed the **LEMURLOOT** web shell, and stole data from backend databases; broader intrusion activity associated with the group has also included **PowerShell** execution, privilege escalation, process injection, **Cobalt Strike** command-and-control, persistence via web shells, and encryption for impact in some cases.
Aug 6, 2026