Loading story…
Attackers exploited vulnerabilities in the legacy Accellion File Transfer Appliance (FTA) and deployed a file-downloading web shell to steal data from organizations worldwide, triggering breaches at telecom, legal, financial, and other enterprises. Reporting tied the campaign to the Clop ransomware operation, with additional analysis suggesting overlap with FIN11, as victims including Singtel and a global law firm said their incidents stemmed from compromise at the file-sharing provider rather than direct intrusion into their own networks.
The intrusions were followed by aggressive extortion, including public leak threats and, in at least one case, the exposure of bank employee personal data to pressure payment. Subsequent government warnings said cybersecurity agencies had observed active exploitation of Accellion vulnerabilities, reinforcing the incident as part of Clop’s broader pattern of targeting managed file transfer products to conduct large-scale data theft and shaming-based extortion rather than relying solely on encryption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
A global law firm later attributed a data breach to the earlier compromise of its file-sharing provider, reflecting the long tail of victim disclosures from the Accellion incident. The statement showed that organizations continued to trace downstream breaches back to the FTA campaign.
Clop escalated pressure on victims by publishing personal data of bank employees as part of its extortion efforts tied to Accellion-related breaches. The leak demonstrated the group's willingness to publicly expose stolen information to force payment.
Government cybersecurity agencies published a warning about exploitation of Accellion vulnerabilities, underscoring the broader significance of the campaign and the risks posed by legacy managed file transfer products. The alert placed the Accellion incidents in the context of recurring exploitation activity against file transfer software.
Mandiant said Accellion FTA attacks and related extortion activity were likely the work of FIN11, a financially motivated group associated with Clop operations. The assessment refined attribution by linking the exploitation to a specific threat actor cluster.
Reporting tied the wave of Accellion-related data theft and extortion incidents affecting multiple organizations to the Clop ransomware operation. This marked a major attribution development connecting the campaign to a known cybercriminal group.
Singapore telecommunications provider Singtel disclosed that a breach of its third-party file-sharing system, Accellion FTA, affected customer information. The incident highlighted that downstream organizations using the platform were suffering data exposure.
GuidePoint Security described a targeted campaign against Accellion FTA in which attackers deployed a web shell used to download files from compromised appliances. The reporting added technical detail on how the intrusions were being carried out.
After the initial disclosure, Accellion found additional vulnerabilities affecting FTA and released further patches in late December 2020 and January 2021. The expanding scope showed attackers were chaining multiple flaws against the appliance.
Accellion disclosed that its legacy File Transfer Appliance (FTA) was being targeted in zero-day attacks and issued an initial patch for affected customers. The incidents involved exploitation of the end-of-life file transfer product to gain unauthorized access to stored files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcebleepingcomputer.com
Open sourcecshub.com
Open sourcerisky.biz
Open sourceguidepointsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Cl0p** extortion group continued broad data-theft campaigns by exploiting managed file-transfer and file-sharing platforms, with reporting tying the gang to attacks involving **Cleo LexiCom, VLTrader, and Harmony** through `CVE-2024-50623` and to a separate campaign targeting **CentreStack** file servers. Security researchers said the Cleo flaw allowed remote file upload and download and could lead to remote code execution, while Huntress reported active exploitation and warned that Cleo's patch in version `5.8.0.21` might be bypassed. Cl0p publicly claimed dozens of organizations affected by the Cleo breach and gave victims short deadlines to respond to ransom demands, consistent with the group's long-running pattern of stealing data before threatening publication on its leak site. The campaign's impact appeared to spread across sectors and geographies, including a report alleging that a **New Zealand poultry producer** was listed as a Cl0p victim. The activity fits Cl0p's established playbook of exploiting high-value file-transfer software vulnerabilities, as previously seen in the **Accellion FTA** and **MOVEit** mass-compromise waves, then pressuring organizations through leak-site postings and negotiation channels. The latest reporting indicates Cl0p remained focused on opportunistic exploitation of internet-facing file exchange systems to drive large-scale extortion operations rather than relying solely on traditional ransomware encryption.
Jun 29, 2026
The Clop ransomware group has initiated a widespread data extortion campaign targeting Internet-exposed Gladinet CentreStack and Triofox file servers. Attackers are exploiting multiple vulnerabilities, including CVE-2025-11371 (an unauthenticated local file inclusion flaw), CVE-2025-14611 (hardcoded cryptographic keys), and CVE-2025-12480 (a critical remote code execution vulnerability in Triofox). These vulnerabilities allow unauthorized access, file retrieval, and even remote code execution, enabling Clop to steal sensitive corporate data and leave ransom notes on compromised systems. Security researchers and incident responders have observed active exploitation across at least 200 unique IP addresses, with evidence that both zero-day and unpatched n-day vulnerabilities are being leveraged. Gladinet CentreStack and Triofox are widely used by businesses for secure file storage and sharing, making the impact of these attacks potentially significant. The Clop group’s campaign follows their established pattern of targeting file transfer and sharing solutions, having previously compromised platforms such as MOVEit, GoAnywhere, and Oracle EBS. Security updates have been released by Gladinet to address some of the exploited flaws, but the ongoing attacks highlight the importance of timely patching and monitoring of Internet-facing file sharing infrastructure. Technical analysis by VulnCheck and Mandiant has provided detailed insights into the exploitation methods, emphasizing the complexity and sophistication of the attack chain.
Jun 29, 2026
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Jul 2, 2026