Loading story…
The Cl0p extortion group continued broad data-theft campaigns by exploiting managed file-transfer and file-sharing platforms, with reporting tying the gang to attacks involving Cleo LexiCom, VLTrader, and Harmony through CVE-2024-50623 and to a separate campaign targeting CentreStack file servers. Security researchers said the Cleo flaw allowed remote file upload and download and could lead to remote code execution, while Huntress reported active exploitation and warned that Cleo's patch in version 5.8.0.21 might be bypassed. Cl0p publicly claimed dozens of organizations affected by the Cleo breach and gave victims short deadlines to respond to ransom demands, consistent with the group's long-running pattern of stealing data before threatening publication on its leak site.
The campaign's impact appeared to spread across sectors and geographies, including a report alleging that a New Zealand poultry producer was listed as a Cl0p victim. The activity fits Cl0p's established playbook of exploiting high-value file-transfer software vulnerabilities, as previously seen in the Accellion FTA and MOVEit mass-compromise waves, then pressuring organizations through leak-site postings and negotiation channels. The latest reporting indicates Cl0p remained focused on opportunistic exploitation of internet-facing file exchange systems to drive large-scale extortion operations rather than relying solely on traditional ransomware encryption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
A LinkedIn post from Curated Intelligence identified a Cl0p extortion campaign targeting CentreStack file servers, indicating another active intrusion vector associated with the group.
Cyber Daily published a report alleging that a New Zealand poultry producer had been hacked by Cl0p, marking a newly disclosed victim claim tied to the group's activity.
Cyberint says Huntress reported active exploitation of the Cleo vulnerability and released a proof of concept, while researchers warned that the vendor patch in Cleo version 5.8.0.21 could be bypassed.
Cyberint describes a renewed Cl0p campaign tied to exploitation of Cleo LexiCom, VLTrader, and Harmony via CVE-2024-50623, a zero-day enabling remote file upload and download that can lead to remote code execution.
According to Cyberint, 27 victims were published by Cl0p in 2024, a sharp drop from the prior year's breach volume.
Cyberint reports that 2023 saw 384 successful breaches attributed to Cl0p, highlighting the scale of the group's operations that year.
The Cyberint reference states that Cl0p has been active since at least 2019 and is widely assessed as a successor to CryptoMix.
On December 24, Cl0p claimed that 66 companies affected by the Cleo breach had 48 hours to respond to ransom demands, adding that the total number of victims could be higher because only contacted but unresponsive firms were listed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyberdaily.au
Open sourcecyberint.com
Open sourcelinkedin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Jul 2, 2026
Attackers exploited vulnerabilities in the legacy **Accellion File Transfer Appliance (FTA)** and deployed a file-downloading web shell to steal data from organizations worldwide, triggering breaches at telecom, legal, financial, and other enterprises. Reporting tied the campaign to the **Clop** ransomware operation, with additional analysis suggesting overlap with **FIN11**, as victims including **Singtel** and a global law firm said their incidents stemmed from compromise at the file-sharing provider rather than direct intrusion into their own networks. The intrusions were followed by aggressive extortion, including public leak threats and, in at least one case, the exposure of bank employee personal data to pressure payment. Subsequent government warnings said cybersecurity agencies had observed active exploitation of Accellion vulnerabilities, reinforcing the incident as part of Clop’s broader pattern of targeting managed file transfer products to conduct large-scale data theft and shaming-based extortion rather than relying solely on encryption.
Jun 29, 2026
Attackers are actively exploiting critical vulnerabilities in **Cleo Harmony**, **Cleo VLTrader**, and **Cleo LexiCom** managed file transfer software, including `CVE-2024-50623` and the related `CVE-2024-55956`. The flaws affect versions prior to **5.8.0.24** and allow remote, unauthenticated attackers to upload arbitrary files, execute commands, access sensitive data, and alter systems. Security researchers and vendor advisories reported in-the-wild exploitation, with public proof-of-concept exploit code increasing the risk of broad compromise. Intrusions linked to the campaign have been associated with **Clop** data-theft activity, and exploitation was observed from at least early December 2024. Defenders were urged to immediately upgrade affected Cleo products to **5.8.0.24 or later**, restrict external access to exposed file transfer servers, and review logs, autorun locations, and other persistence points for suspicious files or commands. The incident adds Cleo software to the list of heavily targeted file transfer platforms exploited for large-scale enterprise breaches.
Jul 24, 2026