Loading story…
SentinelLABS reported the first observed Linux ELF variant of Cl0p ransomware, linking it to an attack that likely hit a university in Colombia in late 2022. The malware mirrors parts of Cl0p’s Windows logic but appears less mature, lacking features such as exclusion logic, command-line options, and RSA-based protection for encryption keys. Researchers said the victim’s data was later posted to Cl0p’s onion leak site, showing the intrusion combined file encryption with data extortion.
The Linux strain contains a critical cryptographic flaw that allows recovery of encrypted files without paying the ransom. SentinelLABS found the malware uses a hardcoded RC4 master key to wrap per-file RC4 keys, and also leaks stack and file metadata into generated key files. Based on those weaknesses, the researchers released a free decryptor and warned that ransomware targeting Linux systems continues to grow across server and cloud environments.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
SentinelLABS disclosed that the Linux Cl0p variant contains a hardcoded RC4 master key flaw that allows victim files to be decrypted without paying the ransom, and published a free decryptor for affected victims.
The report states that data from the victim associated with the Linux Cl0p incident was leaked on Cl0p's onion site on January 5.
Researchers reported the first observed Linux ELF variant of Cl0p ransomware, identifying the sample on December 26, 2022. The variant was described as less mature than the Windows version but similar in overall logic.
SentinelLABS linked the Linux ELF variant of Cl0p ransomware to a broader attack that likely targeted a university in Colombia around December 24, 2022.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a Linux-targeting variant of **RansomEXX**, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with **AES-256 in ECB mode** and appends an **RSA-4096**-encrypted AES key to each file, using cryptographic functions from the `mbedtls` library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family. The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
Aug 15, 2026
The **Cl0p** ransomware operation used data stolen through the Accellion File Transfer Appliance compromise to extort dozens of organizations, escalating pressure by emailing victims’ customers directly and threatening publication on its **CL0P^-LEAKS** site. Reporting and threat research describe a highly organized group that demanded multimillion-dollar payments, offered time-based discounts, and in some cases removed victims from its leak portal after payment, while uncertainty remained over whether Cl0p conducted the initial Accellion intrusion or primarily monetized the stolen data. Security researchers linked Cl0p to **TA505/FIN11** activity, citing years of overlapping phishing, malware delivery, and ransomware deployment patterns. Prior campaigns used mass email lures, malicious Excel **XLM macros**, custom packers, and tailored Cl0p binaries compiled per victim with unique RSA keys and individualized ransom notes, suggesting direct operator control rather than a typical affiliate-only model. Analysts also noted Tor-based negotiation portals, double-extortion tactics combining encryption with data theft, and operational patterns consistent with a mature financially motivated criminal enterprise believed to avoid infecting systems configured for Russian or other CIS language settings.
Aug 15, 2026
LockBit 5.0 ransomware has emerged as a significant evolution in the ransomware landscape, introducing advanced cross-platform capabilities that enable it to target Windows, Linux, and VMware ESXi environments simultaneously. Security researchers from Trend Micro have analyzed the new variant and warn that it is considerably more dangerous than previous versions due to its technical enhancements and expanded reach. The Windows variant of LockBit 5.0 now utilizes DLL reflection for payload loading and incorporates aggressive anti-analysis packing, making detection and analysis more challenging for defenders. The Linux version is engineered to accept command-line directives, allowing attackers to specify which directories and file types to encrypt, thereby increasing the precision and impact of attacks. For ESXi environments, the ransomware is capable of encrypting virtual machines directly, threatening the core of enterprise virtualization infrastructure. Each encrypted file is marked with a random 16-character extension, a tactic designed to complicate data recovery and frustrate incident response efforts. The modular architecture of LockBit 5.0, combined with stealthy encryption routines, enables attackers to paralyze entire enterprise stacks, from endpoints to critical servers and hypervisor hosts. This cross-platform strategy reflects LockBit’s ongoing efforts to maximize disruption and ransom leverage by hitting organizations at multiple layers of their IT infrastructure. The release of LockBit 5.0 follows a major law enforcement operation earlier in the year, known as Operation Cronos, in which UK and US authorities seized LockBit’s servers, domain infrastructure, and decryption keys. Despite these efforts to dismantle the group, LockBit has demonstrated resilience by reactivating its affiliate network and launching this new, more sophisticated variant. The technical improvements in obfuscation and evasion techniques make LockBit 5.0 particularly challenging for security teams to detect and mitigate. The ransomware’s ability to operate across different operating systems means that organizations must ensure comprehensive security coverage, including endpoints, servers, and virtualization platforms. The evolution of LockBit into a cross-platform threat underscores the increasing complexity of the ransomware ecosystem and the need for robust, multi-layered defense strategies. Security experts recommend that organizations review and strengthen their backup, segmentation, and incident response plans in light of LockBit 5.0’s capabilities. The rapid adaptation and technical sophistication of LockBit 5.0 highlight the ongoing arms race between ransomware operators and defenders. As LockBit continues to evolve, it is expected that other ransomware groups may follow suit, further raising the stakes for enterprise cybersecurity. The emergence of LockBit 5.0 serves as a stark reminder of the persistent and adaptive nature of ransomware threats facing organizations worldwide.
Jun 29, 2026