Loading story…
SysAid disclosed that the Cl0p ransomware group exploited a previously unknown flaw in its on-premise IT service management software, later tracked as CVE-2023-47246. The company issued a security notification for affected on-prem deployments, confirming active exploitation of the vulnerability and prompting customers to investigate for compromise and apply vendor guidance.
Follow-on research from SecurityScorecard found 576 internet-exposed IP addresses associated with 330 organizations in 36 countries that may have hosted vulnerable SysAid instances. Despite that broad exposure, the observed exploitation footprint appeared comparatively limited: researchers identified only one IP address that overlapped between potentially vulnerable-instance discovery and traffic linked to SysAid’s published indicators of compromise, suggesting a narrower campaign than some previous Cl0p zero-day operations while underscoring the group’s continued ability to weaponize newly discovered flaws.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
SysAid disclosed that the Cl0p ransomware group had exploited a previously unknown vulnerability in its on-premise IT Service Management software. The flaw was tracked as CVE-2023-47246, and SysAid provided indicators of compromise tied to the campaign.
SecurityScorecard analyzed Attack Surface Intelligence and partner NetFlow data to estimate exposure and victimization related to CVE-2023-47246. It identified 576 internet-exposed IP addresses across 330 organizations in 36 countries that may host affected SysAid instances, with only one IP overlapping with traffic to SysAid IoC-linked infrastructure in the reviewed sample.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Aug 15, 2026
Researchers disclosed a **pre-authentication remote code execution** chain affecting **SysAid On-Premise**, showing that unauthenticated attackers could reach code execution through the product’s support ticket-related functionality. The issue was publicly described by WatchTowr Labs and Summoning Team under the title **“SysOwned, Your Friendly Support Ticket,”** with **`CVE-2025-2775`** identified as a key part of the exploit chain alongside additional related flaws. The reports indicate the vulnerability chain can be triggered **without prior authentication**, making internet-exposed SysAid On-Premise deployments a high-risk target because attackers may be able to compromise servers directly through the application. Public disclosure by multiple security researchers increases the likelihood of defender scrutiny and attacker interest, particularly for organizations relying on on-premises help desk infrastructure.
Aug 1, 2026
The Cl0p ransomware group orchestrated a significant cyber extortion campaign by exploiting multiple vulnerabilities in Oracle E-Business Suite (EBS), including a previously unknown zero-day flaw tracked as CVE-2025-61882. According to reports, Cl0p leveraged these vulnerabilities to gain unauthorized access to EBS environments and exfiltrate large volumes of sensitive data from several organizations in August 2025. Security researchers, including Charles Carmakal, CTO at Mandiant, and CrowdStrike, confirmed that the attacks began on August 9, 2025, and were part of a coordinated effort targeting Oracle EBS customers. The attackers used the zero-day vulnerability to bypass security controls and escalate privileges within the affected systems, enabling them to steal confidential business information and customer data. The stolen data was then used as leverage in extortion attempts, with Cl0p threatening to publicly release or sell the information unless ransom demands were met. The campaign demonstrated a high level of sophistication, as Cl0p combined the exploitation of the zero-day with other known vulnerabilities to maximize their access and impact. Security advisories highlighted the critical nature of CVE-2025-61882, urging organizations to apply patches and implement additional security measures to protect their Oracle EBS deployments. The incident underscored the ongoing threat posed by ransomware groups exploiting enterprise software vulnerabilities, particularly those that remain unpatched or are not widely known. Oracle customers were advised to review their security posture, monitor for signs of compromise, and engage in threat hunting activities to detect potential intrusions. The attacks also prompted discussions about the importance of timely vulnerability disclosure and patch management in reducing the risk of large-scale data breaches. Industry experts noted that the Cl0p campaign was part of a broader trend of ransomware actors targeting business-critical applications to maximize extortion pressure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded by adding the Oracle EBS zero-day to its Known Exploited Vulnerabilities catalog, emphasizing the urgency of remediation. Organizations impacted by the breach faced significant operational and reputational risks, as well as potential regulatory consequences due to the exposure of sensitive data. The incident served as a stark reminder for enterprises to prioritize the security of their ERP systems and to stay vigilant against evolving ransomware tactics. Security vendors and incident response teams collaborated to share indicators of compromise and mitigation strategies, aiming to limit the spread and impact of the Cl0p campaign. The exploitation of Oracle EBS by Cl0p highlighted the persistent threat of zero-day attacks and the need for robust, layered defenses in enterprise environments.
Jul 12, 2026