Loading story…
The CL0P ransomware operation has added motorcycle manufacturer Harley-Davidson to its public extortion leak site, claiming it compromised the company. The listing was highlighted by the ransomNews threat-monitoring account, but Harley-Davidson and its parent organization have not publicly confirmed an intrusion or data theft.
CL0P provided no sample files, screenshots, ransom note, stolen-data archive, or technical indicators to substantiate the claim. The purported initial-access vector, affected business unit, scope and type of data allegedly stolen, and whether ransomware encryption occurred remain unknown; the incident should be treated as unconfirmed pending independent validation or an official disclosure.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
The CL0P ransomware operation allegedly added Harley-Davidson to its public extortion leak site and claimed it had compromised the motorcycle manufacturer. The ransomNews threat-monitoring account highlighted the unverified listing; no supporting evidence accompanied the claim, and Harley-Davidson had not publicly confirmed an intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Cl0p** ransomware operation used data stolen through the Accellion File Transfer Appliance compromise to extort dozens of organizations, escalating pressure by emailing victims’ customers directly and threatening publication on its **CL0P^-LEAKS** site. Reporting and threat research describe a highly organized group that demanded multimillion-dollar payments, offered time-based discounts, and in some cases removed victims from its leak portal after payment, while uncertainty remained over whether Cl0p conducted the initial Accellion intrusion or primarily monetized the stolen data. Security researchers linked Cl0p to **TA505/FIN11** activity, citing years of overlapping phishing, malware delivery, and ransomware deployment patterns. Prior campaigns used mass email lures, malicious Excel **XLM macros**, custom packers, and tailored Cl0p binaries compiled per victim with unique RSA keys and individualized ransom notes, suggesting direct operator control rather than a typical affiliate-only model. Analysts also noted Tor-based negotiation portals, double-extortion tactics combining encryption with data theft, and operational patterns consistent with a mature financially motivated criminal enterprise believed to avoid infecting systems configured for Russian or other CIS language settings.
Aug 15, 2026
The **Cl0p** extortion group continued broad data-theft campaigns by exploiting managed file-transfer and file-sharing platforms, with reporting tying the gang to attacks involving **Cleo LexiCom, VLTrader, and Harmony** through `CVE-2024-50623` and to a separate campaign targeting **CentreStack** file servers. Security researchers said the Cleo flaw allowed remote file upload and download and could lead to remote code execution, while Huntress reported active exploitation and warned that Cleo's patch in version `5.8.0.21` might be bypassed. Cl0p publicly claimed dozens of organizations affected by the Cleo breach and gave victims short deadlines to respond to ransom demands, consistent with the group's long-running pattern of stealing data before threatening publication on its leak site. The campaign's impact appeared to spread across sectors and geographies, including a report alleging that a **New Zealand poultry producer** was listed as a Cl0p victim. The activity fits Cl0p's established playbook of exploiting high-value file-transfer software vulnerabilities, as previously seen in the **Accellion FTA** and **MOVEit** mass-compromise waves, then pressuring organizations through leak-site postings and negotiation channels. The latest reporting indicates Cl0p remained focused on opportunistic exploitation of internet-facing file exchange systems to drive large-scale extortion operations rather than relying solely on traditional ransomware encryption.
Jun 29, 2026
The Clop ransomware group publicly claimed responsibility for breaching The Washington Post, adding the prominent American newspaper to its Tor-based data leak site. The group alleged that the breach resulted from the company's neglect of security responsibilities and threatened to leak stolen data if their demands were not met. Clop's standard tactic involves shaming victims who do not pay by posting accusatory messages and threatening public exposure of sensitive information. Clop, a Russian-speaking ransomware-as-a-service operation, is known for targeting high-profile organizations using double-extortion methods. The group has a history of exploiting zero-day vulnerabilities in third-party software and leveraging initial-access brokers to infiltrate networks. The Washington Post incident follows a pattern of Clop's attacks on major entities, with the group using its leak site to pressure victims and maximize ransom payments.
Jun 29, 2026