Cl0p

Security incidents tagged Cl0p. Newest first.

0 Cl0p incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Show 5 older incidents

CriticalPatched
Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)
Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.
Oracle E-Business SuiteClosed Oct 20, 2025updated Oct 20, 2025

Dec 3CriticalCleo file transfer zero-days exploited by Clop for data theftPatched
Cleo Multiple Products Patched
Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.
Open incident →CVE-2024-50623 · CVE-2024-55956

CriticalPatched
MOVEit Transfer zero-day: Cl0p mass data theft
Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.
Progress MOVEit TransferClosed Jun 16, 2023updated Jun 16, 2023

Apr 21CriticalPaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)Patched
PaperCut MF and PaperCut NG Patched
An improper access control bug in PaperCut NG/MF print management let unauthenticated attackers run code as SYSTEM. Fixes had shipped in March 2023, but unpatched servers were exploited from April. Microsoft linked it to Cl0p (Lace Tempest) and LockBit, and the Bl00dy gang hit schools with it.
Open incident →CVE-2023-27350

Feb 1HighFortra GoAnywhere MFT zero-day: Cl0p claims 130 victimsPatched
Fortra GoAnywhere MFT Patched
A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.
Open incident →CVE-2023-0669