{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T20:45:43.249Z",
  "tag": {
    "id": "cl0p",
    "label": "Cl0p",
    "isStack": false,
    "url": "https://pwn.watch/t/cl0p",
    "feed": "https://pwn.watch/t/cl0p/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 5
  },
  "incidents": [
    {
      "slug": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "title": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882",
      "json": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Oracle E-Business Suite",
      "tags": [
        "oracle",
        "cl0p",
        "zero-day",
        "rce",
        "data-breach",
        "extortion",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2025-61882"
      ],
      "affectedVersions": [
        "Oracle E-Business Suite 12.2.3 to 12.2.14"
      ],
      "fixedVersions": [
        "Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)"
      ],
      "startedAt": "2025-09-29",
      "closedAt": "2025-10-20",
      "updatedAt": "2025-10-20",
      "summary": "Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.",
      "xPost": null
    },
    {
      "slug": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "title": "Cleo file transfer zero-days exploited by Clop for data theft",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "json": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cleo Multiple Products",
      "tags": [
        "cleo",
        "zero-day",
        "cl0p",
        "file-transfer",
        "data-breach",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-50623",
        "CVE-2024-55956"
      ],
      "affectedVersions": [
        "Cleo Harmony, VLTrader and LexiCom before 5.8.0.24 (Cleo)"
      ],
      "fixedVersions": [
        "5.8.0.24 (Cleo, for CVE-2024-55956)",
        "5.8.0.21 (Cleo, for CVE-2024-50623)"
      ],
      "startedAt": "2024-12-03",
      "closedAt": "2024-12-17",
      "updatedAt": "2024-12-17",
      "summary": "Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "moveit-transfer-cl0p-mass-exploitation-2023",
      "title": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023",
      "json": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress MOVEit Transfer",
      "tags": [
        "progress",
        "moveit",
        "cl0p",
        "zero-day",
        "sql-injection",
        "data-breach",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-34362",
        "CVE-2023-35036",
        "CVE-2023-35708"
      ],
      "affectedVersions": [
        "CVE-2023-34362: before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) (NVD)",
        "CVE-2023-35036: before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), 2023.0.2 (15.0.2) (NVD)",
        "CVE-2023-35708: before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3) (NVD)"
      ],
      "fixedVersions": [
        "2021.0.8 (13.0.8)",
        "2021.1.6 (13.1.6)",
        "2022.0.6 (14.0.6)",
        "2022.1.7 (14.1.7)",
        "2023.0.3 (15.0.3)",
        "Older branches: see vendor advisory"
      ],
      "startedAt": "2023-05-27",
      "closedAt": "2023-06-16",
      "updatedAt": "2023-06-16",
      "summary": "Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.",
      "xPost": null
    },
    {
      "slug": "papercut-mf-ng-auth-bypass-cve-2023-27350",
      "title": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)",
      "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350",
      "json": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "PaperCut MF and PaperCut NG",
      "tags": [
        "papercut",
        "auth-bypass",
        "rce",
        "cl0p",
        "lockbit",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-27350"
      ],
      "affectedVersions": [
        "See vendor advisory"
      ],
      "fixedVersions": [
        "20.1.7",
        "21.2.11",
        "22.0.9"
      ],
      "startedAt": "2023-04-21",
      "closedAt": "2023-05-11",
      "updatedAt": "2023-05-11",
      "summary": "An improper access control bug in PaperCut NG/MF print management let unauthenticated attackers run code as SYSTEM. Fixes had shipped in March 2023, but unpatched servers were exploited from April. Microsoft linked it to Cl0p (Lace Tempest) and LockBit, and the Bl00dy gang hit schools with it.",
      "xPost": null
    },
    {
      "slug": "goanywhere-mft-cl0p-cve-2023-0669",
      "title": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669",
      "json": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortra GoAnywhere MFT",
      "tags": [
        "fortra",
        "goanywhere",
        "cl0p",
        "zero-day",
        "rce",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-0669"
      ],
      "affectedVersions": [
        "Before 7.1.2 (NVD)"
      ],
      "fixedVersions": [
        "7.1.2"
      ],
      "startedAt": "2023-02-01",
      "closedAt": "2023-02-10",
      "updatedAt": "2023-02-10",
      "summary": "A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-06",
      "title": "CISA adds CVE-2025-61882 to KEV",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-04",
      "title": "Oracle publishes a Security Alert for CVE-2025-61882",
      "body": null,
      "sourceUrl": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "oracle-ebs-cl0p-extortion-cve-2025-61882",
      "incidentTitle": "Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-29",
      "title": "Cl0p-branded extortion emails start arriving at executives",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation",
      "url": "https://pwn.watch/i/oracle-ebs-cl0p-extortion-cve-2025-61882"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-17",
      "title": "CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-16",
      "title": "Clop claims responsibility for the Cleo data-theft attacks",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-14",
      "title": "Cleo advisory: patch 5.8.0.24 for CVE-2024-55956",
      "body": null,
      "sourceUrl": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-13",
      "title": "CVE-2024-55956 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-55956",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-13",
      "title": "CISA added CVE-2024-50623 to the KEV catalog (federal deadline 2025-01-03)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-09",
      "title": "Huntress warns that fully patched 5.8.0.21 systems are still exploitable",
      "body": null,
      "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "Earliest exploitation Huntress observed against Cleo servers",
      "body": null,
      "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-27",
      "title": "CVE-2024-50623 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-16",
      "title": "Third round of fixes for CVE-2023-35708 after a public proof of concept",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35708",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-09",
      "title": "Progress fixes more SQL injection bugs found during code review (CVE-2023-35036)",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-35036",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-07",
      "title": "CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-02",
      "title": "CISA adds CVE-2023-34362 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-31",
      "title": "Progress discloses the critical MOVEit Transfer vulnerability and ships patches",
      "body": null,
      "sourceUrl": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "moveit-transfer-cl0p-mass-exploitation-2023",
      "incidentTitle": "MOVEit Transfer zero-day: Cl0p mass data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-27",
      "title": "Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft",
      "url": "https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023"
    },
    {
      "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350",
      "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-11",
      "title": "CISA and FBI advisory AA23-131A: Bl00dy Ransomware Gang targeting education via PaperCut",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a",
      "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350"
    },
    {
      "incident": "papercut-mf-ng-auth-bypass-cve-2023-27350",
      "incidentTitle": "PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-21",
      "title": "PaperCut warns that unpatched servers are being exploited in the wild; CISA adds CVE-2023-27350 to KEV",
      "body": null,
      "sourceUrl": "https://www.papercut.com/kb/Main/PO-1216-and-PO-1219",
      "url": "https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350"
    },
    {
      "incident": "goanywhere-mft-cl0p-cve-2023-0669",
      "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-10",
      "title": "CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669"
    },
    {
      "incident": "goanywhere-mft-cl0p-cve-2023-0669",
      "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-07",
      "title": "Emergency patch: GoAnywhere MFT 7.1.2",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669"
    },
    {
      "incident": "goanywhere-mft-cl0p-cve-2023-0669",
      "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-01",
      "title": "Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669"
    }
  ]
}