pwn.watch: Cl0p incident updates

[critical] Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)

Mon, 20 Oct 2025 00:00:00 GMT

Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.

Status: closed · Patch: patched · Fixed in: Oracle Security Alert for CVE-2025-61882 (requires the October 2023 CPU as a prerequisite)

Latest updates:

2025-10-20: CISA adds the related EBS SSRF flaw CVE-2025-61884 to KEV (source)
2025-10-06: CISA adds CVE-2025-61882 to KEV
2025-10-04: Oracle publishes a Security Alert for CVE-2025-61882 (source)

CVEs: CVE-2025-61882

[critical] Cleo file transfer zero-days exploited by Clop for data theft

Tue, 17 Dec 2024 00:00:00 GMT

Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: 5.8.0.24 (Cleo, for CVE-2024-55956), 5.8.0.21 (Cleo, for CVE-2024-50623)

Latest updates:

2024-12-17: CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07) (source)
2024-12-16: Clop claims responsibility for the Cleo data-theft attacks (source)
2024-12-14: Cleo advisory: patch 5.8.0.24 for CVE-2024-55956 (source)

CVEs: CVE-2024-50623, CVE-2024-55956

[critical] MOVEit Transfer zero-day: Cl0p mass data theft

Fri, 16 Jun 2023 00:00:00 GMT

Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.

Status: closed · Patch: patched · Fixed in: 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), Older branches: see vendor advisory

Latest updates:

2023-06-16: Third round of fixes for CVE-2023-35708 after a public proof of concept (source)
2023-06-09: Progress fixes more SQL injection bugs found during code review (CVE-2023-35036) (source)
2023-06-07: CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505) (source)

CVEs: CVE-2023-34362, CVE-2023-35036, CVE-2023-35708

[critical] PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)

Thu, 11 May 2023 00:00:00 GMT

An improper access control bug in PaperCut NG/MF print management let unauthenticated attackers run code as SYSTEM. Fixes had shipped in March 2023, but unpatched servers were exploited from April. Microsoft linked it to Cl0p (Lace Tempest) and LockBit, and the Bl00dy gang hit schools with it.

Status: closed · Patch: patched · Fixed in: 20.1.7, 21.2.11, 22.0.9

Latest updates:

2023-05-11: CISA and FBI advisory AA23-131A: Bl00dy Ransomware Gang targeting education via PaperCut (source)
2023-04-21: PaperCut warns that unpatched servers are being exploited in the wild; CISA adds CVE-2023-27350 to KEV (source)

CVEs: CVE-2023-27350

[high] Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims

Fri, 10 Feb 2023 00:00:00 GMT

A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.

Status: closed · Patch: patched · Fixed in: 7.1.2

Latest updates:

2023-02-10: CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations (source)
2023-02-07: Emergency patch: GoAnywhere MFT 7.1.2 (source)
2023-02-01: Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console (source)

CVEs: CVE-2023-0669