#cl0p — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #cl0p, aggregated by home.social.
-
Data Extortion Groups Intensify Pressure On Global Aerospace Supply Chains
Cyber threats targeting the global aviation and aerospace sector are rapidly evolving, with ransomware, identity-based intrusions, and platform-level disruptions becoming dominant attack vectors. The interconnected nature of this ecosystem, combined with time-sensitive operations and complex third-party dependencies, makes it highly attractive to threat actors. Shared airport IT platforms represent critical single points of failure, as demonstrated by the September 2025 ransomware attack on Collins Aerospace MUSE system that disrupted major European airports including Heathrow, Brussels, Berlin, and Dublin. Major ransomware groups like LockBit and Cl0p maintain heavy focus on aviation suppliers, while advanced persistent threat groups including Refined Kitten, Wicked Panda, and Fancy Bear conduct strategic espionage targeting intellectual property, aircraft design data, and military aviation intelligence. Emerging threats include vulnerabilities in regional airports, aviation SaaS platforms, and satellite ...
Pulse ID: 69fb173ad966425db9cad018
Pulse Link: https://otx.alienvault.com/pulse/69fb173ad966425db9cad018
Pulse Author: AlienVault
Created: 2026-05-06 10:26:02Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Cl0p #CyberSecurity #Espionage #Europe #Extortion #InfoSec #LockBit #Military #OTX #OpenThreatExchange #RAT #RansomWare #SupplyChain #bot #AlienVault
-
Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
#CVE_2024_21762 #CVE_2021_27877 #CVE_2021_27878 #CVE_2021_40539 #CVE_2024_55591 #CVE_2019_6693 #CVE_2024_40766 #CVE_2023_4966 #CVE_2025_53771 #CVE_2025_53770 #CVE_2025_31324 #CVE_2024_3400 #CVE_2025_31161 #QilinGroup #QilinRansomware #Akira #REDBIKE #Cl0p #PLAY #SafePay #INCRansomware #RansomHub #DragonForce #UNC6016 #UNC2465
https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/ -
Food and Ag-ISAC reports 82% surge in ransomware attacks as Qilin, Akira and CL0P lead campaigns against sector
New data from the Food and Agriculture Information Sharing and Analysis Center (Food and Ag-ISAC) shows ra…
#dining #cooking #diet #food #Food #Akira #Cl0p #DDoS #FoodandAg-ISAC #foodandagriculture #Lynx #play #Qilin #ransomwareattacks
https://www.diningandcooking.com/2510429/food-and-ag-isac-reports-82-surge-in-ransomware-attacks-as-qilin-akira-and-cl0p-lead-campaigns-against-sector/ -
Food and Ag-ISAC reports 82% surge in ransomware attacks as Qilin, Akira and CL0P lead campaigns against sector https://www.diningandcooking.com/2510429/food-and-ag-isac-reports-82-surge-in-ransomware-attacks-as-qilin-akira-and-cl0p-lead-campaigns-against-sector/ #Akira #Cl0p #DDoS #food #FoodAndAgISAC #FoodAndAgriculture #Lynx #play #Qilin #RansomwareAttacks
-
CW: NSFW
-
Cl0p - or Clop, depending on you talk to - is back targeting Australian companies again with cyber extortion attempts, though at this stage it may all be a bluff.
-
So for many folks - cancelling their Hilton Honors membership was a way to let the chain know that their handling of the situation in Minneapolis was unacceptable.
Nice techdirt article and template for those perhaps looking to do the same https://www.techdirt.com/2026/01/07/dear-hilton-lose-my-number/
Now it appears that the #Cl0p folks claim to have breached Hilton.com - but have yet to publish any data. After following cl0p in a previous life, my estimate is that they're found some novel way to breach a specific technology that many of these companies have deployed, have been immensely successful in compromising a large number of them, and are now inundated with data that they have to wade through.
(first detection I am aware of was at 2026-01-25 15:14:45 UTC)
However - I do have confidence that Hilton will not pay them and the data will [eventually] be published to The Dark Web™. (Or more accurately - probably via BitTorrent)
(you can point your TOR enabled browser of choice to http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad[.]onion/hilton-com for any updates - the attached screenshot is from there)
What that means is that for folks that did cancel their membership is that their data is likely going to be leaked to various and sundry criminal elements and probably lead to increased cyber-type headaches such as spam, phishing and identity theft for anyone involved. (Note that this is also true for anyone who did not cancel their Hilton Honors membership.)
Going to preface this next bit by indicating that I'm not a lawyer nor do I play one on TV - and that no sane person should take legal advice from me or anyone else who is not a practicing lawyer lest you end up being the star of one of those "sovereign citizen" clips on youtube.
Now - there probably is a way to help translate at least some of this into pain for the Hilton chain. If you are in the EU - GDPR does provide a lot of leverage for individuals in terms of data and privacy protection. As data breaches are more common - and you do live in Europe - you may already have some tools to point in Hilton's general direction.
(Of note as well is that the GDPR 72-hour notifications window starts once the company is "aware" of the breach - and there may be some convoluted verbiage on what that actually means, but your report/request as a European person may be what actually starts that clock.)
If you don't live in Europe - the folks at DLA Piper have a fairly substantial breakdown of breach requirements by country - but may give you some pointers in keywords to be using when communicating with their agents based on your locale.
https://www.dlapiperdataprotection.com/?t=breach-notification
Additionally - if you have the time (and patience) to deal with someone on the phone - this is is the sort of inquiry that will need to be escalated to a human (i.e. will cost Hilton money) to answer.
https://www.hilton.com/en/help-center/global-phone-numbers/
You may also want to reach out via any of the emails listed in the techdirt article above
This may be of some assistance in providing - at the very least - some time and cycle burn for their public relations folks, who are probably also very busy trying to put some spin on some of their other PR disasters.
Some questions that you may want to ask anyone that you get a hold of via phone, email, or carrier pigeon:
- Are you aware that the ransomware gang cl0p has claimed that they have breached Hilton.com?
- Can you confirm that this breach notification is legitimate?
- Do you have an idea of what data was allegedly stolen, how much and when?
- Has the vulnerability that led to this alleged breach been identified and remediated?
- Is there any personally identifiable information (PII) included in the corpus?
- Is my PII included in that corpus?
- Is there a plan to notify affected individuals and/or provide remediation or credit monitoring?
-
#CISA-Katalog attackierter Schwachstellen wuchs 2025 um 20 Prozent | Security https://www.heise.de/news/CISA-Katalog-attackierter-Schwachstellen-wuchs-2025-um-20-Prozent-11130460.html #Malware #Ransomware #Cl0p #CitrixBleed2
-
Korean Air confirms 30,000 of its employee records have been stolen after the Cl0p ransomware gang leaked the data online, following exploitation of an Oracle EBS vulnerability.
Read: https://hackread.com/30000-korean-air-employee-cl0p-leaks-data/
#CyberSecurity #DataBreach #Cl0p #KoreanAir #OracleEBS #InfoSec
-
Auto Parts Giant LKQ Confirms Oracle EBS Breach https://www.securityweek.com/auto-parts-giant-lkq-confirms-oracle-ebs-breach/ #OracleEBusinessSuite #DataBreaches #carhacking #databreach #Oraclehack #Cl0p #LKQ
-
Barts Health NHS confirms Cl0p ransomware breached its invoicing system by exploiting an Oracle EBS flaw. The organisation is now taking legal action against the notorious Russian-speaking group.
Read: https://hackread.com/barts-health-nhs-cl0p-ransomware-data-breach/
-
Cyberbande #cl0p behauptet zahlreiche weitere Datendiebstähle | Security https://www.heise.de/news/Cyberbande-cl0p-behauptet-zahlreiche-weitere-Datendiebstaehle-11087148.html #Datenschutz #privacy #DataLeak #Datenleck #Canon #Michelin #Mazda #Broadcom
-
Canon Says Subsidiary Impacted by Oracle EBS Hack https://www.securityweek.com/canon-says-subsidiary-impacted-by-oracle-ebs-hack/ #OracleE-BusinessSuite #DataBreaches #Oraclehack #Canon #Cl0p
-
#WashingtonPost: Daten von rund 10.000 Menschen bei IT-Einbruch kopiert | Security https://www.heise.de/news/IT-Vorfall-bei-Washington-Post-Daten-von-knapp-10-000-Leuten-abgeflossen-11081532.html #Datenschutz #privacy #DataLeak #Datenleck #Cl0p
-
Angreifer steigen über #ZeroDay-Lücke bei #Logitech ein | Security https://www.heise.de/news/Angreifer-steigen-ueber-Zero-Day-Luecke-bei-Logitech-ein-11080333.html #DataLeak #Datenleck #Datenschutz #privacy #Cl0p
-
Mazda Says No Data Leakage or Operational Impact From Oracle Hack https://www.securityweek.com/mazda-says-no-data-leakage-or-operational-impact-from-oracle-hack/ #OracleE-BusinessSuite #DataBreaches #Oraclehack #Mazda #Cl0p
-
Cox Confirms Oracle EBS Hack as Cybercriminals Name 100 Alleged Victims https://www.securityweek.com/cox-confirms-oracle-ebs-hack-as-cybercriminals-name-100-alleged-victims/ #OracleEBusinessSuite #DataBreaches #databreach #Oraclehack #Ransomware #Featured #Cl0p #Cox
-
Cybergang #cl0p will Daten von #Carglass, #Fluke und #NHS erbeutet haben | Security https://www.heise.de/news/Datenlecks-Cybergang-cl0p-will-Daten-von-Carglass-Fluke-und-NHS-erbeutet-haben-11079113.html #DataLeak #Datenleck #Datenschutz #privacy #CyberCrime
-
Logitech confirma el robo de datos tras un ataque del ransomware Clop https://blog.elhacker.net/2025/11/logitech-confirma-robo-datos-clop-ransomware.html #ransomware #dataleak #logitech #cl0p
-
Logitech Confirms Data Breach Following Designation as Oracle Hack Victim https://www.securityweek.com/logitech-confirms-data-breach-following-designation-as-oracle-hack-victim/ #OracleEBusinessSuite #DataBreaches #databreach #Oraclehack #Ransomware #Featured #Logitech #Cl0p
-
Washington Post Says Nearly 10,000 Employees Impacted by Oracle Hack https://www.securityweek.com/washington-post-says-nearly-10000-employees-impacted-by-oracle-hack/ #OracleEBusinessSuite #TheWashingtonPost #DataBreaches #Ransomware #databreach #Cl0p
-
NHS Investigating Oracle EBS Hack Claims as Hackers Name Over 40 Alleged Victims https://www.securityweek.com/nhs-investigating-oracle-ebs-hack-claims-as-hackers-name-over-40-alleged-victims/ #OracleEBusinessSuite #DataBreaches #databreach #healthcare #Oraclehack #Ransomware #Cl0p #NHS
-
Cl0p Ransomware Lists NHS UK as Victim, Days After Washington Post Breach https://hackread.com/cl0p-ransomware-nhs-uk-washington-post-breach/ #WashingtonPost #CyberAttacks #CyberCrime #databreach #Ransomware #OracleEbs #Security #Oracle #Cl0p #NHS
-
NEW: Cl0p ransomware claims NHS UK breach days after breaching The Washington Post, stealing 183GB of data through Oracle EBS flaws, a breach confirmed by the Post.
Read: https://hackread.com/cl0p-ransomware-nhs-uk-washington-post-breach/
-
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site https://www.securityweek.com/nearly-30-alleged-victims-of-oracle-ebs-hack-named-on-cl0p-ransomware-site/ #OracleEBusinessSuite #DataBreaches #Ransomware #databreach #Oraclehack #dataleak #Featured #Cl0p
-
Cyberangriff - ermöglicht durch gemeinsame Schwachstelle in der Oracle E‑Busines‑Suite (EBS)?
Die russischsprachige Ransomware-Gruppe Cl0p_‑Leaks erpresst aktuell mehrere zahlungskräftige Unternehmen/Institutionen, darunter Logitech, die Washington Post oder auch die Harvard‑Universität. Ausgangspunkt scheint eine Schwachstelle in Oracles E‑Busines‑Suite (EBS) zu sein.
Wenn die Angegriffenen nicht binnen 24h zahlen, werden die Daten zum Verkauf angeboten oder veröffentlicht oder beides. Mehr als unangenehm für die Betroffenen.
https://www.24heures.ch/logitech-le-fabricant-lausannois-vise-par-une-cyberattaque-dampleur-936720204778 -
The Washington Post confirms a breach via Oracle’s E-Business Suite.
CL0P ransomware group claims the attack - part of a global campaign exploiting EBS vulnerabilities.
https://www.technadu.com/washington-post-confirms-oracle-e-business-suite-data-breach-cl0p-ransomware-claims-the-attack/612806/ -
Cl0p ransomware adds Logitech to its list of alleged victims - reportedly exploiting an Oracle E-Business Suite zero-day as part of a campaign hitting 9+ ICT & manufacturing firms.
🔗 https://www.technadu.com/cl0p-ransomware-claims-data-breach-of-swiss-tech-giant-logitech/612725/ -
Industrial Giants Schneider Electric and Emerson Named as Victims of Oracle Hack https://www.securityweek.com/industrial-giants-schneider-electric-and-emerson-named-as-victims-of-oracle-hack/ #OracleEBusinessSuite #SchneiderElectric #DataBreaches #Industrial #Oraclehack #dataleak #Emerson #ICS/OT #Cl0p
-
Envoy Air, a regional carrier of American Airlines, confirms it was impacted in the latest zero-day exploit of Oracle E-Business Suite by the #CL0P extortion gang. Limited business info exposed, no customer data or flights impacted.
Read: https://hackread.com/envoy-air-american-airlines-oracle-ebs-0-day-breach-cl0p/
-
Cl0p-Linked Gang Attempts to Extort Oracle E-Business Customers https://hackread.com/cl0p-extort-oracle-e-business-customers/ #Cybersecurity #CyberAttacks #CyberAttack #CyberCrime #Ransomware #Security #Mandiant #Google #FIN11 #Cl0p
-
Alert: a group claiming ties to Cl0p is sending extortion emails to Oracle E-Business Suite users. Mandiant and Google’s threat teams are investigating.
Read: https://hackread.com/cl0p-extort-oracle-e-business-customers/
#OracleEBS #Cybersecurity #Ransomware #Cl0p #Mandiant #Google -
American National Insurance Company (ANICO) Data Leaked in MOVEit Breach – Source:hackread.com https://ciso2ciso.com/american-national-insurance-company-anico-data-leaked-in-moveit-breach-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #DataBreach #Ransomware #Insurance #Hackread #security #MOVEit #ANICO #Leaks #Cl0p #USA
-
🚨 Over 270,000+ records from American National Insurance Company (#ANICO) leaked online, linked to the 2023 MOVEit hack. Sensitive customer & employee info exposed.
Read: https://hackread.com/american-national-insurance-company-anico-moveit-breach/
-
American National Insurance Company (ANICO) Data Leaked in MOVEit Breach https://hackread.com/american-national-insurance-company-anico-moveit-breach/ #databreach #Ransomware #Insurance #Security #MOVEit #Leaks #ANICO #Cl0p #USA
-
Cl0p Ransomware Exploits Cleo Vulnerability, Threatens Data Leaks – Source:hackread.com https://ciso2ciso.com/cl0p-ransomware-exploits-cleo-vulnerability-threatens-data-leaks-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #CyberAttacks #CyberAttack #Ransomware #Hackread #security #MOVEit #Cl0p
-
Cl0p Ransomware Exploits Cleo Vulnerability, Threatens Data Leaks https://hackread.com/cl0p-ransomware-exploits-cleo-vulnerability-data-leaks/ #Cybersecurity #Vulnerability #CyberAttacks #CyberAttack #Ransomware #Security #MOVEit #Cl0p
-
Data Vigilante Leaks 772K Employee Records from Top Firms and 12.3M-Row Database – Source:hackread.com https://ciso2ciso.com/data-vigilante-leaks-772k-employee-records-from-top-firms-and-12-3m-row-database-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #Vulnerability #CyberAttack #Ransomware #Hackread #Nam3L3ss #security #MOVEit #Leaks #Cl0p
-
Data Vigilante Leaks 772K Employee Records from Top Firms and 12.3M-Row Database https://hackread.com/data-vigilante-leaks-772k-employee-record-database/ #Cybersecurity #Vulnerability #CyberAttack #Ransomware #Security #Nam3L3ss #MOVEit #Leaks #LEAKS #Cl0p
-
#Cl0p has listed Texas Wesleyan University. #TWU #ransomware
-
CIBC National Trust of Chicago, a US division of the Canadian Imperial Bank of Commerce (CIBC) have notified their Private Wealth Management customers that their data have been stolen when their third party service provider, Pension Benefit Information (PBI) was hit by a cyberattack in May.
The PBI breach was one of the many organization that fell victim to the much wider MOVEIt breaches by the Cl0p ransomware gang.
There's no word on how many clients were affected & how much information was stolen as the letter seen by IT World Canada was heavily redacted.
https://www.itworldcanada.com/article/u-s-division-of-cibc-apparently-sideswiped-by-moveit-hack/545256
#infosec #cybersecurity #CIBC #databreach #banking #datasecurity #ransomware #MOVEIt #Cl0p -
The personal details of #StandardInsurance customers were exposed by the #MOVEit Transfer attacks and have impacted over 300,000 people.
#NTTData #PBI #ransomware #databreach #Cl0p #cybersecurity #infosechttps://cybernews.com/news/standard-insurance-ntt-data-customers-exposed/
-
Beauty products giant, Estée Lauder was breached by the #ALPV (aka #BlackCat) & #Cl0p #ransomware gangs in separate breaches.
#infosec #cybersecurity #databreach #dataloss #breach #EsteeLauder
https://www.bleepingcomputer.com/news/security/est-e-lauder-beauty-giant-breached-by-two-ransomware-gangs -
Another week, another newsletter - catch up on the week's infosec news here:
https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423
Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.
#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.
#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign
#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?
The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.
Have a great week ahead folks, I hope this newsletter proves helpful!
https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423
#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD
-
Another week, another newsletter - catch up on the week's infosec news here:
https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423
Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.
#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.
#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign
#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?
The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.
Have a great week ahead folks, I hope this newsletter proves helpful!
https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423
#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD
-
Another week, another newsletter - catch up on the week's infosec news here:
https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423
Researchers have found that nearly two years on, 2 in 3 installs of #Apache #Superset are still using default Flask Secret Keys - a configuration flaw which would allow an attacker to forge session cookies and access said servers with full administrative privileges.
#Kritec is a commodity #skimmer found installed on compromised #Magecart sites, with its code heavily obfuscated and customised to match the site's aesthetic in order to con users out of credit card details.
#FIN7 look to be popping instances of the #Veeam backup software that are unpatched for a recent vulnerability; a revised #ViperSoftX #infostealer now targets #1password and #keepass password vaults, and #TA505 deliver a new infostealer through a #GoogleAds campaign
#LockBit & #CL0P ransomware affiliates have been abusing a month-old vulnerability in the #PaperCut print management software to drop ransomware. With the cat out of the bag, security researchers have decided now is a great time to drop a PoC exploit on Github - I mean, why not let the skiddies get in on the action too, right?
The #blueteam have some great research worth reading on #Smishing via #AWS; detections for #SliverC2 and different implementations of #PsExec, as well as #Sigma integration for #SentinelOne and a #KQL hack for monitoring LOLDrivers.
Have a great week ahead folks, I hope this newsletter proves helpful!
https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-240423-300423
#infosec #cyber #news #newsletter #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #affiliate #dfir #soc #threatintel #threatintelligence #threathunting #detection #threatdetection #detectionengineering #flask #python #fraud #malvertising #clop #PoC #exploit #securityresearch #LOLBAS #LOLBIN #BYOVD