{"uuid": "b6b708ff-e93b-4d73-824c-e2bf22f08fe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-34362", "type": "seen", "source": "https://t.me/hacking_Attack/105897", "content": "https://external-preview.redd.it/4C9YNE4fOGhU6dKO4-uKx5POmQRUQkuQglb-xzmof_A.jpg?width=640&crop=smart&auto=webp&s=1ce99fb5150cd1068870cec170522fbf704abf91 Updated as of June 14, 2023, 1:00 p.m. EST \u2013 Updates will be provided here.\n\nAll eyes have been on the \u201cClop\u201d ransomware group\u2019s data-leak website since the group took credit for attacks exploiting the MOVEit Transfer zero-day vulnerability (CVE-2023-34362). On June 6, 2023, the data-stealing extortionists stated that MOVEit Transfer victims had one week to contact the group and begin negotiations. The group threatened to publicly name and shame victims if no ransom was paid, and then leak their data on the data-leak site, >_CLOP^_-LEAKS.\n\nOn June 14, 2023, Clop named its first batch of 12 victims. No victim data has been leaked at the time of writing. As the ReliaQuest Threat Research Team continues to monitor the site for more updates, let\u2019s dig into what we\u2019ve seen so far.\n\n\u200b\n\nFigure: Clop data leakage website as of 1:00 PM ET on June 14, 2023 \n\nWhat We Know So Far\n\nAs of 1 p.m. EST on June 14, 2023, Clop has named 12 victims on its dark-website, but the group is actively adding new victims. So far, the majority of victims named are from the US. Other victims are from Switzerland, Canada, Belgium, and Germany. Expect to see more of Clop\u2019s new victims named throughout the day.Traditionally, Clop mostly targets organizations in the US, followed by Canada, the UK, and Germany. So far, the MOVEit Transfer victims have been consistent with Clop\u2019s previously targeted victims. Before the MOVEit Transfer leaks, most victims named on its data-leak website were involved in manufacturing (66 entities named), followed by technology (41) and healthcare (33) providers. We will continue to update on target sectors in the MOVEit Transfer leaks as victims are named.\n\nWhat We Know So Far\n\nAs of 1 p.m. EST on June 14, 2023, Clop has named 12 victims on its dark-website, but the group is actively adding new victims. So far, the majority of victims named are from the US. Other victims are from Switzerland, Canada, Belgium, and Germany. Expect to see more of Clop\u2019s new victims named throughout the day.\n\nTraditionally, Clop mostly targets organizations in the US, followed by Canada, the UK, and Germany. So far, the MOVEit Transfer victims have been consistent with Clop\u2019s previously targeted victims. Before the MOVEit Transfer leaks, most victims named on its data-leak website were involved in manufacturing (66 entities named), followed by technology (41) and healthcare (33) providers. We will continue to update on target sectors in the MOVEit Transfer leaks as victims are named.\n\n\u200b\n\nFigure: Clop's victims shown by country on ReliaQuest's GreyMatter platform \n\nClop Strays from Its MO\u2014Sort Of\nThis is the third time that Clop has exploited major vulnerabilities in enterprise managed file transfer (MFT) software [...]", "creation_timestamp": "2026-09-01T20:00:57.311018Z"}