{"uuid": "bd18787d-8373-43e2-8048-718c5c8c7a6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-34362", "type": "seen", "source": "https://t.me/hacking_Attack/114399", "content": "https://external-preview.redd.it/7hd2C6lWoyvnN_KJDFIa-4oQTojtvDd0UpsQqUToHQA.jpg?width=640&crop=smart&auto=webp&s=c24af9bed63ba20002506646dae523cc80342758 Original post can be found here: Brace for Impact: Clop MoveIT Breach Continues\n\nIn June 2023, the Clop ransomware group exploited a critical zero-day vulnerability (CVE-2023-34362) affecting file transfer software MOVEit. This tactic has become a trend for Clop: targeting commonly used\u2014albeit susceptible\u2014file transfer providers to exfiltrate data that can be used to extort companies.\n\nFor the last three months, we\u2019ve watched closely as the Clop ransomware group worked through its ransom list, naming and shaming victims\u2014and leaking their data. To date, they\u2019ve released the names of roughly 260 organizations they\u2019ve exploited through the MOVEit file transfer vulnerability. The affected organizations span the globe and multiple industries. Clop has also made good on its threats when companies decline to negotiate, leaking data belonging to many of the named organizations.\n\nUnfortunately, this fiasco is set to continue.\n\nIn this campaign, Clop took the rather unorthodox method of requesting impacted companies contact them to negotiate ransoms, rather than the typical approach of making their demands via a ransom note. Clop has now claimed that any remaining named companies that have failed to contact them would have their data leaked on August 15, 2023.\n\nDeadline for New Leaks Set on August 15, 2023\n\nOn August 10, 2023, Clop released a statement to their data-leak website, Clop Leaks, clarifying their next steps following the MOVEit vulnerability exploitation.\n\n\u200b\n\nFigure 1: Post made to Clop leaks on August 10, 2023\n\nThe post exposes that despite the high-profile nature of the attack, some impacted companies have still failed to contact Clop to negotiate payment of a ransom. There are a number of reasons this could be:\n\n* The possibility is slim, but some companies may be unaware that they are affected by the vulnerability\u2019s exploitation. This could be down to a lack visibility of certain IT services\u2014like MOVEit\u2014within their environment, or otherwise may not have followed recent developments.\n* Some companies may be aware of a possible exposure to the incident, however, may have determined that contacting Clop represented a greater risk than the value of what was potentially stolen.\n* It\u2019s also possible that some companies have taken a stance to not negotiate with criminal extortionists, instead choosing to deal with the fallout of the breach if and when it occurs.\n\nWhatever the case, it\u2019s likely that many organizations\u2019 security teams will be busy on August 15, 2023.\n\nClop\u2019s New Tactics and Their Impact\n\nClop has recently shifted tactics multiple times to identify and prompt any outstanding organizations that have not contacted them to negotiate a ransom. It\u2019s possible that the latest statement represents Clop\u2019s final attempt to solicit payments from victims who have yet to pay the ransom.\n\nThese changes in tactics have included:\n\n* Posting victim data onto clear web domains\u2014a tactic originally explored by the ALPHV ransom[...]", "creation_timestamp": "2026-09-01T20:00:53.111354Z"}