Team Cymru details six years of Cl0p attacks on file-transfer systems

Aug 12, 2026 · Original article ↗

Summary

Team Cymru’s report analyzes Cl0p’s campaign patterns, reconnaissance, and infrastructure, and recommends stronger monitoring and controls for managed file-transfer systems.

Key points

The report describes Cl0p’s sustained targeting of internet-facing managed file-transfer systems and related platforms, with novel exploits used in seven of nine campaigns.
Five of nine campaigns began in Q4; the report also identifies intervals of roughly 10–14 months between major operations since 2023.
MOVEit reconnaissance was observed as early as two years before exploitation, and the report finds evidence of advance reconnaissance in other campaigns.
Cl0p used 79 observed ASNs across nine campaigns; 53 appeared in only one campaign, limiting the effectiveness of blocklists based only on old infrastructure.
The report highlights a recurring MFT architecture risk: a compromised web application may access both stored files and the keys used to decrypt them.
Recommended defenses include HTTP-layer default-deny rules for MFT services, long-term log retention, traffic baselining, and retroactive log hunting after vulnerability disclosures.
In the Gladinet Centrestack campaign, initial compromises occurred November 27, 2025; Gladinet released a critical update two days later.

Article Details

Publisher: Team Cymru
Scope: Six-year analysis of Cl0p targeting, exploitation, reconnaissance, hosting infrastructure, and defensive controls, including follow-up observations in early 2026.
Sample Size: Nine campaigns and 79 unique ASNs in the report's operational and infrastructure analysis.
Key Statistics: The report identifies novel exploits in seven of nine analyzed campaigns.
Five of nine confirmed campaigns began in Q4, exceeding the other quarters combined.
Of 79 observed ASNs, 53 were used in only one campaign and 26 were reused across campaigns.
Kroll documented MOVEit reconnaissance approximately two years before the May 2023 exploitation.
Four campaigns against four separate technologies occurred within ten months, from January through October 2023.
Recommendations: Enumerate internet-facing MFT assets, including shadow IT, and establish dedicated security controls, monitoring, and incident response procedures.
Deploy default-deny HTTP-layer WAF rules, allowing only required URI paths and restricting partner API access to known IP ranges.
Retain MFT access logs for at least 12 months, preferably 24 months; after patching newly disclosed vulnerabilities, retro-hunt as far back as retention permits.
Baseline inbound URI patterns and outbound transfer volumes, heighten monitoring during October through January, and maintain rolling 180-day monitoring or blocking rules for Cl0p-associated ASNs.
Separate internet-facing web components from decryption key material and file storage.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`pubstorm[.]com`	Domain used to send extortion emails to Oracle EBS victims, reportedly arriving on September 29.
DOMAIN	`pubstorm[.]net`	Domain used to send extortion emails to Oracle EBS victims, reportedly arriving on September 29.
IPV4	`161[.]97[.]99[.]49`	Source of Oracle EBS exploit attempts observed after the July 2025 patch release.
IPV4	`200[.]107[.]207[.]26`	Mandiant reported suspicious Oracle EBS traffic from this IP in July 2025; the report states it returned with successful exploitation in August.
IPV4	`45[.]129[.]137[.]232`	Kroll identified automated MOVEit API probing in July 2021; the report links this IP to Cl0p operations and concurrent SolarWinds Serv-U exploitation.
IPV4	`92[.]118[.]36[.]233`	Performed MOVEit reconnaissance in April 2022 and was subsequently linked to active Cl0p operations.