Russia-linked ransomware and extortion gang known for mass data-theft campaigns exploiting file-transfer software like MOVEit and Accellion.
Suspected Cl0p operators chain a FlexPLM WSDL disclosure to CVE-2026-12569 for unauthenticated code execution. No encryption stage means ransomware-tuned detections stay silent.
Perspective Coverage
7 publishersReality
Kiteworks told customers to shut its file-transfer servers for nine hours this weekend after a federal warning. The company says its current release fixes every known flaw, so the outage guards against one it does not know about.
Perspective Coverage
3 publishersReality
ShinyHunters defaced Clop's leak site, demanded an eight-figure sum and threatened to name firms that allegedly paid Clop in the Oracle EBS campaign. Only ShinyHunters vouches for its theft claims. The firms it would name are victims whose payments were meant to stay private.
Reality
CenterPoint Energy's 8-K says an unauthorized party took customer personal information through an external-facing system. The person selling the file says it came out of a public API with no rate limiting.
Perspective Coverage
6 publishersReality
BleepingComputer confirmed a defaced page and an uploaded file on Cl0p's infrastructure. Everything past that is a criminal crew's own inventory, and the route it describes runs through the content layer.
Reality
The flaw sits in the JWT refresh token handler, needs nothing more than a rewritten authorization header over plain HTTP, and the fix is a point release to 5.8.1.11 that no change board should need a month to approve.
Reality
The National Cybersecurity Plan 2025-2030 loads its operational machinery into a single legislative year. Firms operating in Mexico should budget for weak state incident response until it lands.
Reality
ShinyHunters says it voice-phished a RingCentral employee. The vendor sells business telephony, and its core platform never broke. The control that failed was a person.
Reality