Cl0p ransomware and data-extortion group remains a relevant threat to Australian and New Zealand organisations in 2026, despite a reduction in activity compared with 2025.
Cl0p, is one of the threat actors that should be considered when organisations conduct threat modelling, attack-surface assessments and ransomware readiness exercises. The group has a long-established pattern of exploiting internet-facing enterprise software at scale, particularly managed file-transfer and other centralised business platforms.
In September 2026, Cl0p’s own dark-web leak site was compromised and defaced by rival extortion group ShinyHunters. The incident attracted considerable attention because the site normally serves as Cl0p’s platform for naming victims and publishing stolen data. The defacement is confirmed, while broader claims by ShinyHunters regarding access to Cl0p’s underlying infrastructure and private keys have not all been independently verified. This raises a critical risk to any company who paid a ransom to Cl0p to avoid their data being published in that what will ShinyHunters do with this information if it stil exists in Cl0ps compromised infrastructure.
The incident should not, however, be interpreted as evidence that Cl0p has ceased operating. Cl0p continued to have victim activity during 2026, including a major campaign involving PTC Windchill environments. Recent reporting identified more than 40 organisations allegedly targeted in that campaign, while threat-intelligence sources continued to record Cl0p victim listings into September.
Why Cl0p matters to Australian and New Zealand organisations
Cl0p’s significance is less about conventional ransomware deployment and more about its ability to turn a single vulnerable enterprise platform into an access point to data belonging to many organisations.
This has been demonstrated repeatedly through attacks against managed file-transfer technologies including Accellion FTA, GoAnywhere MFT, MOVEit Transfer and Cleo products. The MOVEit campaign, for example, involved exploitation of a public-facing application followed by deployment of the LEMURLOOT web shell and large-scale data theft.
The Cleo campaign provides another example. Cl0p claimed responsibility for exploitation of CVE-2024-50623 and CVE-2024-55956, vulnerabilities affecting Cleo Harmony, VLTrader and LexiCom. The vulnerabilities allowed unauthenticated attackers to write files or execute commands, creating a high-value route into systems designed specifically to exchange business data.
Cl0p has also been associated with exploitation of Oracle E-Business Suite CVE-2025-61882. Oracle describes the vulnerability as remotely exploitable without authentication and capable of resulting in remote code execution. Google Threat Intelligence reported that the Cl0p campaign involved significant data exfiltration from affected organisations.
Australia is already being targeted
Cl0p should not be treated as a threat that is primarily relevant to North American or European organisations.
CyberCX reported in February 2026 that it had observed 10 Australian victims claimed on Cl0p’s dedicated leak site over the preceding two months.
More recently, Australian truck-trailer manufacturer Midland was listed by Cl0p in August 2026. Cl0p claimed to have obtained project information and database data from the organisation.
This provides an important threat-modelling point: Australian organisations are not outside Cl0p’s targeting model simply because they represent a smaller market than the United States or Europe.
The same applies to New Zealand organisations. A threat actor conducting mass exploitation does not necessarily need to specifically select an organisation in New Zealand. If a vulnerable application is exposed to the internet, the organisation can become part of the target population.
The Cl0p threat model
For Australian and New Zealand organisations, the most important scenario to model is not simply:
“Cl0p deploys ransomware.”
A more representative scenario is:
Internet-facing enterprise application → vulnerability exploitation → persistence/access → data discovery and staging → data exfiltration → extortion → public disclosure.
This distinction is important because Cl0p campaigns have frequently emphasised data theft and extortion rather than traditional ransomware encryption.
For organisations using managed file-transfer platforms, ERP systems, collaboration platforms or other centralised enterprise applications, the potential blast radius can also be considerably larger than a single compromised server.
A compromised platform may contain:
- customer information;
- supplier information;
- financial records;
- contracts;
- engineering and intellectual property;
- credentials and configuration information;
- documents exchanged with third parties; and
- information belonging to multiple downstream organisations.
This creates a particularly important third-party and supply-chain threat-model scenario.
Vulnerabilities to consider
Organisations should ensure their vulnerability-management and external attack-surface processes specifically consider technologies previously targeted by Cl0p.
Examples include:
| Vulnerability | Technology / relevance |
|---|---|
| CVE-2024-50623 | Cleo Harmony, VLTrader and LexiCom; unrestricted file upload/download vulnerability |
| CVE-2024-55956 | Cleo Harmony, VLTrader and LexiCom; unauthenticated command execution vulnerability |
| CVE-2025-61882 | Oracle E-Business Suite; remotely exploitable vulnerability that can result in remote code execution |
The two Cleo vulnerabilities were exploited in the wild, with Cl0p publicly claiming responsibility for the associated data-theft campaign.
CVE-2025-61882 is particularly relevant to threat modelling because Oracle describes it as exploitable remotely without authentication, with a CVSS 3.1 score of 9.8.
MITRE ATT&CK mapping
The following techniques provide a useful starting point for incorporating Cl0p into an organisational threat model.
| Tactic | ATT&CK ID | Technique | Cl0p relevance |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | Cl0p is repeatedly associated with mass exploitation of exposed enterprise and managed file-transfer applications, including MOVEit, GoAnywhere, Cleo and Oracle E-Business Suite. This is one of the clearest characteristics of the group’s operations. |
| Persistence | T1505.003 | Server Software Component: Web Shell | Cl0p’s MOVEit exploitation included the LEMURLOOT web shell, which provided access to compromised MOVEit environments. |
| Impact | T1486 | Data Encrypted for Impact | Cl0p has historically deployed ransomware, although more recent campaigns have frequently concentrated on data theft and extortion without requiring broad encryption. |
| Exfiltration | T1048 | Exfiltration Over Alternative Protocol | Cl0p activity has included data exfiltration using alternative communications paths and protocols. |
| Exfiltration | T1048.002 | Exfiltration Over Alternative Protocol: Exfiltration Over Non-C2 Protocol | Relevant to data movement where an established C2 channel is not used for exfiltration. |
| Exfiltration | T1048.003 | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol | Applicable to reported alternative-protocol data transfer behaviour. |
| Exfiltration | T1567.002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Cl0p activity has been associated with use of cloud/web services for data movement, including services such as Dropbox and OneDrive. |
| Execution | T1059 | Command and Scripting Interpreter | Command execution is associated with post-exploitation activity following compromise of vulnerable enterprise applications. |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | PowerShell has been observed in Cl0p-associated exploitation activity, including the Cleo campaign. |
| Credential Access | T1003 | OS Credential Dumping | Credential theft has been reported as part of Cl0p-associated post-compromise activity. |
| Credential Access | T1003.001 | OS Credential Dumping: LSASS Memory | LSASS memory credential theft is associated with Cl0p tradecraft reported in Windows environments. |
| Lateral Movement | T1021.001 | Remote Services: RDP | RDP can provide remote access and movement following compromise of Windows environments. |
| Lateral Movement | T1563.002 | Remote Service Session Hijacking: RDP Hijacking | Associated with post-compromise remote-session activity. |
| Persistence / Execution | T1053.005 | Scheduled Task/Job: Scheduled Task | Scheduled tasks can provide persistence or facilitate repeated execution. |
| Persistence / Execution | T1543.003 | Create or Modify System Process: Windows Service | Windows services can be used for persistence and execution within compromised environments. |
| Impact | T1489 | Service Stop | Stopping services can support ransomware deployment and disruption of business operations. |
| Defense Evasion | T1070 | Indicator Removal | Cl0p-associated activity includes anti-forensics and removal of evidence. |
| Defense Evasion | T1070.001 | Clear Windows Event Logs | Clearing Windows event logs can reduce evidence available to defenders and incident responders. |
| Discovery | T1518.001 | Software Discovery: Security Software Discovery | Cl0p malware has been associated with identifying installed security and anti-malware products. |
The ATT&CK mapping should be treated as a threat-modelling reference rather than a claim that every Cl0p intrusion uses every technique. Public reporting provides stronger evidence for some techniques than others, particularly T1190 and T1505.003. CISA’s MOVEit advisory, for example, explicitly maps the Cl0p exploitation of MOVEit to T1190 and its subsequent activity to PowerShell and other command-execution techniques.
Cl0p’s Australian Victims in 2026
Cl0p has continued to name Australian organisations on its leak infrastructure during 2026. The following organisations were listed as Australian victims in the supplied victim data:
| Company | Domain | Date | Industry | Country |
|---|---|---|---|---|
| Midland (Australia) | midlandind.com.au | 13 Aug 2026 | Automotive and Industrial Parts | AU |
| Omni Tanker | omnitanker.com | 12 Aug 2026 | Chemicals / Transportation | AU |
| Whole IT | wholeit.com.au | 30 Jan 2026 | Information Technology | AU |
| NextPhaze | nextphaze.com.au | 28 Jan 2026 | Cybersecurity / Information Technology | AU |
| ETTO Australia | ettoaustralia.com | 28 Jan 2026 | Retail / Cosmetics | AU |
| Hale Road Tavern | thehaleroad.com.au | 28 Jan 2026 | Food and Beverage | AU |
| MRA Group | mragroup.com.au | 28 Jan 2026 | Oil and Gas Equipment and Services | AU |
| Podiatry Western Australia | podiatrywa.com.au | 28 Jan 2026 | Professional Services | AU |
| RMW Hospitality Group | rmwgroup.com.au | 28 Jan 2026 | Hospitality | AU |
| Ventnor | ventnor.com.au | 28 Jan 2026 | Capital Markets / Finance | AU |
| Y Architecture Studio | y-architecture.studio | 28 Jan 2026 | Architecture | AU |
| Skye Excavations | skyeexcavations.com.au | 28 Jan 2026 | Construction | AU |
| Roberts Designs | robertsdesigns.com.au | 27 Jan 2026 | Industrial Distribution | AU |
The presence of an organisation on a ransomware or extortion leak site should not, by itself, be interpreted as confirmation that the organisation paid a ransom or that every claim made by the threat actor is accurate.
What this means for Australian and New Zealand defenders
Cl0p provides a good example of why threat modelling needs to go beyond conventional endpoint ransomware scenarios.
Organisations should consider whether they have:
1. Internet-facing applications that could become a mass-exploitation target
Maintain an accurate inventory of externally accessible applications, particularly managed file-transfer, ERP, collaboration and other business-critical platforms.
2. High-value centralised systems
Identify systems that hold information belonging to multiple customers, suppliers, subsidiaries or partners. These systems should receive additional scrutiny because compromise can create a disproportionate data-exposure event.
3. Emergency vulnerability-management capability
Cl0p’s history demonstrates the importance of being able to identify and patch critical vulnerabilities in internet-facing applications rapidly. Vulnerability management should include emergency processes for vulnerabilities being actively exploited in the wild.
4. Detection around the application itself
Endpoint detection alone may not be sufficient when the initial compromise occurs against an application server. Organisations should monitor web shells, unusual processes spawned by application services, unexpected PowerShell execution, anomalous outbound connections and abnormal data access.
5. Data-exfiltration controls
Large outbound transfers from file-transfer, ERP and other data repositories should be detectable. Where practical, organisations should restrict outbound connectivity from sensitive application servers.
6. Third-party exposure
Threat models should consider whether a compromised supplier, managed service provider or shared platform could provide Cl0p with access to organisational data.
The key threat-modelling lesson
Cl0p’s enduring relevance is its industrial-scale approach to exploitation.
The group does not necessarily need to spend weeks compromising every individual organisation. A vulnerability in a widely deployed enterprise platform can provide access to a large number of organisations simultaneously.
The MOVEit and Cleo campaigns demonstrated this model particularly clearly, while the 2025 Oracle E-Business Suite campaign showed that the same approach can extend beyond managed file-transfer products.
The September 2026 compromise of Cl0p’s own leak site is an unusual development, but it does not remove the underlying threat. Indeed, the incident highlights another consideration for organisations: information held on criminal infrastructure can itself become exposed through secondary compromise. Claims about the extent of ShinyHunters’ access should be treated cautiously, but the publicly observed defacement demonstrates that even criminal infrastructure can be compromised.
For Australian and New Zealand organisations, the practical takeaway is straightforward: Cl0p should remain in the threat model, particularly where an organisation operates internet-facing enterprise software, managed file-transfer systems, centralised data platforms or technologies with a history of mass exploitation.
The relevant question is not whether Cl0p is currently as active as it was in 2025. The more important question is whether an organisation has an exposure that fits the group’s established operating model.
