Clop (ELF)

ShinyHunters, a prolific cybercriminal group known for data breaches and extortion, is under increased law enforcement pressure following the reported detention of a key suspect, Saif al-Din Khader (alias Rey/ReyXBF), in Jordan. Khader, allegedly a former administrator of BreachForums and Scattered LAPSUS$ Hunters, is cooperating with the FBI to identify other group members. The group has been linked to over 140 breaches and $70 million in extortion payments, recently exploiting a Grav CMS vulnerability to hijack the Cl0p ransomware group's darknet site and breaching the FBI’s job portal, stealing approximately three terabytes of data. ShinyHunters claims the FBI breach was not financially motivated but intended to challenge false allegations and their alleged ties to The Com cybercrime collective.

Cl0p-affiliated threat actors are exploiting critical vulnerabilities in internet-exposed PTC Windchill and FlexPLM systems to achieve unauthenticated remote code execution. The attackers deploy hex-named JSP web shells to gain persistent access, conduct data exfiltration, and carry out double extortion. This campaign targets high-value sectors such as manufacturing, automotive, aerospace, and retail, leveraging known vulnerabilities to compromise enterprise applications.