Malware

Clop (ELF)

Also known as: Cl0p

ELF version of clop ransomware.

Indicators of Compromise 4

IP 104[.]243[.]35[.]63 IP 216[.]152[.]148[.]54 IP 216[.]152[.]151[.]204 IP 5[.]180[.]41[.]35

MITRE ATT&CK TTPs 3

T1059.007
JavaScript
Execution
 T1105
Ingress Tool Transfer
Command And Control
 T1210
Exploitation of Remote Services
Lateral Movement

Source Articles

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Cl0p-affiliated threat actors are exploiting critical vulnerabilities in internet-exposed PTC Windchill and FlexPLM systems to achieve unauthenticated remote code execution. The attackers deploy hex-named JSP web shells to gain persistent access, conduct data exfiltration, and carry out double extortion. This campaign targets high-value sectors such as manufacturing, automotive, aerospace, and retail, leveraging known vulnerabilities to compromise enterprise applications.
hacker-news ·3d ago