Quick Summary
The Clop ransomware gang is targeting Gladinet CentreStack file servers in a new data theft extortion campaign. Gladinet CentreStack, used by thousands of businesses globally, has faced multiple security flaws since April, prompting security updates. Clop is exploiting vulnerabilities in these servers, with at least 200 unique IPs identified as potential targets.
The Securityish Brief
The Clop ransomware group, also known as Cl0p, is actively targeting Gladinet CentreStack file servers, which allow secure file sharing for businesses. This new data theft extortion campaign has been noted since April, with Gladinet releasing security updates to address various vulnerabilities exploited in prior attacks. Currently, it remains unclear what specific vulnerabilities Clop is exploiting to breach these servers.
Curated Intelligence reported that Clop is leaving ransom notes on compromised CentreStack servers, indicating a systematic approach to extortion. The group has a history of targeting secure file transfer products, having previously exploited vulnerabilities in systems such as Accellion FTA and MOVEit Transfer, which impacted thousands of organizations worldwide.
As of now, there are indications that Clop is scanning for CentreStack servers exposed on the internet, with over 200 unique IPs identified as potential targets. The lack of clarity regarding whether the exploited vulnerabilities are zero-days or previously patched flaws raises concerns about the security posture of organizations using these systems.
Implications for Users and Organizations
This incident highlights the ongoing risks associated with internet-facing file servers, particularly those that may not be regularly updated or monitored. Organizations using Gladinet CentreStack should ensure that their systems are patched against known vulnerabilities and actively monitor for any signs of compromise.
Users should be aware of the potential for data breaches and the importance of securing sensitive information. Implementing robust security measures, such as regular software updates and monitoring network traffic, can help mitigate risks associated with ransomware attacks.
Organizations should also consider reviewing their incident response plans and ensuring that they have protocols in place for dealing with ransomware incidents. This includes understanding how to respond to ransom notes and the potential implications of data being published on dark web leak sites.
Key Takeaways
- Ensure your Gladinet CentreStack servers are updated with the latest security patches.
- Regularly monitor your network for unusual activity or signs of compromise.
- Review your incident response plan to prepare for potential ransomware attacks.
- Educate employees about the risks of ransomware and how to recognize phishing attempts.
- Consider implementing additional security measures such as multi-factor authentication for sensitive access.
Key Terms & Concepts
- Clop ransomware: In this article, Clop ransomware refers to a cybercrime gang known for targeting secure file transfer products and extorting victims.
- Gladinet CentreStack: Gladinet CentreStack is a file sharing solution that allows businesses to securely share files without requiring a VPN.
- zero-day vulnerability: A zero-day vulnerability is a security flaw that is exploited by attackers before the vendor has released a fix.
- CVE: CVE stands for Common Vulnerabilities and Exposures, a list of publicly disclosed cybersecurity vulnerabilities.
Read the original article here: https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-gladinet-centrestack-servers-for-extortion/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
