clop

Aug 27 – September 22, 2026

• ShinyHunters escalated its extortion of Cl0p: a 21 September message on the hijacked leak site says demands rise every 24 hours without engagement, adds a public apology to the terms, and threatens to publish which companies paid Cl0p, how much, and the receiving Bitcoin addresses — Cl0p replied, and Shiny replied again (earlier coverage). Dark Reading's angle is the one that matters for defenders: organisations that quietly paid may now face renewed extortion from a second crew. The Record, Dark Reading · Sep 22 · observed · as shinyhunters · Threat Activity

Aug 15 – August 18, 2026 · 3 reports

• Clop built a custom web shell for its Windchill data-theft campaign. This adds a concrete post-exploitation detail to the operation that recently expanded past 40 named victims (earlier coverage). BleepingComputer reports that the shell was tailored to support theft from compromised PTC Windchill environments. · Aug 18 · observed · Threat Activity & Supply Chain
• Clop's Windchill campaign balloons to 40+ named victims — the gang listed dozens of new companies on its leak site, including Shell, Philips, and GE, consistent with mass exploitation of PTC Windchill (earlier coverage). @campuscodi (discussion) · Aug 16 · observed · Threat Activity
• Clop listed 40+ organizations on its leak site — including Shell, Philips and GE — likely from PTC Windchill exploitation, with Shell now confirming it is investigating a "potential incident" (BleepingComputer). · Aug 15 · claimed · Threat Activity

July 21, 2026

• Estée Lauder disclosed a 2025 breach traced to Clop ransomware exploiting Oracle E-Business Suite used for HR, exposing employee personal data. BleepingComputer, CyberInsider. · Jul 21 · observed · Data Breaches