A Chill in the Air: Cl0p Targets Windchill, Another Enterprise Software Product
Cl0p's recent targeting of Windchill shows that Internet-exposed enterprise back office software remains a high value target for threat actors.
Topic
Cl0p
5 posts
Unpacking the Oracle EBS Debacle: Industries, Geography, and MOVEit Comparisons
Cl0p exploits Oracle E-Business Suite zero-day (CVE-2025-61882) in extortion campaign. Censys research reveals exposed instances across industries and compares tactics to 2023 MOVEit attack.
2025 State of the Internet: Notable Incidents
Explore Censys' 2025 State of the Internet Report: deep analysis of Cl0p ransomware, Cleo file transfer vulnerabilities (CVE-2024-55956), and key 2024 threat intelligence findings.
MOVEit Transfer Vulnerability
UPDATES: SUMMARY: Another day, another MFT (Managed File Transfer) product getting pwned. On the heels of the GoAnywhere MFT 0-day, this time, it’s a vendor called Progress Software Corporation and their product, “MOVEit Transfer,” that facilitates the transfer of files between business partners and their customers using a variety of protocols such as SSH and […]
Months after first GoAnywhere MFT zero-day attacks, Censys still sees ~180 public admin panels
GoAnywhere MFT Breaches by high-profile ransomware groups have now affected 8 confirmed organizations (and counting) Executive Summary: Timeline: The Internet’s Response: We observe a slow and steady patch response to this actively exploited vulnerability. Since this zero-day was first disclosed, Censys has seen an approximate 46% decrease in the number of exposed GoAnywhere Admin Panels […]