Cl0p - Til You Drop - 6 years, 9 Campaigns, 7 0Days

Speaker Eli Woodward, a threat intelligence advisor at Team Cymru, reviews the exploitation campaigns attributed to the Cl0p group since 2020. The group has repeatedly targeted managed file transfer products and other edge devices that hold large volumes of data, from Accellion through MOVEit to CentreStack. The campaign count changed between the submission and the event as new activity surfaced.

The middle of the talk focuses on infrastructure. Drawing on prior vendor reporting, passive DNS and hosting records, the presenter built a lookup tool that links IP addresses and ASNs to specific campaigns. One hosting provider appears across several campaigns, only about a third of ASNs were ever reused, and some scanning traced back roughly two years before exploitation. Half of the campaigns landed in the fourth quarter, and recent extortion emails arrived months after data theft, suggesting the group now favors quiet exfiltration over encryption.

The closing advice is practical. Teams should baseline normal traffic on file transfer appliances and treat them as production honeypots, alert on unfamiliar URIs, and limit web application firewall rules to required endpoints with default deny. Organizations should also shorten retention of sensitive files on these systems and share indicators from incident response, since publicly reported IPs were scarce for much of this research.