CLOP targets Gladinet CentreStack servers in large-scale extortion campaign

The Clop ransomware group is targeting Gladinet CentreStack file servers in a new large-scale extortion campaign aimed at stealing sensitive data from organisations worldwide, according to Security Affairs. Experts from threat intel firm Curated Intelligence reported the campaign, noting that over 200 IPs with the “CentreStack – Login” HTTP title may be at risk from an unknown CVE (n-day or zero-day) exploited by the group.

In October, Huntress researchers reported that threat actors are exploiting the local File Inclusion flaw CVE-2025-11371, a zero-day in Gladinet CentreStack and Triofox, enabling access to system files without authentication. The article also references prior Clop advances against file-transfer platforms such as MOVEit, GoAnywhere and Oracle EBS, and lists CVEs linked to these campaigns.

It notes that at least three customers have been targeted so far, and that the campaign involves data extortion alongside data leakage on a dark web site. Clop is described as a prolific Russian-speaking ransomware-as-a-service group known for big-game hunting and double-extortion.