好的，我现在需要帮用户总结一篇文章的内容，控制在100字以内。首先，我得仔细阅读文章，理解其主要内容。 文章主要讲的是Clop勒索软件团伙正在攻击暴露在互联网上的Gladinet CentreStack文件服务器。CentreStack是一个允许企业通过网页浏览器、移动应用和映射驱动器安全共享文件的工具，不需VPN。自四月以来，Gladinet发布了多个安全更新来修复被利用的安全漏洞，包括零日漏洞。 Clop团伙通过扫描并入侵这些CentreStack服务器，留下勒索信息。目前还不清楚他们利用的是零日漏洞还是未修补的已知漏洞。此外，Clop之前也曾攻击过其他文件传输产品，最近还利用了Oracle EBS的零日漏洞。 用户的需求是用中文总结内容，控制在100字以内，并且不需要特定的开头。所以我要提取关键点：Clop攻击CentreStack服务器，利用未知漏洞，可能影响200多个IP，以及他们之前攻击的历史。 现在组织语言：Clop团伙针对暴露的CentreStack服务器发起数据窃取勒索活动。CentreStack用于企业安全文件共享。自四月以来，Gladinet发布安全更新修复漏洞。目前未知Clop利用的是零日还是已知漏洞。已有200多个IP可能受影响。Clop过去曾攻击过其他文件传输系统。 检查字数是否在100字以内，并确保信息准确无误。 </think> Clop 勒索软件团伙针对暴露在互联网上的 Gladinet CentreStack 文件服务器发起数据窃取勒索活动。CentreStack 用于企业安全文件共享。自四月以来，Gladinet 发布安全更新修复漏洞。目前未知 Clop 利用的是零日还是已知漏洞。已有 200 多个 IP 可能受影响。 2025-12-18 20:30:17 Author: www.bleepingcomputer.com(查看原文) 阅读量:2 收藏
The Clop ransomware gang (also known as Cl0p) is targeting Internet-exposed Gladinet CentreStack file servers in a new data theft extortion campaign.
Gladinet CentreStack enables businesses to securely share files hosted on on-premises file servers through web browsers, mobile apps, and mapped drives without requiring a VPN. According to Gladinet, CentreStack "is used by thousands of businesses from over 49 countries."
Since April, Gladinet has released security updates to address several other security flaws that were exploited in attacks, some of them as zero-days.
The Clop cybercrime gang is now scanning for and breaching CentreStack servers exposed online, with Curated Intel telling BleepingComputer that ransom notes are left on compromised servers.
However, there is currently no information on the vulnerability Clop is exploiting to hack into CentreStack servers. It is unclear whether this is a zero-day flaw or a previously addressed bug that the owners of the hacked systems have yet to patch.
"Incident Responders from the Curated Intelligence community have encountered a new CLOP extortion campaign targeting Internet-facing CentreStack file servers," warned threat intel group Curated Intelligence on Thursday.
"From recent port scan data, there appears to be at least 200+ unique IPs running the "CentreStack - Login" HTTP Title, making them potential targets of CLOP who is exploiting an unknown CVE (n-day or zero-day) in these systems."
Clop's data theft attacks
Clop has a long history of targeting secure file transfer products. In the past, the extortion gang has been behind other data theft campaigns targeting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer file-sharing servers, the latter of which affected over 2,770 organizations worldwide.
Most recently, it exploited an Oracle EBS zero-day flaw (CVE-2025-61882) to steal sensitive files from many organizations since early August 2025.
The list of Oracle customers impacted includes Harvard University, The Washington Post, GlobalLogic, the University of Pennsylvania, Logitech, and the American Airlines subsidiary Envoy Air.
After breaching their systems and exfiltrating sensitive documents, Clop published the stolen data on its dark web leak site and made it available for download via Torrent.
The U.S. Department of State is offering a $10 million reward for any information that could link this cybercrime gang's attacks to a foreign government.
A Gladinet spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today
Break down IAM silos like Bitpanda, KnowBe4, and PathAI
Broken IAM isn't just an IT problem - the impact ripples across your whole business.
This practical guide covers why traditional IAM practices fail to keep up with modern demands, examples of what "good" IAM looks like, and a simple checklist for building a scalable strategy.
如有侵权请联系:admin#unsafe.sh