CL0P Seeds ^_- Gotta Catch Em All!
Summary: The CL0P ransomware group began publishing stolen victim data via torrents as of Aug. 15, 2023, after a MOVEit zero-day campaign that CISA estimated affected more than 3,000 U.S.-based organizations and 8,000 globally. Unit 42 analyzed the torrent seed infrastructure behind these releases, using magnet links and distributed hash table peer discovery to identify likely original seeders across hundreds of individual torrents.
Bottom line: CL0P moved to peer-to-peer distribution because Tor leak sites were too slow to move the terabytes of stolen data, restoring the payment pressure that slow downloads had accidentally relieved. The seeding infrastructure Unit 42 mapped is the same mechanism that lets anyone, including credential harvesters and other attackers, pull victim data at speed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026