Cl0p has resumed mass exploitation activity, this time targeting a recently disclosed vulnerability in a managed file transfer (MFT) platform used across logistics, freight forwarding, and customs filing operations. At least seven European logistics operators are known to have been affected, with exfiltrated data including customs declarations, shipment manifests, and commercial invoice data.
This follows the group’s previous mass exploitation campaigns against MOVEit Transfer (2023), GoAnywhere MFT (2023), and Accellion File Transfer Appliance (2021). Cl0p has established a clear pattern: identify a critical vulnerability in a platform used across supply chains, exploit it at scale before patches are applied, exfiltrate data from hundreds of victims simultaneously, and then demand ransoms or publish data to a leak site.
The Transport and Logistics Exposure
The transport and logistics sector relies heavily on automated file transfer systems to exchange documents with ports, customs authorities, freight partners, and customers. These platforms are often:
- Directly internet-facing with no additional access controls
- Running older firmware versions due to operational continuity concerns
- Administered by small IT teams without dedicated security resources
- Connected to multiple upstream and downstream partner systems
This makes the sector a reliable target for MFT exploitation campaigns.
What Has Been Exfiltrated
Data exfiltrated from affected organisations includes:
- Customs and import/export documentation — which can reveal trade relationships, supplier networks, and product volumes
- Shipment tracking data — useful to criminal networks and state actors with interest in cargo movements
- Commercial agreements and pricing — competitive intelligence with direct value
- Employee and customer personal data — subject to ICO notification obligations
Organisations with affected MFT platforms have 72 hours from discovery to notify the ICO of a personal data breach.
Immediate Actions
- Identify all MFT platforms in use across your organisation and any that handle data on your behalf (including third-party logistics providers)
- Apply the available patch immediately — Cl0p exploits narrow the window between disclosure and mass exploitation to days, not weeks
- Review file transfer platform audit logs for anomalous bulk download activity in the past 30 days
- Notify your data protection officer and assess whether ICO notification is required
- Alert key logistics partners — if your MFT is compromised, partner data may have been exfiltrated too
The specific CVE and affected platform versions have been withheld pending wider patch deployment. NCSC has the details and can brief qualifying organisations through its partnership programmes.