The Clop ransomware group is once again making headlines—this time for targeting internet-facing Gladinet CentreStack file servers in a new data-theft and extortion campaign.
Rather than encrypting files, Clop is focusing on something far more damaging for many organizations: stealing sensitive data and threatening to leak it. This approach has become a signature move for the group and mirrors their earlier attacks against file-transfer platforms like MOVEit and GoAnywhere.
What’s Going On?
Security researchers have observed Clop scanning the internet for publicly exposed CentreStack login portals. Once a vulnerable server is found, the attackers exploit weaknesses in the application to gain access and quietly extract data.
According to reports, hundreds of CentreStack servers are currently reachable from the internet, making them potential targets. Organizations running unpatched or poorly secured instances are especially at risk.
The Vulnerabilities Being Exploited
Clop’s access appears to rely on two serious flaws in Gladinet CentreStack and Triofox:
CVE-2025-11371 – Local File Inclusion (LFI)
This vulnerability allows attackers to read sensitive files from the server without authentication. Most importantly, it can be abused to retrieve the application’s Web.config file, which contains cryptographic machine keys.
CVE-2025-14611 – Hardcoded Cryptographic Keys
This issue involves hardcoded AES encryption keys used by the application. With these keys, attackers can decrypt and forge authentication tickets, giving them persistent access to the system.
By chaining these flaws together—often through directory traversal of the /storage/t.dn endpoint—attackers can escalate access and, in some cases, achieve remote code execution.
How the Attack Typically Works
In simple terms, the attack follows this pattern:
- Scan the internet for exposed CentreStack servers
- Exploit the LFI vulnerability to access sensitive configuration files
- Extract cryptographic keys and forge authentication tokens
- Exfiltrate data quietly, without encrypting files
- Send extortion demands, threatening to leak stolen data
Because files aren’t encrypted, victims may not realize they’ve been compromised until they receive an extortion email.
Why This Matters
CentreStack servers often store high-value business data—financial records, legal documents, customer information, and intellectual property. Losing control of this data can result in regulatory penalties, reputational damage, and costly incident response efforts.
This campaign also reinforces a broader trend: ransomware groups are increasingly targeting file-sharing and file-transfer platforms because a single vulnerability can expose data from many organizations at once.
What Organizations Should Do Now
If you use Gladinet CentreStack or Triofox, immediate action is critical:
- Patch immediately to the latest fixed version released by Gladinet
- Rotate machine keys and credentials if your server was exposed
- Remove CentreStack interfaces from direct internet access
- Review logs for suspicious requests targeting
/storage/t.dn - Monitor for unusual data access or large outbound transfers
Even if you haven’t seen signs of compromise, exposed systems should be treated as high-risk.
Final Thoughts
Clop’s CentreStack campaign is another reminder that internet-facing enterprise tools are prime targets for modern ransomware groups. Encryption is no longer required for attackers to cause serious harm—data theft alone is enough.
Organizations should assume that any exposed file service will be probed and ensure these systems are patched, locked down, and closely monitored.
