Clop ransomware group targets morrisgroup.co

• Ransomware group: Clop
• Country: Colombia
• Sector: Manufacturing
• Announcement date: February 12, 2025

The Clop ransomware group has published an announcement on its leak site claiming to have exfiltrated data belonging to morrisgroup.co. The listing, which appeared on February 12, 2025, asserts that the threat actor has successfully obtained data from the organization's systems.

The details of the claim

According to the announcement posted on the group's leak site, the target of this operation is the domain morrisgroup.co. The threat actor claims to have obtained data from the organization's systems, and the listing was officially created on February 12, 2025. The group has stated that the organization's data may be published in accordance with the group's claims.

Ransomware groups often use leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish stolen data on public forums, these groups aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or personal information. This tactic increases the pressure on the victim, as the threat of a public leak can lead to significant reputational damage and legal consequences.

Information regarding the leaked data

At this time, there is no information regarding the nature of the leaked data, and no screenshot has been provided to support the group's claims. The listing names no specific data types.

Impact and assessment

This incident may pose a risk to the organization's operational continuity and could lead to data privacy breaches. The Clop group is known for orchestrating large-scale data exfiltration campaigns by exploiting vulnerabilities in file transfer software. This specific method of attack can create secondary risks for an organization's supply chain and business partners, as the breach of one entity can serve as a gateway or a source of information for attacking others in the same ecosystem.

The alleged data breach could bring threats such as identity theft or targeted phishing attacks for the organization's customers and employees. When sensitive data is exfiltrated, attackers can use the information to craft highly convincing social engineering campaigns, making it difficult for individuals to distinguish between legitimate communications and malicious ones.

Furthermore, within the framework of data protection legislation in Colombia, the organization may face legal obligations and potential administrative sanctions. Organizations facing such threats typically focus on incident response, forensic investigation, and strengthening their security posture to prevent future occurrences. This includes implementing robust patch management to address vulnerabilities in software and enhancing monitoring capabilities to detect unauthorized data transfers. Information about this group remains limited.