Skip to content
Product
Use it
Threat intelligence API
Free key, 70+ endpoints, OpenAPI. The product.
Get started
Pick your stack, make your first call.
Live feed
The console: incidents, filters, entities, search.
Recipes
Runnable examples for the free key.
Free feeds
RSS, ransomware feed, IOC blocklist, MISP — no key.
CLI & agents
tc from a terminal; agent keys with scoped budgets.
The data
Incident records
900 articles a day become ~70 scored incidents.
Dark web
First-party leak-site collection: victims, groups, markets.
Validated IOCs
Indicators with a false-positive gate; STIX, MISP, CSV.
Vulnerabilities
CVEs with EPSS, KEV and exploit status.
Entity graph
Actors, malware, CVEs, companies — pivotable.
For teams
For service providers
Per-client feeds, alerts and branded digests.
Use cases
How teams and builders use the corpus.
About ThreatCluster
What it is and how it is built.
Pricing
Docs
Reference
OpenAPI (Swagger)
Every endpoint, parameter and response model.
ReDoc
The same reference, long-form.
Examples on GitHub
curl, Python and Node quickstarts; daily spec snapshot.
Guides
Quickstart & plans
Key, scopes, budgets, tiers.
Integrations
Splunk, Sentinel, Elastic, agents and terminals, step by step
Export formats
STIX 2.1, MISP, CSV, text.
CLI setup
Install, log in, wire an agent.
No results found
Sign in
Get a free key
No results found
Product
Threat intelligence API
Get started
Live feed
Recipes
Free feeds
CLI & agents
The data
Incident records
Dark web
Validated IOCs
Vulnerabilities
Entity graph
For teams
For service providers
Use cases
About ThreatCluster
Docs
OpenAPI (Swagger)
ReDoc
Examples on GitHub
Quickstart & plans
Integrations
Export formats
CLI setup
Pricing
Contact
Get a free key
Sign in
Back
Moveit
Vulnerability
Threat entity extracted from intelligence sources
Oct 20: 0 mentions
Oct 21: 0 mentions
Oct 22: 0 mentions
Oct 23: 1 mention
Oct 24: 0 mentions
Oct 25: 0 mentions
Oct 26: 0 mentions
Oct 20
Oct 23
Oct 26
Entities
›
vulnerability
›
Moveit
Frequency
35
occurrences
First Seen
October 29, 2025
Last Seen
October 23, 2026
API
Overview
Recent Events
Profile
Profile
MITRE ATT&CK
1 / 2
Exploited By
BlackTech
Circuit Panda
Lazarus Group
Midnight Blizzard
Palmerworm
Radio Panda
TA505
Temp.Overboard
Volt Typhoon
Cl0p
Tools Used
Cleo file transfer programs
Fortra GoAnywhere
LiteLLM
Madpot
Openssl
Triofox
Related CVEs
CVE-2025-40541
CVE-2025-40539
CVE-2025-40540
CVE-2025-40538
CVE-2025-40551
CVE-2026-12569
CVE-2026-2699
CVE-2026-2701
MITRE Techniques
T1567 - Exfiltration Over Web Service
T1041 - Exfiltration Over C2 Channel
T1195 - Supply Chain Compromise
T1566 - Phishing
T1486 - Data Encrypted for Impact
T1190 - Exploit Public-Facing Application
T1021 - Remote Services
T1059 - Command and Scripting Interpreter
Campaigns
Oracle EBS campaign
Clop Oracle EBS Campaign
MOVEit Campaign
MOVEIT exploit campaign
MOVEit Hacks
MOVEit Mass Hack
Affected Platforms
Oracle E-business Suite
GoAnywhere
Accellion
Serv-U
SolarWinds Serv-U
PaperCut
Regions
United States
Germany
China
Russia
North Korea
Sectors Affected
Financial
Healthcare
Manufacturing
Government
Energy
Retail
-
REC
Recon
No techniques detected
-
RD
Resource Dev
No techniques detected
2
IA
Initial Access
T1566 - Phishing
T1190 - Exploit Public-Facing Application
2
EX
Execution
T1059 - Command and Scripting Interpreter
T1203 - Exploitation for Client Execution
1
PE
Persistence
T1136 - Create Account
1
PE
Priv Esc
T1068 - Exploitation for Privilege Escalation
1
DE
Defense Evasion
T1562 - Impair Defenses
-
CA
Cred Access
No techniques detected
-
DI
Discovery
No techniques detected
1
LM
Lateral Mov
T1021 - Remote Services
-
CO
Collection
No techniques detected
-
C2
C2
No techniques detected
2
EX
Exfil
T1567 - Exfiltration Over Web Service
T1041 - Exfiltration Over C2 Channel
1
IM
Impact
T1486 - Data Encrypted for Impact
12
techniques detected across
8
tactics
Related Clusters (15)
Washington Post Confirms Breach from Oracle EBS Attacks by Cl0p Ransomware Gang
Nov 7
·
3 sources
79
Critical MOVEit Vulnerabilities Expose Organizations to Data Breaches
May 4
·
9 sources
74
Critical Vulnerabilities in SolarWinds Serv-U Require Immediate Patching
Jul 22
·
3 sources
73
Ransomware Groups Target Retailers Ahead of Holiday Shopping
Nov 21
·
30 sources
57
Clop Ransomware Claims Breaches of Canon and Mazda
Nov 24
·
4 sources
57
Deutsche Bank Investigates Ransomware Breach by Unsafe Group
Jul 9
·
2 sources
52
GRIPA Class Action Settlement for MOVEit Data Breach Announced
Jun 26
·
1 sources
52
Critical Vulnerabilities in SolarWinds Serv-U Software Patched
Feb 24
·
19 sources
50
Delta Dental Fined $2.25M for Data Breach Lapses in New York
May 2
·
5 sources
49
GlobalLogic Reports Data Breach Affecting Over 10,000 Employees
Nov 11
·
3 sources
49
Supply Chain Breaches Affect 97% of Organizations in 2025
Nov 24
·
3 sources
38
Washington Post Data Breach Linked to Oracle E-Business Suite Exploit
Dec 1
·
49 sources
35
SMEs Urged to Enhance Cybersecurity Ahead of Small Business Saturday
Nov 16
·
32 sources
34
Third-Party Vendor Risks Lead to Cybersecurity Breaches
Feb 27
·
2 sources
31
Top Cybersecurity PR Agencies of 2026 Identified
Jun 3
·
2 sources
3
Prev
1 / 3
Next
Related Articles (35)
Nsa Wants To Protect Americas Ai 65c0eb42a0e6da001a37dfbd
news.risky.biz
·
2d ago
2025 Supply Chain Threats Ai Api
www.secureworld.io
·
6d ago
Cyberattack Hits South Carolina School Choice Program
www.the74million.org
·
Oct 12
AntiBrok3rs
www.resecurity.com
·
Sep 15
Texas Utility Firm Investigating Potential Data Leak Moveit Breach
therecord.media
·
Sep 15
Harley-Davidson breach claimed by Cl0p gang with 270GB internal data dump
Cybernews
·
Sep 12
Unpacking The Moveit Breach Statistics And Analysis
www.emsisoft.com
·
Aug 18
Cyber gang claims to have breached dozens of multinationals, stolen data
Computing
·
Aug 14
Cl0p claims a mass hack of Shell, Philips, and dozens more
Thenextweb
·
Aug 14
Data transfer software Serv-U has 15 critical security vulnerabilities
Heise.De
·
Jul 22
EY data breach exposes client tax documents
Cybernews
·
Jul 18
Deutsche Bank probes supplier cyber incident after ransomware gang claims breach
Computing
·
Jul 9
$2.15M Settlement Ends Greater Rochester Independent Practice Association Lawsuit Over ...
Classaction
·
Jun 26
Cybersecurity PR Agencies - Best Picks 2026
Analyticsinsight
·
Jun 3
Cybersecurity PR Agencies - Best Picks 2026
Analyticsinsight
·
Jun 3
NYDFS Fines Delta Dental $2.25M Over MOVEit Data Breach
Law360
·
May 2
Filigran Report: 90% of Financial Sector Breaches Driven by Financial Gain as AI and ...
Morningstar
·
Apr 21
Researchers warn of critical flaws in Progress ShareFile
Cybersecuritydive
·
Apr 3
Mercor confirms cyberattack as hackers claim 4TB of critical data in possession
Cybernews
·
Apr 1
Counter third-party risk with continuous vendor monitoring
Techtarget
·
Feb 27
New Serv-U bugs extend SolarWinds’ run of high
Csoonline
·
Feb 25
Patch these 4 critical, make-me-root SolarWinds bugs ASAP
Theregister
·
Feb 24
Patch these 4 critical, make-me
Theregister
·
Feb 24
Latest Oracle EBS Victims Include Korean Air, University of Phoenix
Thecyberexpress
·
Dec 30
CL0P Ransomware Group Targets Gladinet CentreStack in New Campaign
Thecyberexpress
·
Dec 19
University of Pennsylvania joins growing pool of Oracle customers impacted by Clop attacks
Cyberscoop
·
Dec 2
Oracle EBS exploitation similar to Clop's MOVEit, GoAnywhere attacks
Scworld
·
Dec 1
From security silos to collective resilience: Transforming supply chain security in the UK insurance industry
Securitybrief
·
Nov 19
The Washington Post reveals thousands impacted via Oracle-based hack
Cybernews
·
Nov 16
Washington Post breach impacts nearly 10K
Scworld
·
Nov 15
Washington Post confirms data on nearly 10,000 people stolen from its Oracle environment
Cyberscoop
·
Nov 13
Hitachi-owned GlobalLogic admits data stolen by Clop
Theregister
·
Nov 11
Hitachi
Theregister
·
Nov 11
Washington Post is latest victim of Oracle-hacking Cl0p gang
Cybernews
·
Nov 7
Cyber Trends Report
Stories.Td
·
Oct 29
Prev
1 / 7
Next
Related Entities
BlackTech
Circuit Panda
Lazarus Group
Midnight Blizzard
Palmerworm
Radio Panda
TA505
Temp.Overboard
Volt Typhoon
Data Breach
Ransomware
Phishing
