Clop Loves a Good Blueprint

# Clop Loves a Good Blueprint I’ve spent the last few hours staring at reports about the new PLM zero-day. Product Lifecycle Management software is basically the crown jewels of any company that actually makes physical things. It’s where the blueprints, the CAD files, and the Bill of Materials live. If you're GE or Philips—both of whom are currently under the microscope because Clop decided to move in—your PLM isn't just a database. It's the intellectual property of the entire firm. When I see these stories, I see the same pattern we saw during NotPetya. Everyone focuses on how the attackers got in. They want to talk about the "sophisticated" nature of the zero-day exploit. I hate that word. Every time a PR firm uses "sophisticated," they're trying to say, "It wasn't our fault because we couldn't have stopped a genius." Stop it. It doesn't matter if the attacker used a zero-day or found the password on a sticky note in the breakroom. Once the door is open, the only thing that matters is the blast radius. If your PLM server can talk to your domain controller and your backup repository without any one of them asking for credentials, you didn't get hit by a "sophisticated" attack. You just built a house with no interior walls and then acted surprised when the fire reached the bedroom. The real nightmare here isn't just the data theft; it's the second-order ripple. Think about the customers of GE or Philips. If these companies lose their blueprints or their production schedules get wiped, that doesn't stay inside their corporate firewall. It hits the hospitals waiting for MRI parts and the power plants needing turbine components. The vendor's breach becomes the customer's outage. If you're running a PLM, stop wondering who Clop is. Start wondering if your backups are immutable or if they're just sitting there on a network share waiting to be encrypted. That’s what costs you on a Tuesday. *** **MAILBAG** **Gary from Des Moines: "I keep seeing news about 'AI botnets' and this Ray framework flaw (CVE-2025-62593) that CISA mentioned. I run a small accounting firm with six people. Do I need to be worried about AI taking over my network?"** Gary, let me put your mind at ease. You aren't running the Ray distributed computing framework. It’s used for scaling AI and Python workloads across clusters of machines. Unless your accountant is secretly training a large language model in the closet to do the taxes, this isn't your problem. Most people get targeted because they are easy, not because they are interesting. You aren't an "interesting" target for a high-end botnet. You're a target for the guy who sends a fake invoice that looks like it’s from the electric company. Focus on your MFA and make sure your staff knows not to click links in emails that create a sense of urgent panic. That'll do more for you than worrying about distributed computing flaws. **Sarah from London: "My team is panicking over the Clop news hitting GE and Philips. We use similar PLM tools. Should I be spending my weekend hunting for Indicators of Compromise (IOCs) or just pushing patches?"** Patch first. Always patch first. Hunting for IOCs is a great way to feel productive while your house is still on fire. If there's a patch, apply it. If you can't apply it, isolate the system from the rest of the network until you can. But here is the question you should actually be asking: if you found an IOC right now—if you saw a weird connection to a known Clop C2 server—what happens next? Do you have a plan to kill the session and rotate every single credential in that environment without locking yourself out of your own backups? If the answer is "I'll figure it out when it happens," then the IOCs don't matter. You're just documenting your own demise. **Marcus from Atlanta: "Heights Finance had a breach through a third-party cloud platform affecting over 1.2 million people. I’m a business owner, and we use about ten different SaaS providers for our operations. How do I stop my partners from leaking my data?"** Short answer: you can't. You have zero control over the security posture of a third-party cloud provider. You can send them a twenty-page security questionnaire once a year, and they will lie to you on every single line just to close the sale. It’s a formality. The only way to manage this is to assume they've already been breached. Stop treating your partners as "trusted" zones. If a SaaS provider has access to your data, limit that data to the absolute minimum required for them to function. Look at Comcast. They just agreed to pay north of 117 million dollars to settle a massive customer breach. That's what happens when you hold too much data and fail to protect it. The lesson isn't "use better cloud providers." The lesson is "don't store things you don't need, and don't trust anyone with the keys to the kingdom just because they have a fancy SOC2 report." *** I noticed there were 386 data breach stories reported this week. Nearly 50 of them hit today alone. The noise is deafening. Everyone is chasing the newest CVE or the latest group name. Meanwhile, Apple dropped updates to fix 108 vulnerabilities across iOS and macOS on Monday. Not one of those had been seen in the wild yet. That’s the window we live in. The time between a patch being released and an attacker reverse-engineering it to find the hole is shrinking every year. If you're still relying on a monthly patching cycle, you're essentially inviting people into your network and giving them a map. You have to move faster than the people who are getting paid millions to break your stuff. Check your backups. Then check them again. If they aren't air-gapped, they aren't backups; they're just another thing for the attackers to delete before they send you the ransom note.