> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Ransomware: clop named AMEY-CO.UK (GB)
- URL: https://f4n6.co.uk/security-feed/ransomware-clop-named-amey-co-uk-gb/
- Published: 2026-09-23T20:06:57.000Z
- Updated: 2026-09-23T20:06:57.000Z
- Author: Jeff Davies
- Tags: #security-feed, clop

## 1\. Executive summary

On 2026-09-23 the ransomware.live victim index recorded a listing in which the extortion group "clop" names "AMEY-CO.UK" (country: GB) as a victim. The indexed entry contains no proof-of-compromise material, no data samples, no file listing, and no description of how access was obtained. The victim string does not correspond to a confirmed corporate entity in the source material, and the source itself flags possible confusion with Amey plc (amey.co.uk), a UK infrastructure and facilities management company. No CVE appears in the verified reference data for this item, so no CVSS score, severity rating, or CISA KEV exploitation state can be assigned, and the clop attribution is unconfirmed because the actor has no MITRE ATT&CK profile in that data. Treat this as a single-sourced extortion claim requiring independent corroboration before it is acted on as a confirmed incident.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The only confirmed facts are that a leak-site listing was published and indexed; there is no confirmed incident at a client, no confirmed affected ICT third party, and no confirmed service disruption or data loss. Mapping DORA Art. 19 or NIS2 Art. 23 reporting duties to an unverified third-party claim would create a reporting obligation that the evidence does not support.

One conditional point. If a client confirms that AMEY-CO.UK is an entity in its ICT third-party register, DORA Art. 28 (ICT third-party risk, general principles) and NIS2 Art. 21(2)(d) (supply chain security measures) are engaged by the supplier relationship itself, not by this listing. That determination is a register question, not an incident-response question, and it should be answered before any reporting clock is started.

## 3\. Technical analysis & attack chain

Confirmed steps, and they are few:

1. The group "clop" published a victim entry naming "AMEY-CO.UK" with country GB and website AMEY-CO.UK.
2. ransomware.live indexed that entry on 2026-09-23T14:28:12Z.

That is the full extent of what the source material establishes. There is no initial access vector, no exploited component, no payload description, no persistence mechanism, no privilege escalation path, no command-and-control detail, no lateral movement, and no exfiltration evidence in the indexed entry. The entry carries no leak screenshot content and no data sample. Any attack chain written for this item beyond the two steps above would be invention.

The related corpus entries are separate clop victim listings, not evidence about this victim. Six of them (mam\*\*\*\*\*\*\*, clo\*\*\*\*\*\*\*, sma\*\*\*\*\*\*\*, bri\*\*\*\*\*\*\*, g\*\*\*\*\*\*\*, ato\*\*\*\*\*\*\*) each carry a bracketed reference to CVE-2026-12569 alongside a short data-type string: databases and project files in four cases, software backups and system files in one, and .png files with a Windchill-related string in another. Two caveats apply. First, CVE-2026-12569 does not appear in the verified reference data supplied for this advisory, so no CVSS score, severity, or CISA KEV exploitation state can be stated for it, and Adverse Trace has not independently validated the identifier. Second, these are other victims' listings; they indicate a recurring reference pattern across clop postings, not that the same vulnerability was used against AMEY-CO.UK. Single-sourced; verify before using CVE-2026-12569 as a prioritisation input.

The victim identity is unresolved. The source text explicitly states it cannot confirm a company operating under the domain AMEY-CO.UK and notes the string is distinct from amey.co.uk. The hyphen placement means the domain could be a typo, a lookalike registration, or a genuinely separate entity. Adverse Trace has not confirmed which, and clients should not assume the listing refers to Amey plc on the strength of this entry alone.

## 4\. Mitigation & containment

There is no vendor fix to name, because no vulnerability or affected product is identified in the source material. The actions below address the claim itself and the exposure question it raises.

### P1 (within 24h)

- Search your third-party and vendor register for the exact string "AMEY-CO.UK" and for any supplier whose registered domain differs from its trading name by hyphenation or similar typographic variation. Confirm whether any entity in scope matches.
- If a match is found, contact the supplier through a channel you already hold (account manager, contract notice address) and ask directly whether they have received an extortion demand. Do not use contact details taken from the leak-site entry.
- Do not block or sinkhole the domain on the basis of this listing alone. It is unverified and may belong to an unrelated party.

### P2 (within 72h)

- If a supplier relationship is confirmed, invoke the incident notification clause in the contract and request a written statement of whether data belonging to your organisation was held by that supplier.
- Where the supplier processes personal data, confirm with your DPO whether a personal data breach notification assessment is required under UK GDPR, independent of any DORA or NIS2 question.
- Preserve any supplier correspondence and the original listing URL with its retrieval timestamp for the incident file.

### P3 (within 7 days)

- Add the victim string to leak-site monitoring so that any later publication of proof-of-compromise material, data samples, or a countdown timer is picked up and routed to the same incident file.
- Review whether your supplier onboarding process would have caught a domain that differs from a known trading name only by punctuation. If not, that is a register data-quality fix, not a security control.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

The indexed entry contains no hashes, no domains beyond the victim string itself, no IP addresses, no file paths, no registry keys, and no email addresses. No behavioural indicators are available either: the source describes no authentication pattern, device registration, process activity, or network activity. There is nothing to place in a copyable indicator block.

## 6\. Detection

Insufficient indicators to author detection rules.

The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text, or hard-coded values belonging to the threat. The only strings present are the victim name, the actor name, and a CVE identifier, none of which are artefacts of malicious code or traffic. A rule built from those would detect reporting about the claim, not the activity.

## 7\. Sources

- ransomware.live, "Victim: AMEY-CO.UK – clop", https://www.ransomware.live/id/QU1FWS1DTy5VS0BjbG9w, indexed 2026-09-23T14:28:12Z (primary item; single source for the victim claim)
- ransomware.live, "Ransomware: clop named mam\*\*\*\*\*\*\*", https://www.ransomware.live/id/bWFtKioqKioqKkBjbG9w (related corpus entry; CVE-2026-12569 reference)
- ransomware.live, "Ransomware: clop named clo\*\*\*\*\*\*\*", https://www.ransomware.live/id/Y2xvKioqKioqKkBjbG9w (related corpus entry; CVE-2026-12569 reference)
- ransomware.live, "Ransomware: clop named sma\*\*\*\*\*\*\*", https://www.ransomware.live/id/c21hKioqKioqKkBjbG9w (related corpus entry; CVE-2026-12569 reference)
- ransomware.live, "Ransomware: clop named bri\*\*\*\*\*\*\*", https://www.ransomware.live/id/YnJpKioqKioqKkBjbG9w (related corpus entry; CVE-2026-12569 reference)
- ransomware.live, "Ransomware: clop named g\*\*\*\*\*\*\*", https://www.ransomware.live/id/ZyoqKioqKipAY2xvcA== (related corpus entry; CVE-2026-12569 reference)
- ransomware.live, "Ransomware: clop named ato\*\*\*\*\*\*\*", https://www.ransomware.live/id/YXRvKioqKioqKkBjbG9w (related corpus entry; CVE-2026-12569 reference)

## 8\. Adverse Trace position

Adverse Trace assesses this item as an unverified extortion claim with no assessable severity. No CVE in the verified reference data applies, so no CVSS score or CISA KEV state can be cited, and the clop attribution is unconfirmed because the actor has no MITRE ATT&CK profile in that data. The claim rests on a single source, the ransomware.live index, which republishes operator-posted material without validating it; the victim string is not confirmed to correspond to any real entity, and the source itself raises the possibility of confusion with Amey plc. Client impact is therefore conditional: exposure exists only if a client can confirm AMEY-CO.UK as an entity in its own third-party register, and that is a register query, not an incident. We will monitor the listing for proof-of-compromise material, data samples, or a countdown timer, and we will reissue this advisory with a severity assessment if the victim identity is confirmed or if CVE-2026-12569 appears in the verified reference data with a KEV state. Clients who confirm a supplier match should notify their Adverse Trace contact so the exposure can be tracked against the same case.

---

[Read the original source →](https://www.ransomware.live/id/QU1FWS1DTy5VS0BjbG9w?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*