> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware: clop named INFINIGATE.CH(INFINIGATE.CO.UK) (GB) - URL: https://f4n6.co.uk/security-feed/ransomware-clop-named-infinigate-ch-infinigate-co-uk-gb/ - Published: 2026-09-23T20:06:48.000Z - Updated: 2026-09-23T20:06:48.000Z - Author: Jeff Davies - Tags: #security-feed, clop ## 1\. Executive summary On 2026-09-23 the ransomware group clop listed INFINIGATE.CH and INFINIGATE.CO.UK on its public leak site. Infinigate is a Switzerland-headquartered cybersecurity value-added distributor that sells security, networking and cloud products to resellers across Europe, including the UK. The indexed record carries no data samples, no file listing, no CVE and no proof of exfiltration, and the verified reference data holds no CVSS score, no CISA KEV entry and no MITRE ATT&CK profile for clop, so the group attribution rests on the leak-site post alone and is unconfirmed. For EMEA financial services the exposure is indirect: Infinigate supplies the reseller channel through which many institutions buy security licences and support, so the question is whether contracted services or partner-portal accounts are affected, not whether client data was taken. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | A named supplier in the security-product distribution chain has been publicly listed by a ransomware group. This applies only where the client contracts with Infinigate, or with a reseller it supplies, for an ICT service. | Confirm whether Infinigate or a supplying reseller sits in your register of information, and obtain a written service-status statement from the account owner. | | NIS2 Art. 21(2)(d) | The same fact, for entities in scope of NIS2: a supplier in the security-product supply chain is the subject of a public extortion listing. | Record a supply chain security assessment for that supplier relationship and the outcome of the service-status check. | No other article in the regulatory reference is engaged. The listing is a claim by the actor, not a confirmed incident at the victim, and nothing in the source establishes an impact on any client's own network. ## 3\. Technical analysis & attack chain The source contains no technical detail. What the indexed record establishes is limited to the following. 1. At 2026-09-23T14:35:37 UTC, ransomware.live indexed a clop leak-site entry naming INFINIGATE.CH (INFINIGATE.CO.UK), country GB, website INFINIGATE.CO.UK. 2. The indexed record shows no leaked file listing, no sample documents and no populated screenshot field. 3. No CVE, no initial-access vector, no dwell time, no tooling and no exfiltration volume is given for this victim. There is therefore no confirmed attack chain to describe. The initial access vector, the exploited component, the payload, any persistence mechanism, privilege escalation, command-and-control, lateral movement and data access are all unknown from the material provided. The company description in the source is marked as platform-generated text, not victim confirmation, and should not be read as verification that Infinigate's own systems were compromised. One detail from adjacent listings is worth recording, with a clear caveat. Five other clop entries in the same index carry a tag reading CVE-2026-12569 and list exfiltrated data categories: databases, projects, project backups, SQL database backups, logs, software installers, and PDF, TXT, XML, XLSX, XLS and DOCX files. That tag does not appear on the Infinigate entry, and CVE-2026-12569 is absent from the verified reference data, so there is no CVSS score, no severity and no CISA KEV state for it, and no basis to link it to this victim. The claim is single-sourced to the ransomware.live index and unverified; do not build detection or patching decisions on it. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Establish whether Infinigate, or a reseller supplied by it, appears in your register of information or supplier inventory. If it does, contact the account owner through a channel already on file and request written confirmation of service status, and specifically whether any partner portal, licence-delivery system or support function is affected. - Treat any inbound email, call or portal message that cites the leak-site listing and asks for payment, credential entry or a callback on a new number as a potential fraud attempt. Verify through the contact details already on file before acting on it. - If your organisation holds accounts on Infinigate partner or support portals, pull authentication logs for those accounts for the last 30 days and look for logins from new source countries or ASNs. Rotate credentials for any account with administrative rights on the portal. ### P2 (within 72 hours) - Review the contract with the supplier against the key contractual provisions required by DORA Art. 30: incident notification timelines, service continuity, audit and information rights, and exit. Ask for the notification the contract requires rather than waiting for it. - If the supplier delivers licences or support for a regulated service, document a fallback route: which alternative reseller or vendor direct channel can supply the same entitlements, and how long a switch would take. - Determine what of yours the supplier holds: support tickets, configuration exports, licence entitlement records, named contact databases. Ask the supplier to confirm the categories it holds on your behalf. ### P3 (within 7 days) - Add the supplier to enhanced monitoring for 90 days: watch for follow-on leak-site posts, the appearance of data samples, and any edit to the existing entry. - Re-walk your incident classification and reporting path under DORA Art. 18 and Art. 19 so that a supplier confirmation of impact on your services can be classified and reported without delay. - Where the relationship is material to a critical or important function, feed the outcome into the concentration-risk assessment under DORA Art. 29. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The only observable artefact is the leak-site entry itself, which is not machine-pivotable. No hashes, domains, IP addresses, file paths, registry keys or command lines are present in the source. ## 6\. Detection Insufficient indicators to author detection rules. ## 7\. Sources - ransomware.live, "Victim: INFINIGATE.CH(INFINIGATE.CO.UK) – clop", https://www.ransomware.live/id/SU5GSU5JR0FURS5DSChJTkZJTklHQVRFLkNPLlVLKUBjbG9w, 2026-09-23 - ransomware.live, "Ransomware: clop named sp***\****", https://www.ransomware.live/id/c3AqKioqKioqQGNsb3A= - ransomware.live, "Ransomware: clop named lif***\****", https://www.ransomware.live/id/bGlmKioqKioqKkBjbG9w - ransomware.live, "Ransomware: clop named int***\****", https://www.ransomware.live/id/aW50KioqKioqKkBjbG9w - ransomware.live, "Ransomware: clop named ipm***\****", https://www.ransomware.live/id/aXBtKioqKioqKkBjbG9w - ransomware.live, "Ransomware: clop named STNET.IT (IT)", https://www.ransomware.live/id/U1RORVQuSVRAY2xvcA== - ransomware.live, "Ransomware: clop named wat***\****", https://www.ransomware.live/id/d2F0KioqKioqKkBjbG9w ## 8\. Adverse Trace position Adverse Trace assesses this as an unconfirmed extortion listing with no technical corroboration. There is no CVE, no CVSS score, no CISA KEV entry and no MITRE ATT&CK profile for clop in the reference data, so we assign no severity rating and we do not treat the group attribution as established. The client impact is supply-chain: institutions that buy security products or support through Infinigate or its resellers should confirm service status and establish what supplier-held data exists. We will monitor the leak-site entry for data samples or a file listing, watch for follow-on posts naming the same victim or its resellers, and re-issue this advisory if samples appear or if the supplier confirms an impact on client services. --- [Read the original source →](https://www.ransomware.live/id/SU5GSU5JR0FURS5DSChJTkZJTklHQVRFLkNPLlVLKUBjbG9w?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*