1. Executive summary
On 2026-09-23 the ransomware.live index recorded a listing by the group "clop" naming SAUL-ORG.UK (GB) as a victim. The entry is an index record only: it carries a group name, a victim identifier, a country code and a publication timestamp, and no data sample, file listing, negotiation detail or technical artefact. No CVSS score, CISA KEV entry or exploitation state applies, because this is not a vulnerability item. Attribution to a tracked actor is unconfirmed: the verified reference data holds no MITRE ATT&CK profile for "clop", so the group name is an operator self-designation on a leak site and nothing more. For EMEA financial services the immediate exposure is limited to institutions that are the named entity or that share a third party with it; for everyone else this is a monitoring signal, not evidence of a compromise in your estate.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
The source is a leak-site index entry with no confirmed intrusion, no confirmed data theft, no confirmed victim identity and no indication that the named entity is a financial entity, an OES or an RDSP. Mapping DORA Art. 17 or Art. 19, NIS2 Art. 23 or UK NIS 2018 duties onto it would require facts the source does not contain. That changes if any of the following is established: the named domain resolves to a client or a client's ICT third party (DORA Art. 28 and Art. 30 become relevant to the contractual and concentration position), the entity is confirmed as an OES or RDSP (UK NIS 2018 duties attach), or an intrusion at a client is confirmed (DORA Art. 17, Art. 18 and Art. 19, or NIS2 Art. 23, depending on entity type and jurisdiction). Until then, treat this as an intelligence item, not a reportable event.
3. Technical analysis & attack chain
Confirmed steps, and only these:
- On 2026-09-23T14:36:48Z, ransomware.live published an index entry recording a listing by the group "clop" with victim identifier SAUL-ORG.UK and country GB.
- The entry references a leak screenshot. The screenshot content is not reproduced in the source material and no data has been published to the index.
That is the full extent of the confirmed record. The source contains no initial access vector, no exploited component or CVE, no payload or malware capability, no persistence mechanism, no privilege escalation path, no command-and-control detail, no lateral movement, no exfiltration evidence and no stated impact. Nothing in the material identifies the legal entity behind the identifier SAUL-ORG.UK, its sector, its size or its relationship to any financial services firm. The identifier has the form of a domain rather than a registered company name, and the source does not resolve it.
Two caveats on the material itself. First, the listing page carries sponsor content from Hudson Rock promoting infostealer intelligence as a precursor to ransomware attacks. That is advertising on the platform, not evidence about this victim, and it should not be read as a finding. Second, the primary item's own body text is an automated response stating that no reliable information about the named entity could be established. It adds no facts.
Attribution: the group name "clop" appears only as the operator's own label on the leak site. The verified reference data contains no MITRE ATT&CK profile for that name, so no TTP set, tooling or campaign history can be attached to this listing with confidence. Treat the attribution as unconfirmed. Do not map this entry to any tracked intrusion set on the strength of the name alone.
4. Mitigation & containment
P1 (within 24 hours)
- Determine whether saul-org.uk is a client, a client's ICT third party, or a supplier in your register. If it is none of those, close the item as monitoring only and record the decision.
- If it is a client or supplier, contact the named entity's security function through a known-good channel and ask a single question: has an intrusion been detected. Do not reference the leak-site listing in that contact beyond stating that a public claim exists.
- Do not contact the operator, do not visit the leak site from corporate infrastructure, and do not attempt to acquire any published data. Doing so creates legal and sanctions exposure with no defensive benefit.
- Preserve authentication, VPN, EDR and email gateway logs for the affected domain for the last 90 days if the entity is in scope, before any retention rotation.
P2 (within 72 hours)
- Search credential-dump and stealer-log sources for addresses at the saul-org.uk domain. Infostealer-sourced credentials are a common precursor to ransomware access, and this check is cheap. Treat any hit as a credential hygiene issue, not as proof of intrusion.
- Review the third-party contract position for the entity if it is in scope: DORA Art. 30 provisions on incident notification, access and audit rights, and exit are the ones that matter when a supplier is named publicly.
- Confirm that no client-facing service depends on infrastructure at the named domain. If one does, add it to the watch list and raise monitoring on authentication anomalies for that service.
P3 (within 7 days)
- Re-check the listing for a data publication event. A leak-site entry that stays empty is a claim; one that gains a file listing is a different problem and should trigger a fresh assessment.
- If the entity is confirmed as a client, run the DORA Art. 18 classification against the confirmed facts at that point, not against the listing.
There is no vendor fix to apply and no patch to deploy. This item has no software component.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source provides no hashes, domains, IP addresses, file paths, registry keys or command lines. It also provides no behavioural detail that could be observed in telemetry. There is nothing to pivot on.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- ransomware.live, "Victim: SAUL-ORG.UK – clop", https://www.ransomware.live/id/U0FVTC1PUkcuVUtAY2xvcA==, published 2026-09-23. Single source for every fact in this advisory.
8. Adverse Trace position
We assess this as an unverified leak-site claim with no technical corroboration, and we are not assigning it a severity: there is no CVSS score, no CISA KEV entry and no exploitation state to anchor one, and the victim's identity is unresolved. The attribution to "clop" is unconfirmed because the verified reference data holds no MITRE ATT&CK profile for that name, and the entire item rests on a single source, so verify before acting on it. Client impact is nil unless saul-org.uk is confirmed as a client, a client's third party, or an OES/RDSP, in which case the regulatory position in §2 changes and we will say so. We will monitor the listing for a data publication event, attempt to resolve the identifier to a legal entity through public registry and DNS data, and reissue this advisory if corroboration appears. Clients who believe the named domain touches their supply chain should contact their Adverse Trace analyst directly rather than waiting for version 1.1.
Published via PulseTrace — Adverse Trace threat intelligence.