Cl0p has a business model, and it’s depressingly repeatable. Find one unauthenticated bug in a widely deployed enterprise app that moves or manages files. Exploit it quietly. Steal the data. Then send extortion emails to hundreds of employees at once. They did it with MOVEit in 2023, with Cleo file-transfer in 2024, and this month with PTC Windchill — CVE-2026-12569, a CVSS 9.3 unauthenticated remote code execution chain, with the first extortion emails landing July 20.

The pattern never changes because it doesn’t have to. There is always another file-transfer box, product-lifecycle system, or admin panel sitting on the public internet that someone forgot about. The single best defense a noob (or a whole company) can deploy is embarrassingly low-tech: know exactly what you’re exposing, and expose less of it. This tutorial teaches you to audit your own attack surface the way an attacker enumerates it.

Scope note: only scan hosts and IPs you own or have explicit written permission to test. Scanning someone else’s systems is illegal in most places. Everything below is for your home lab, your server, your company’s assets with sign-off. If you’re new to the tool, start with our complete guide to using nmap.

Step 1: Know Your Own Perimeter

Attackers start by figuring out what IP addresses and hostnames belong to you. You should know this better than they do. Make a list:

  • Your home/office public IP: curl -s https://ifconfig.me
  • Any VPS or cloud servers you run (check every provider account — the forgotten $5 droplet is the one that gets you).
  • Domains and subdomains you own. Subdomains are where “temporary” and “test” servers hide forever.

For subdomains you control, a quick passive sweep using certificate transparency logs:

# List subdomains that have ever been issued a TLS cert for your domain
curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | tr ',' '\n' | grep -oE '[a-zA-Z0-9._-]+\.example\.com' \
  | sort -u

Replace example.com with a domain you own. That dev., vpn., mft., or old-portal. subdomain you’d forgotten? That’s exactly what Cl0p’s initial-access crews go looking for.

Step 2: Enumerate What’s Actually Listening

Now scan your own hosts to see which ports and services face the internet. Run this against your public IP or your own server:

# Fast top-ports sweep with service/version detection (your host only!)
nmap -sV -T4 --top-ports 1000 YOUR.IP.ADDRESS.HERE

# Then a fuller sweep for the sneaky high ports admin panels love
nmap -sV -p- --open -T4 YOUR.IP.ADDRESS.HERE

What you’re hunting for is anything you didn’t deliberately decide to publish. Red flags, roughly in order of “fix this tonight”:

  • Admin / management interfaces on 8443, 9443, 10000, 8080, 7001, etc. — RMM consoles, appliance managers, PLM portals. These are Cl0p’s favorite front doors.
  • File-transfer services — MFT web UIs, SFTP/FTP that shouldn’t be public, WebDAV.
  • Databases — 3306 (MySQL), 5432 (Postgres), 27017 (MongoDB), 6379 (Redis) should almost never be internet-facing.
  • Remote access — 3389 (RDP), 5900 (VNC) exposed to the world.
  • Old, unpatched web apps — anything whose version banner is years out of date.

Write down every open port and answer one question for each: Do I have a specific reason for the entire internet to reach this? If the answer is “no” or “I’m not sure,” that’s a finding.

Step 3: See Yourself the Way Attackers Do

Attackers rarely scan the whole internet themselves — they query databases that already did. You can use the same ones (for your own assets) to catch exposure you missed:

  • Shodan — search ip:YOUR.IP.ADDRESS to see everything Shodan already indexes about your host: open ports, banners, known CVEs, even screenshots of exposed web panels. This is free reconnaissance on yourself.
  • Censys — similar, strong on TLS certs and service fingerprints.

If Shodan is showing an admin login panel or a file-transfer UI for your IP, so is every ransomware affiliate running automated scans. Seeing your own exposure through their lens is the fastest gut-check there is.

Step 4: Match Exposure Against Known-Exploited Bugs

An open port is a risk. An open port running software with a known, actively exploited vulnerability is an emergency. CISA maintains the Known Exploited Vulnerabilities (KEV) catalog — bugs confirmed to be exploited in the wild, exactly like CVE-2026-12569.

Cross-reference the service versions nmap gave you against KEV:

# Pull the KEV catalog and search it for a product you're running
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | grep -iE "windchill|moveit|cleo|fortinet|kemp|n-central" -A2

Anything that matches something you expose is a drop-everything-and-patch item. (We’ll turn this into an automated personal watchlist in an upcoming tutorial.)

Step 5: Shrink the Surface

Finding exposure is half the job. Now reduce it. In priority order:

  1. Take it off the internet. The most secure port is one that’s closed. Does that MFT portal, admin console, or database really need to be public? Almost never. Move it behind the perimeter.
  2. Put remote access behind a VPN or reverse proxy. Admin panels, RDP, and management UIs should require you to be on a private network first. A WireGuard tunnel takes 20 minutes to set up and removes the panel from the public internet entirely.
  3. Patch what must stay exposed. If a service genuinely has to be public (your website, your mail server), it goes to the front of the patch queue and stays there.
  4. Add authentication and rate limits to anything reachable — but treat this as a backstop, not the primary control. Cl0p’s bugs were unauthenticated; a login page in front of a pre-auth RCE doesn’t help.
  5. Re-scan and confirm. After each change, run the nmap sweep again. The port should be gone. Trust the scan, not your memory of the config change.

Make It a Habit

Attack surface isn’t a one-time cleanup — it grows every time you spin up a new service and forget about it. Put a recurring reminder in your calendar:

  • Monthly: re-run the nmap sweep against your public IPs and check Shodan for surprises.
  • Whenever you launch something new: immediately ask “is this reachable from the internet, and does it need to be?”
  • Whenever a big MFT/edge CVE hits the news: check whether you run it, before the extortion email arrives.

The Bottom Line

Cl0p’s entire operation depends on the fact that organizations don’t know what they’re exposing. Every MOVEit, Cleo, and Windchill campaign is really the same story: an internet-facing app nobody was watching, a pre-auth bug, and a data theft that becomes an extortion email weeks later. You beat that not with a fancy tool but with a boring habit — enumerate your own perimeter, question every open port, and take the ones you can’t justify off the internet. Scan yourself before someone else does it for you.

The full breakdown of the Cl0p Windchill campaign, including how the extortion emails were sent from compromised internal accounts, is on our sister site: Cl0p Found the Next MOVEit.