Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1261 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
Victims 1261 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-05-01 Latest victim discovery date
Inactive since 78 days Days since the latest known victim
Top country United States 432 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 1 Onion service Unknown ekbgzchl6x2ias37.onion
    Leak location 2 Onion service Unknown santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Unknown toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion

    Top Activity Sectors (5)

    1. Technology146
    2. Transportation/Logistics68
    3. Consumer Services65
    4. Manufacturing64
    5. Business Services34

    Ransom Notes (4)

    AAA_READ_AAA.TXT Details_Cleo.txt clop1.txt clop2.txt

    YARA Rules (1)

    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1261)

    Search, filter and paginate the victim timeline for Cl0p. Showing 1–100 of 1261.

    Type Target Discovered Country Business Category Intel Link
    Ransomware INJURYLAWYERS.COM id28335 View details United States Finance / Legal / Insurance
    Ransomware INTEGRALIFE.COM id28336 View details United States Healthcare / Pharma
    Ransomware AIGHEALTHCARE.IN id27709 View details India Healthcare / Medicine
    Ransomware CLOUD.CLEARWAYGROUP.COM id27708 View details Services
    Ransomware DAD.CO.TH id26532 View details Thailand IT
    Ransomware THEMORTGAGEFIRM.COM id26531 View details United States Communication / Marketing
    Ransomware FISHWINDOWCLEANING.COM id26530 View details United States Energy
    Ransomware SOLUTIONSINSAFETY.COM id26529 View details Services
    Ransomware BOYDEN.COM id26528 View details United States Services
    Ransomware CFDT.FR id26527 View details France Healthcare / Pharma
    Ransomware SPOHNASSOCIATES.COM id26526 View details United States Communication / Marketing
    Ransomware GARNERGROUP.NET id26525 View details Services
    Ransomware THEPERPETUAL.COM id26524 View details United States Other
    Ransomware AIGBUSINESS.COM id26523 View details Services
    Ransomware HYDEPARKUMC.ORG id26522 View details United States Other
    Ransomware GIACARE.COM id26521 View details United States Healthcare / Pharma
    Ransomware GIASPACE.COM id26520 View details United States Services
    Ransomware ONESUPPORT.COM id26519 View details United States Services
    Ransomware HUDSONSUSTAINABLE.COM id26518 View details United States Finance / Legal / Insurance
    Ransomware GOKALLIT.COM id26517 View details Other
    Ransomware CHEHARDY.COM id26516 View details United States Other
    Ransomware RBDCONSTRUCTION.COM id26515 View details United States Construction / Real Estate
    Ransomware BROADREACHRETAIL.COM id26514 View details United States Retail / E-commerce
    Ransomware BE09.FR id26513 View details France Other
    Ransomware SMITHIPSERVICES.COM id26512 View details Services
    Ransomware PROACTIVEMEDICAL.COM id26511 View details United States Communication / Marketing
    Ransomware ITARCHITECHS.COM id26510 View details United States IT
    Ransomware HUDSONEXECUTIVE.COM id26509 View details United States Finance / Legal / Insurance
    Ransomware ANSTECHINC.COM id26508 View details United States IT
    Ransomware MNKASSOCIATES.COM id26339 View details Other
    Ransomware VIPPLLC.COM id26338 View details Services
    Ransomware TRJLTD.CO.UK id26337 View details United Kingdom Services
    Ransomware STRATEGICOBJECTIVES.COM id26336 View details Canada Communication / Marketing
    Ransomware IDEALWELDERS.COM id26335 View details Canada Manufacturing / Engineering
    Ransomware CROWDEDISLAND.COM id26334 View details Other
    Ransomware DUKOSI.COM id26333 View details United Kingdom IT
    Ransomware CONWEST.COM id26332 View details Canada Other
    Ransomware NGATTORNEYS.COM id26331 View details Finance / Legal / Insurance
    Ransomware LABINF.IT id26330 View details Italy Other
    Ransomware AUGUSTEA.COM id26329 View details Italy Communication / Marketing
    Ransomware MEDIAWORLD.COM.HK id26328 View details Hong Kong Communication / Marketing
    Ransomware WARDHAVENCAPITAL.COM id26327 View details Other
    Ransomware LONGHORNORGANICS.COM id26326 View details United States Communication / Marketing
    Ransomware DCSNORWAY.COM id26325 View details Norway Other
    Ransomware SHACKELFORD.LAW id26324 View details Finance / Legal / Insurance
    Ransomware SERVE-CLOUD.COM id26323 View details IT
    Ransomware MARK-FINN.CO.UK id26322 View details United Kingdom Construction / Real Estate
    Ransomware EMEG.CO.UK id26321 View details United Kingdom Communication / Marketing
    Ransomware LOGICALMICRO.COM id26320 View details United Kingdom Other
    Ransomware HODERO HOLDINGS LTD id26319 View details Bermuda Services
    Ransomware NVHG.COM id26318 View details United States Other
    Ransomware WHEELOCKST.COM id26317 View details United States Other
    Ransomware DESKTOPG.COM id26316 View details Other
    Ransomware CMHHELI.COM id26315 View details Canada Transportation / Travel
    Ransomware COWANS.ORG id26314 View details Other
    Ransomware HTHELI.COM id26313 View details China Communication / Marketing
    Ransomware GRANITEPOINTE.CA id26312 View details Canada Communication / Marketing
    Ransomware SMTLAWYERS.CA id26311 View details Canada Finance / Legal / Insurance
    Ransomware CLOUDDATAWORKS.CA id26310 View details Canada IT
    Ransomware SENSIBLESOLUTIONS.CA id26309 View details Canada Services
    Ransomware KVHELI.WORDPRESS.COM id26308 View details Communication / Marketing
    Ransomware WHOLEIT.COM.AU id26307 View details Australia Other
    Ransomware SKYEEXCAVATIONS.COM.AU id26306 View details Australia Communication / Marketing
    Ransomware ROBERTSDESIGNS.COM.AU id26305 View details Australia Other
    Ransomware Y-ARCHITECTURE.STUDIO id26304 View details Japan Construction / Real Estate
    Ransomware VENTNOR.COM.AU id26303 View details Australia Other
    Ransomware RMWGROUP.COM.AU id26302 View details Australia Hospitality / Food & Beverage / Tourism
    Ransomware PODIATRYWA.COM.AU id26301 View details Australia Communication / Marketing
    Ransomware MRAGROUP.COM.AU id26300 View details Australia Services
    Ransomware THEHALEROAD.COM.AU id26299 View details Australia Retail / E-commerce
    Ransomware ETTOAUSTRALIA.COM id26298 View details Australia Retail / E-commerce
    Ransomware NEXTPHAZE.COM.AU id26297 View details Australia Other
    Ransomware KLMEQUITIES.COM id26296 View details United States Other
    Ransomware NYASPHALT.COM id26295 View details United States Construction / Real Estate
    Ransomware KRIEGMANANDSMITH.COM id26294 View details United States Construction / Real Estate
    Ransomware ISLANDOUTPOST.COM id26293 View details Hospitality / Food & Beverage / Tourism
    Ransomware GALEINTL.COM id26292 View details United States Construction / Real Estate
    Ransomware CENTINELA.COM.BR id26291 View details Brazil Other
    Ransomware MCKEEGROUP.NET id26290 View details Services
    Ransomware ESCALI.COM id26289 View details United States Communication / Marketing
    Ransomware COBU-ARCH.COM id26288 View details Japan Other
    Ransomware ARKTLA.ORG id26287 View details United States Other
    Ransomware M-B.LAW id26286 View details Germany Finance / Legal / Insurance
    Ransomware WRENLAWFIRM.COM id25807 View details Finance / Legal / Insurance
    Ransomware LDHRLAW.COM id25806 View details United States Finance / Legal / Insurance
    Ransomware GENESYSSPINE.COM id25805 View details United States Healthcare / Pharma
    Ransomware HILTON.COM id25804 View details United States Hospitality / Food & Beverage / Tourism
    Ransomware WEATHER.COM id25803 View details United States Communication / Marketing
    Ransomware WHISKIJACKRESORTS.COM id25802 View details Canada Hospitality / Food & Beverage / Tourism
    Ransomware GROUPAMS.CO.UK id25801 View details United Kingdom Services
    Ransomware RTCCOMPUTERS.COM id25800 View details IT
    Ransomware CCCM.BC.CA id25799 View details Canada Other
    Ransomware TECHNIKEL.CA id25798 View details Canada IT
    Ransomware KAZMILAW.COM id25797 View details Türkiye Finance / Legal / Insurance
    Ransomware WFRFIRE.COM id25796 View details United States Communication / Marketing
    Ransomware VERTIGORELEASING.COM id25795 View details Communication / Marketing
    Ransomware BR-ALSETH.NO id25794 View details Norway Other
    Ransomware 4DITSOLUTIONS.COM id25793 View details Services
    Ransomware VISTA-TRAINING.COM id25792 View details United States Education
    Ransomware RSTRT.IT id25791 View details Italy Other