Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1261 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
Victims 1261 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-05-01 Latest victim discovery date
Inactive since 78 days Days since the latest known victim
Top country United States 432 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 1 Onion service Unknown ekbgzchl6x2ias37.onion
    Leak location 2 Onion service Unknown santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Unknown toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion

    Top Activity Sectors (5)

    1. Technology146
    2. Transportation/Logistics68
    3. Consumer Services65
    4. Manufacturing64
    5. Business Services34

    Ransom Notes (4)

    ▼
    AAA_READ_AAA.TXT Details_Cleo.txt clop1.txt clop2.txt

    YARA Rules (1)

    ▼
    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1261)

    Search, filter and paginate the victim timeline for Cl0p. Showing 901–1000 of 1261.

    Type Target Discovered Country Business Category Intel Link
    Ransomware RADISSONHOTELSAMERICAS.COM id7200 View details Hospitality / Food & Beverage / Tourism
    Ransomware CROWE.COM id7176 View details Finance / Legal / Insurance
    Ransomware AUTOZONE.COM id7175 View details Other
    Ransomware BCDTRAVEL.COM id7174 View details Transportation / Travel
    Ransomware AMERICANNATIONAL.COM id7173 View details Finance / Legal / Insurance
    Ransomware USG.EDU id7172 View details United States Education
    Ransomware CYTOMX.COM id7171 View details Other
    Ransomware MARYKAY.COM id7170 View details Other
    Ransomware FISCDP.COM id7169 View details Other
    Ransomware KERNAGENCY.COM id7168 View details Communication / Marketing
    Ransomware UOFLHEALTH.ORG id7167 View details India Healthcare / Pharma
    Ransomware L8SOLUTIONS.CO.UK id7166 View details United Kingdom Services
    Ransomware TDAMERITRADE.COM id7165 View details Other
    Ransomware DELARUE.COM id7159 View details Services
    Ransomware ENERGYTRANSFER.COM id7158 View details Energy
    Ransomware PAYCOR.COM id7157 View details Services
    Ransomware NETSCOUT.COM id7156 View details Telecommunications
    Ransomware WOLTERSKLUWER.COM id7155 View details IT
    Ransomware CADENCEBANK.COM id7154 View details Finance / Legal / Insurance
    Ransomware BANKWITHUNITED.COM id7153 View details Finance / Legal / Insurance
    Ransomware NEWERATECH.COM id7152 View details IT
    Ransomware TRANSPERFECT.COM id7133 View details Services
    Ransomware QUORUMFCU.ORG id7132 View details Finance / Legal / Insurance
    Ransomware MERATIVE.COM id7131 View details Healthcare / Pharma
    Ransomware NORGREN.COM id7130 View details Other
    Ransomware CIENA.COM id7129 View details Telecommunications
    Ransomware KYBURZDRUCK.CH id7128 View details Switzerland Other
    Ransomware UNITEDREGIONAL.ORG id7127 View details Healthcare / Pharma
    Ransomware TDECU.ORG id7126 View details Finance / Legal / Insurance
    Ransomware BRADYID.COM id7125 View details Manufacturing / Engineering
    Ransomware BARRICK.COM id7124 View details Hospitality / Food & Beverage / Tourism
    Ransomware DURR.COM id7123 View details Manufacturing / Engineering
    Ransomware ENCORECAPITAL.COM id7089 View details Other
    Ransomware TRELLISWARE.COM id7088 View details IT
    Ransomware CLICKSGROUP.CO.ZA id7087 View details South Africa Services
    Ransomware HORNBECKOFFSHORE.COM id7086 View details Services
    Ransomware FISGLOBAL.COM id7085 View details Services
    Ransomware DIGITALINSIGHT.COM id7084 View details IT
    Ransomware IRONBOW.COM id7083 View details Services
    Ransomware VERICAST.COM id7082 View details Other
    Ransomware RHENUS.GROUP id7081 View details Transportation / Travel / Logistics
    Ransomware SOVOS.COM id7080 View details IT
    Ransomware HARRINGTONCOMPANY.COM id7079 View details Services
    Ransomware CITYNATIONAL.COM id7078 View details Public Sector
    Ransomware KLGATES.COM id7071 View details Other
    Ransomware KIRKLAND & ELLIS LLP id7070 View details Other
    Ransomware DARLINGCONSULTING.COM id7069 View details Services
    Ransomware CPIAI.COM id7068 View details United States Finance / Legal / Insurance
    Ransomware DELTADENTAL.COM id7067 View details Healthcare / Pharma
    Ransomware COGNIZANT.COM id7066 View details Ireland Other
    Ransomware ENSTARGROUP.COM id7065 View details Services
    Ransomware SAPIENS.COM id7064 View details Finance / Legal / Insurance
    Ransomware CARESOURCE.COM id7063 View details Healthcare / Pharma
    Ransomware JACKSON.COM id7062 View details Other
    Ransomware STARMOUNTLIFE.COM id7061 View details Finance / Legal / Insurance
    Ransomware KOTAKLIFE.COM id7060 View details India Finance / Legal / Insurance
    Ransomware KIRKLAND.COM id7059 View details Other
    Ransomware PROSKAUER.COM id7058 View details Communication / Marketing
    Ransomware ABBVIE.COM id7032 View details Healthcare / Pharma
    Ransomware UCLA.EDU id7031 View details United States Other
    Ransomware SIEMENS-ENERGY.COM id7030 View details Energy
    Ransomware SE.COM id7029 View details France Energy
    Ransomware WERUM.COM id7028 View details Other
    Ransomware MSAMLIN.COM id7007 View details Other
    Ransomware GUSCANADA.CA id6999 View details Canada Other
    Ransomware PWC.COM id6998 View details Construction / Real Estate
    Ransomware EY.COM id6997 View details Construction / Real Estate
    Ransomware SONY.COM id6996 View details Other
    Ransomware ANDESASERVICES.COM id6995 View details Services
    Ransomware ZURICH.COM.BR id6950 View details Brazil Other
    Ransomware CBESERVICES.COM id6949 View details Services
    Ransomware EMSSHI.COM id6948 View details Other
    Ransomware BAESMAN.COM id6947 View details Communication / Marketing
    Ransomware STOCKMANBANK.COM id6946 View details Finance / Legal / Insurance
    Ransomware NORTONLIFELOCK.COM id6945 View details Public Sector
    Ransomware CREELIGHTING.COM id6942 View details Other
    Ransomware SKILLSOFT.COM id6941 View details Education
    Ransomware SCU.EDU id6940 View details United States Education
    Ransomware TELOS.COM id6939 View details Communication / Marketing
    Ransomware GESA.COM id6938 View details Finance / Legal / Insurance
    Ransomware PALIG.COM (PANAMERICAN) id6920 View details Other
    Ransomware NUANCE.COM id6919 View details Healthcare / Pharma
    Ransomware AON.COM id6918 View details Healthcare / Pharma
    Ransomware CEGEDIM.COM id6917 View details Services
    Ransomware STIWA.COM id6916 View details IT
    Ransomware CNCBINTERNATIONAL.COM id6915 View details Services
    Ransomware BOSTONGLOBE.COM id6914 View details Other
    Ransomware ARBURG.COM id6913 View details Other
    Ransomware ICSYSTEM.COM id6912 View details Services
    Ransomware UMSYSTEM.EDU id6911 View details United States Education
    Ransomware COLUMBIABANK.COM (UMPQUABANK.COM) id6910 View details Finance / Legal / Insurance
    Ransomware PRAGROUP.NO id6909 View details Norway Communication / Marketing
    Ransomware MARTI.COM id6908 View details Other
    Ransomware EASTWESTBANK.COM id6904 View details Finance / Legal / Insurance
    Ransomware POWERFI.ORG id6903 View details Energy
    Ransomware BARHARBOR.BANK id6902 View details Finance / Legal / Insurance
    Ransomware APLUSFCU.ORG id6901 View details Finance / Legal / Insurance
    Ransomware BRAULT.US id6900 View details United States Communication / Marketing
    Ransomware GENERICON.AT id6897 View details Austria Healthcare / Pharma
    Ransomware CARESERVICESLLC.COM id6896 View details Services