Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1261 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
Victims 1261 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-05-01 Latest victim discovery date
Inactive since 78 days Days since the latest known victim
Top country United States 432 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 1 Onion service Unknown ekbgzchl6x2ias37.onion
    Leak location 2 Onion service Unknown santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Unknown toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion

    Top Activity Sectors (5)

    1. Technology146
    2. Transportation/Logistics68
    3. Consumer Services65
    4. Manufacturing64
    5. Business Services34

    Ransom Notes (4)

    ▼
    AAA_READ_AAA.TXT Details_Cleo.txt clop1.txt clop2.txt

    YARA Rules (1)

    ▼
    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1261)

    Search, filter and paginate the victim timeline for Cl0p. Showing 1001–1100 of 1261.

    Type Target Discovered Country Business Category Intel Link
    Ransomware ENZO.COM id6895 View details Other
    Ransomware 316FIDUCIARIES.COM id6894 View details Other
    Ransomware DELAWARELIFE.COM id6893 View details United States Finance / Legal / Insurance
    Ransomware NAVAXX.LU id6892 View details Luxembourg Other
    Ransomware CUANSWERS.COM id6891 View details Other
    Ransomware SYNLAB.FR id6890 View details France Healthcare / Pharma
    Ransomware HEALTHEQUITY.COM id6889 View details Healthcare / Pharma
    Ransomware uga.edu id6870 View details United States Other
    Ransomware leggett.com id6869 View details Other
    Ransomware bankers-bank.com id6868 View details Finance / Legal / Insurance
    Ransomware heidelberg.com id6867 View details Communication / Marketing
    Ransomware landal.com id6866 View details Switzerland Public Sector
    Ransomware uhcsr.com id6865 View details Other
    Ransomware oekk.ch id6864 View details Switzerland Other
    Ransomware studentclearinghouse.org id6863 View details Education
    Ransomware putnam.com id6862 View details Finance / Legal / Insurance
    Ransomware datasite.com id6861 View details Communication / Marketing
    Ransomware 1stsource.com id6860 View details Finance / Legal / Insurance
    Ransomware shell.com id6859 View details Other
    Ransomware MICHENER.CA id6809 View details Canada Education
    Ransomware HCI.EDU id6808 View details United States Education
    Ransomware 360EQUIPMENTFINANCE.COM id6807 View details Finance / Legal / Insurance
    Ransomware PRECISIONMEDICALBILLING.NET id6806 View details Healthcare / Pharma
    Ransomware IDTECHPRODUCTS.COM id6333 View details IT
    Ransomware MYSIMPLYGREEN.COM id6309 View details Other
    Ransomware GC-EMPLOYMENT.COM id6278 View details Communication / Marketing
    Ransomware AUT-TECH-GROUP.COM id6196 View details IT
    Ransomware LASOTEL.FR id5994 View details France Other
    Ransomware MULTIPLAN.COM id5974 View details Other
    Ransomware BISSELL.COM id5894 View details Other
    Ransomware EMERALDX.COM id5893 View details Other
    Ransomware CAJASANRAFAEL.COM.MX id5892 View details Mexico Other
    Ransomware TAS.GOV.AU id5891 View details Australia Public Sector
    Ransomware ENERJISAURETIM.COM id5890 View details Other
    Ransomware INTELLICARE.COM.PH id5889 View details Philippines Other
    Ransomware CRESCENTHOTELS.COM id5888 View details Hospitality / Food & Beverage / Tourism
    Ransomware COLMAC.COM id5887 View details Services
    Ransomware INVESTORCOM.COM id5886 View details Communication / Marketing
    Ransomware IMAGINE360.COM id5884 View details Other
    Ransomware THECYPRINUS.COM id5882 View details Communication / Marketing
    Ransomware SPI.CO.ZA id5881 View details South Africa Other
    Ransomware DETECH.COM.TR id5880 View details Türkiye IT
    Ransomware GRUPOFLORAPLANT.COM id5879 View details Other
    Ransomware ALTO.US id5878 View details United States Retail / E-commerce
    Ransomware GOA.GOV.IN id5875 View details India Other
    Ransomware INTERTERMINALS.COM id5874 View details Other
    Ransomware GLOBALFARM.COM.AR id5873 View details Argentina Agriculture / Food
    Ransomware ATOS.NET id5872 View details Other
    Ransomware TGW.COM id5871 View details Other
    Ransomware DERK.CL id5870 View details Chile Other
    Ransomware REDBOXVOICE.COM id5869 View details Other
    Ransomware PROGRESSION.COM id5868 View details Communication / Marketing
    Ransomware UNIMELB.EDU.AU id5867 View details Australia Education
    Ransomware CROWNRESORT.COM.AU id5866 View details Australia Hospitality / Food & Beverage / Tourism
    Ransomware BRIDGEWAY.COM.PH id5865 View details Philippines Communication / Marketing
    Ransomware TLG.COM id5864 View details Other
    Ransomware PHOENIX.TECH id5860 View details IT
    Ransomware SODALESSOLUTIONS.COM id5859 View details Services
    Ransomware NATIONSBENEFITS.COM id5858 View details Healthcare / Pharma
    Ransomware SHOLASTIC.COM id5857 View details Other
    Ransomware VUMACAM.CO.ZA id5856 View details South Africa Other
    Ransomware TORONTO.CA id5855 View details Canada Public Sector
    Ransomware CLOUDMED.COM id5854 View details IT
    Ransomware DPWORLD.COM id5853 View details Other
    Ransomware SOLPAC.CO.JP id5852 View details Japan Other
    Ransomware VIRGIN.COM id5851 View details Other
    Ransomware LEGACY-TECHNOLOGIES.DE id5850 View details Germany IT
    Ransomware OSHCO.COM id5849 View details Other
    Ransomware GRAY.TV id5848 View details Other
    Ransomware ORCAAUDIT.COM id5847 View details Finance / Legal / Insurance
    Ransomware CHEMILAB.COM.CO id5846 View details Colombia Other
    Ransomware PAYBOXAPP.COM id5839 View details Other
    Ransomware VERRAMOBILITY.COM id5838 View details Other
    Ransomware BUNZL.COM id5837 View details Other
    Ransomware FIRST-CENTRAL.COM id5836 View details Other
    Ransomware ALIVIAHELTH.COM id5835 View details Other
    Ransomware HORMELFOODS.COM id5834 View details Agriculture / Food
    Ransomware THECROSBYGROUP.COM id5833 View details Services
    Ransomware MUNICHRE.COM id5832 View details Other
    Ransomware GRUPOVANTI.COM id5831 View details Other
    Ransomware VOLARIS.COM id5830 View details Other
    Ransomware ACCUZIP.COM id5829 View details Communication / Marketing
    Ransomware SEPIRE.COM id5828 View details Communication / Marketing
    Ransomware WVI.ORG id5827 View details Other
    Ransomware TTBH.ORG id5826 View details Healthcare / Pharma
    Ransomware HUMANGOOD.COM id5825 View details NGOs / Associations
    Ransomware KANNACT.COM id5824 View details Other
    Ransomware CINEPLEX.COM id5823 View details Other
    Ransomware AMERIJET.COM id5822 View details Transportation / Travel / Logistics
    Ransomware GDI.COM id5821 View details Other
    Ransomware ZOSKINHEALTH.COM id5820 View details Healthcare / Pharma
    Ransomware HRTRANSIT.ORG id5819 View details Other
    Ransomware PLURALSIGHT.COM id5818 View details Education
    Ransomware PPF.CO.UK id5817 View details United Kingdom Communication / Marketing
    Ransomware LASOLTEL.FR id5815 View details France Other
    Ransomware PG.COM id5814 View details Other
    Ransomware CROSSVILLEINC.COM id5813 View details Services
    Ransomware LESLIESPOOL.COM id5812 View details Other
    Ransomware SAKSFIFTHAVENUE.COM id5784 View details Other
    Ransomware JAYMART.CO.TH id5738 View details Thailand Other