Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1261 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
Victims 1261 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-05-01 Latest victim discovery date
Inactive since 78 days Days since the latest known victim
Top country United States 432 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 1 Onion service Unknown ekbgzchl6x2ias37.onion
    Leak location 2 Onion service Unknown santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Unknown toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion

    Top Activity Sectors (5)

    1. Technology146
    2. Transportation/Logistics68
    3. Consumer Services65
    4. Manufacturing64
    5. Business Services34

    Ransom Notes (4)

    ▼
    AAA_READ_AAA.TXT Details_Cleo.txt clop1.txt clop2.txt

    YARA Rules (1)

    ▼
    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1261)

    Search, filter and paginate the victim timeline for Cl0p. Showing 1101–1200 of 1261.

    Type Target Discovered Country Business Category Intel Link
    Ransomware SERVICESTREAM.COM.AU id5737 View details Australia Services
    Ransomware WORLDMARKET.COM id5736 View details Retail / E-commerce
    Ransomware WILDFIRE-DEFENSE.COM id5735 View details Other
    Ransomware SWEEPINGCORP.COM id5734 View details Services
    Ransomware TUEBORA.COM id5733 View details Other
    Ransomware RATELINX.COM id5732 View details Other
    Ransomware FERGUSON.COM id5731 View details Manufacturing / Engineering
    Ransomware ACENURSING.ORG id5730 View details Healthcare / Pharma
    Ransomware WELLBE.COM id5729 View details Other
    Ransomware HELLOBRIGHTLINE.COM id5728 View details Healthcare / Pharma
    Ransomware HITACHIENERGY.COM id5727 View details Energy
    Ransomware SAE.ORG id5726 View details Services
    Ransomware AVIDXCHANGE.COM id5725 View details Other
    Ransomware GALDERMA.COM id5724 View details Other
    Ransomware NEWEUROPEANOFFSHORE.COM id5723 View details Other
    Ransomware MEDEXHCO.COM id5722 View details Other
    Ransomware INVESTQUEBEC.COM id5721 View details Communication / Marketing
    Ransomware RIOTINTO.COM id5720 View details Other
    Ransomware ITXCOMPANIES.COM id5719 View details Other
    Ransomware HOMEWOODHEALTH.COM id5718 View details Healthcare / Pharma
    Ransomware GUINNESSPARTNERSHIP.COM id5717 View details Other
    Ransomware ALLIEDBENEFIT.COM id5716 View details Other
    Ransomware USWELLNESS.COM id5715 View details Healthcare / Pharma
    Ransomware RUBRIK.COM id5705 View details Other
    Ransomware ONEX.COM id5704 View details Other
    Ransomware PEOPLECORPORATION.COM id5647 View details Services
    Ransomware MEDMINDER.COM id5646 View details Other
    Ransomware AXISBANK.COM id5645 View details Finance / Legal / Insurance
    Ransomware HOUSELOAN.COM id5644 View details Other
    Ransomware ALIVIAHEALTH.COM id5643 View details Healthcare / Pharma
    Ransomware GROUPAMANA.COM id5591 View details France Services
    Ransomware HATCHBANK.COM id5583 View details Finance / Legal / Insurance
    Ransomware NYCBAR.ORG id5241 View details Hospitality / Food & Beverage / Tourism
    Ransomware CGMLLC.NET id5192 View details Services
    Ransomware UNISALLE.EDU.CO id5191 View details Colombia Other
    Ransomware SOFTEQ.COM id5078 View details Construction / Real Estate
    Ransomware MARCELSOLUTION.COM id5077 View details Other
    Ransomware ORDEREXPRESS.COM.MX id5076 View details Mexico Communication / Marketing
    Ransomware LOESCHGROUP.DE id5075 View details Germany IT
    Ransomware SOUTH-STAFFS-WATER.CO.UK id5074 View details United Kingdom Other
    Ransomware APPLEXUS.COM id5073 View details Services
    Ransomware SPINNEYS.COM id5072 View details Retail / E-commerce
    Ransomware PRICEDEX.COM id5071 View details Communication / Marketing
    Ransomware FERRAN-SERVICES.COM id5070 View details Services
    Ransomware LATOURNERIE-WOLFROM.COM id5069 View details France Other
    Ransomware ENSSECURITY.COM id5068 View details Other
    Ransomware FTSUMNERK12.COM id5067 View details Other
    Ransomware NEWCOURSECC.COM id5066 View details Communication / Marketing
    Ransomware PERBIT.COM id5065 View details Communication / Marketing
    Ransomware 888VOIP.COM id5064 View details Other
    Ransomware AFJCONSULTING.NET id5063 View details Services
    Ransomware ORBITELECTRIC.COM id5062 View details Other
    Ransomware FAIR-RITE.COM id5061 View details Other
    Ransomware JDAVIDTAXLAW.COM id5060 View details Finance / Legal / Insurance
    Ransomware THENOC.NET id5059 View details Telecommunications
    Ransomware ZISSERFAMILYLAW.COM id5058 View details Finance / Legal / Insurance
    Ransomware SA1SOLUTIONS.COM id5057 View details Services
    Ransomware OAKDELL.COM id5056 View details Agriculture / Food
    Ransomware ALTERNATIVETECHS.COM id5055 View details IT
    Ransomware DRIVEANDSHINE.COM id5054 View details Other
    Ransomware DRC-LAW.COM id5053 View details Finance / Legal / Insurance
    Ransomware ALEXIM.COM id5052 View details Other
    Ransomware CAPCARPET.COM id5051 View details Retail / E-commerce
    Ransomware JBINSTANTLAWN.NET id5050 View details Finance / Legal / Insurance
    Ransomware JCWHITE.COM id5049 View details Other
    Ransomware DUTTONFIRM.COM id5048 View details Finance / Legal / Insurance
    Ransomware ENPRECIS.COM id5047 View details Communication / Marketing
    Ransomware MTMRECOGNITION.COM id5046 View details Other
    Ransomware MUSCHERT-GIERSE.DE id5045 View details Germany Other
    Ransomware SWIRESPO.COM id5044 View details Other
    Ransomware EDAN.COM id5043 View details Other
    Ransomware MCH-GROUP.COM id5042 View details Services
    Ransomware SLIMSTOCK.COM id5041 View details Services
    Ransomware QUANTUMGROUP.COM id5040 View details Services
    Ransomware NATUS.COM id5039 View details Other
    Ransomware SMARTERASP.NET id5038 View details Other
    Ransomware TONLYELE.COM id5037 View details Other
    Ransomware SSMSJUSTICE.COM id5036 View details Other
    Ransomware ABSOLUTERESULTS.COM id5035 View details Other
    Ransomware BOLTONUSA.COM id5034 View details Other
    Ransomware STRATISVISUALS.COM id5033 View details Other
    Ransomware EMPIRICAL-RESEARCH.COM id5032 View details Other
    Ransomware BRPRINTERS.COM id5031 View details Communication / Marketing
    Ransomware BLUEBONNETNUTRITION.COM id5030 View details Communication / Marketing
    Ransomware SUNSETHCS.COM id5029 View details Healthcare / Pharma
    Ransomware BPATPA.COM id5028 View details Other
    Ransomware GENESISNET.COM id5027 View details Other
    Ransomware COMPASSNRG.COM id5026 View details Other
    Ransomware COULSONGROUP.COM id5025 View details Services
    Ransomware STORAFILE.CO.UK id5024 View details United Kingdom Services
    Ransomware KLEINBERGLANGE.COM id5023 View details Finance / Legal / Insurance
    Ransomware WDMANOR.COM id5022 View details Construction / Real Estate
    Ransomware MMALTZAN.COM id5021 View details Other
    Ransomware KSSENTERPRISES.COM id5020 View details Communication / Marketing
    Ransomware PARAGONGRI.COM id5019 View details Other
    Ransomware PENBENS.COM id5018 View details Other
    Ransomware GOABCO.COM id5017 View details Manufacturing / Engineering
    Ransomware ZUCCHETTIKOS.IT id5016 View details Italy Other
    Ransomware RMICO.COM id5015 View details Other
    Ransomware VALLEYTRUCKANDTRACTOR.COM id5014 View details Agriculture / Food