Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 14137 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 14137 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-08-14 Latest victim discovery date
Inactive since 18 days Days since the latest known victim
Top country United States 6275 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 2 Onion service Up checked 2h ago santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Down checked 2h ago toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion
    Leak location 1 Onion service Down checked 2h ago ekbgzchl6x2ias37.onion

    Top Activity Sectors (5)

    1. Technology 146
    2. Transportation/Logistics 68
    3. Consumer Services 65
    4. Manufacturing 64
    5. Business Services 34

    YARA Rules (1)

    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (14137)

    Search, filter and paginate the victim timeline for Cl0p. Showing 13401–13500 of 14137.

    Type Target Discovered Country Business Category Intel Link
    Ransomware crestmills.com id17382 View details United States Communication / Marketing
    Ransomware cranebsu.com id17381 View details Germany Communication / Marketing
    Ransomware covectra.com id17380 View details United States IT
    Ransomware connexion-informatique.fr id17379 View details France Services
    Ransomware compasshealthbrands.com id17378 View details United States Healthcare / Pharma
    Ransomware collectionxiix.com id17377 View details United States Communication / Marketing
    Ransomware coghlans.com id17376 View details Canada Communication / Marketing
    Ransomware codagami.com id17375 View details United States IT
    Ransomware cmcoldstores.com id17374 View details United Kingdom Retail / E-commerce
    Ransomware classicaccessories.com id17373 View details United States Communication / Marketing
    Ransomware cinema1.ca id17372 View details Canada Retail / E-commerce
    Ransomware cherokeedistributing.com id17371 View details United States Hospitality / Food & Beverage / Tourism
    Ransomware chemstarcorp.com id17370 View details United States Communication / Marketing
    Ransomware challenger.com id17369 View details Retail / E-commerce
    Ransomware cesarcastillo.com id17368 View details Puerto Rico Retail / E-commerce
    Ransomware cedarsfoods.com id17367 View details United States Agriculture / Food
    Ransomware cathayhome.com id17366 View details United States Communication / Marketing
    Ransomware catchuplogistics.com id17365 View details United States Transportation / Travel / Logistics
    Ransomware castlewoodapparel.com id17364 View details United States Communication / Marketing
    Ransomware carlsondistributing.com id17363 View details United States Hospitality / Food & Beverage / Tourism
    Ransomware CAPITALFINEMEATS.COM id17344 View details Canada Communication / Marketing
    Ransomware CALIFORNIARAINLA.COM id17343 View details United States Retail / E-commerce
    Ransomware CAINEWAREHOUSING.COM id17342 View details United States Construction / Real Estate
    Ransomware BARCOMADE.COM id17341 View details Mexico Hospitality / Food & Beverage / Tourism
    Ransomware BEINOGLOU.GR id17340 View details Greece Transportation / Travel / Logistics
    Ransomware BIAGIBROS.COM id17339 View details United States Services
    Ransomware BSIEDI.COM id17338 View details Hong Kong Services
    Ransomware BOZICKDIST.COM id17337 View details Communication / Marketing
    Ransomware BOWANDARROWPET.COM id17336 View details United States Communication / Marketing
    Ransomware BOSSCHAIR.COM id17335 View details United States Communication / Marketing
    Ransomware BESTBRANDSINC.COM id17334 View details Communication / Marketing
    Ransomware BERKSHIREINC.COM id17333 View details Communication / Marketing
    Ransomware BENSONMILLS.COM id17332 View details United States Communication / Marketing
    Ransomware BENBECKER.EU id17331 View details Germany Communication / Marketing
    Ransomware BAYSIDENH.COM id17330 View details Communication / Marketing
    Ransomware BARRETTDISTRIBUTION.COM id17329 View details United States Hospitality / Food & Beverage / Tourism
    Ransomware BACKYARDDISCOVERY.COM id17328 View details United States Communication / Marketing
    Ransomware ALEGACY.COM id17327 View details United States Communication / Marketing
    Ransomware AURORAIMPORTING.COM id17326 View details Canada Communication / Marketing
    Ransomware ARLAN.NL id17325 View details Netherlands Communication / Marketing
    Ransomware ARKIEJIGS.COM id17324 View details United States Communication / Marketing
    Ransomware APOLLOCORP.COM id17323 View details Communication / Marketing
    Ransomware AOL.COM AJ MISSERT INC id17322 View details United States Communication / Marketing
    Ransomware ANNABELLECANDY.COM id17321 View details United States Communication / Marketing
    Ransomware ANDROSNA.COM id17320 View details United States Communication / Marketing
    Ransomware ANDREWSDISTRIBUTING.COM id17319 View details United States Communication / Marketing
    Ransomware AMSINO.COM id17650 View details United States Communication / Marketing
    Ransomware AMERICANLIGHTING.COM id17317 View details United States Communication / Marketing
    Ransomware ALPADVANTAGE.COM id17316 View details United States Communication / Marketing
    Ransomware ALLTECH.COM id17315 View details United States IT
    Ransomware ALLIANCEMERCANTILE.COM id17314 View details Canada Communication / Marketing
    Ransomware AIRLIQUIDE.COM id17313 View details France Healthcare / Pharma
    Ransomware AGILITYAUTOPARTS.COM id17312 View details Manufacturing / Engineering
    Ransomware AFFINITYCANADA.COM id17311 View details Canada Services
    Ransomware ACTIAN.COM id17310 View details United States Services
    Ransomware ACPIDEAS.COM id17309 View details United States Communication / Marketing
    Ransomware ACCEM.COM id17308 View details Spain Communication / Marketing
    Ransomware ABCOPRODUCTS.COM id17307 View details Communication / Marketing
    Ransomware 3PLSOFTWARE.COM id17306 View details United States IT
    Ransomware 3FINITY.NET id17301 View details Singapore IT
    Ransomware 1888MILLS.COM id17300 View details United States Communication / Marketing
    Ransomware CXTSOFTWARE.COM id17299 View details United States IT
    Ransomware UNIEKINC.COM id17298 View details United States Communication / Marketing
    Ransomware STORKCRAFT.COM id17297 View details Canada Communication / Marketing
    Ransomware COMPANY's_PART1 id17296 View details Communication / Marketing
    Ransomware DATACONSULTANTS.COM id17102 View details United States Services
    Ransomware CHAMPIONHOMES.COM id17101 View details United States Transportation / Travel / Logistics
    Ransomware CIERANT.COM id17100 View details United States Services
    Ransomware DATATRAC.COM id17099 View details United States IT
    Ransomware OLAMETER.COM id16851 View details United States Services
    Ransomware USLUGGAGE.COM id16850 View details United States Transportation / Travel / Logistics
    Ransomware AMPOL.COM.AU id16849 View details Australia Energy
    Ransomware POLARISTRANSPORT.COM id16848 View details Canada Transportation / Travel / Logistics
    Ransomware CALEXISCS.COM id16847 View details IT
    Ransomware CDRSOFTWARE.COM id16846 View details IT
    Ransomware UTILISMARTCORP.COM id16845 View details Canada Services
    Ransomware SEATTLECHOCOLATES.COM id16844 View details United States Communication / Marketing
    Ransomware WHITMOR.COM id16843 View details United States Communication / Marketing
    Ransomware BURRISLOGISTICS.COM id16842 View details United States Transportation / Travel / Logistics
    Ransomware ARTIKA.COM id16841 View details Canada Communication / Marketing
    Ransomware SPADERFREIGHT.COM id16840 View details Transportation / Travel / Logistics
    Ransomware SULLYTRANSPORT.COM id16839 View details United States Transportation / Travel / Logistics
    Ransomware BRADLEYCALDWELL.COM id16838 View details United States Communication / Marketing
    Ransomware MADENGINE.COM id16837 View details United States Retail / E-commerce
    Ransomware SPGUSA.COM id16836 View details United States Communication / Marketing
    Ransomware EMKAY.COM id16835 View details United States Services
    Ransomware RUIA.COM id16834 View details India Communication / Marketing
    Ransomware BUSINESSSYSINTEG.COM id16833 View details United States Services
    Ransomware BMIUSA.COM id16832 View details United States Services
    Ransomware NORTHERNONTARIOWIRES.COM id16831 View details Canada Energy
    Ransomware COYOTE.COM id16830 View details United States Transportation / Travel / Logistics
    Ransomware HILLBROS.COM id16829 View details United States Retail / E-commerce
    Ransomware KEEACTIONSPORTS.COM id16828 View details United States Communication / Marketing
    Ransomware INNOTEKEP.COM id16827 View details Croatia IT
    Ransomware NOWINC.CA id16826 View details Canada Manufacturing / Engineering
    Ransomware TERRA.COM id16825 View details United States Communication / Marketing
    Ransomware HERTZ.COM id16815 View details United States Services
    Ransomware CREELED.COM id16814 View details United States Communication / Marketing
    Ransomware JAKKS.COM id16813 View details United States Communication / Marketing
    Ransomware C3GROUP.NL id16812 View details Netherlands Services