Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1375 published victims, 4 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 1375 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-09-23 Latest victim discovery date
Inactive since 24 days Days since the latest known victim
Top country United States 468 victims
Known locations 4 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Leak Status Distribution

  • Leaked 319 23.2%
  • Pending 1055 76.7%
  • Deleted 1 0.1%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (4)

    Label Type Availability Links
    Leak location 4 Onion service Up checked 4m ago clopofffr7tth6hsvxx3cys4qkshrbbiitnxfwts6hj64mtnaovjieyd.onion
    Leak location 2 Onion service Up checked 5m ago santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Down checked 5m ago toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion
    Leak location 1 Onion service Down checked 5m ago ekbgzchl6x2ias37.onion

    Top Activity Sectors (5)

    1. Technology 146
    2. Transportation/Logistics 68
    3. Consumer Services 65
    4. Manufacturing 64
    5. Business Services 34

    YARA Rules (1)

    ▼
    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1375)

    Search, filter and paginate the victim timeline for Cl0p. Showing 301–400 of 1375.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware BELFUSE.COM id24053 View details United States Communication / Marketing leaked
    Ransomware RFSUNY.ORG id24052 View details United States Communication / Marketing leaked
    Ransomware TULANE.EDU id24051 View details United States Other leaked
    Ransomware LIFEFITNESS.COM id24050 View details United States Education leaked
    Ransomware ELKAY.COM id24049 View details United States Services leaked
    Ransomware ENOVIS.COM id24048 View details United States Other leaked
    Ransomware NCH.COM id24047 View details United States IT leaked
    Ransomware CYTIVALIFESCIENCES.COM id24046 View details Sweden Healthcare / Pharma leaked
    Ransomware COMPANIES-GROUP-4 id24045 View details Services pending
    Ransomware COMPANIES-GROUP-3 id24044 View details Services pending
    Ransomware COMPANIES-GROUP-2 id24043 View details Services pending
    Ransomware COMPANIES-GROUP-1 id24042 View details Services pending
    Ransomware ENTRUST.COM id23876 View details United States IT leaked
    Ransomware PENS.COM id23875 View details United States Communication / Marketing leaked
    Ransomware FORBESMARSHALL.COM id23874 View details India Communication / Marketing leaked
    Ransomware SATO-GLOBAL.COM id23873 View details Japan Communication / Marketing leaked
    Ransomware FLUKE.COM id23872 View details United States Communication / Marketing leaked
    Ransomware TPICOMPOSITES.COM id23871 View details United States Manufacturing / Engineering leaked
    Ransomware HELIXESG.COM id23870 View details United States Communication / Marketing leaked
    Ransomware MARITZ.COM id23869 View details United States Communication / Marketing pending
    Ransomware This entry has been removed following the request #1740 from the company. id23959 View details United States Services — pending
    Ransomware AFLGLOBAL.COM id23867 View details United States Communication / Marketing leaked
    Ransomware GLOBALLOGIC.COM id23866 View details United States IT leaked
    Ransomware DARTMOUTH.EDU id23865 View details United States Other leaked
    Ransomware PAFL.COM.PK id23864 View details Pakistan Transportation / Travel / Logistics leaked
    Ransomware SAMCRETE.COM id23863 View details Egypt Construction / Real Estate leaked
    Ransomware GAEAGLOBAL.COM id23862 View details United States Services leaked
    Ransomware P2ENERGYSERVICES.COM id23861 View details United States Services leaked
    Ransomware GLOBUSANDCOSMOS.COM id23860 View details United States Other leaked
    Ransomware ENNVEE.COM id23859 View details United States Services leaked
    Ransomware CARGLASS.DE id23858 View details Germany Manufacturing / Engineering leaked
    Ransomware VITAMIX.COM id23857 View details United States Communication / Marketing leaked
    Ransomware GARDENOFLIFE.COM id23856 View details United States Communication / Marketing leaked
    Ransomware NHS.UK id23855 View details United Kingdom Healthcare / Pharma leaked
    Ransomware WASHINGTONPOST.COM id23720 View details United States Communication / Marketing leaked
    Ransomware ZANACO.CO.ZM id23719 View details Zambia Finance / Legal / Insurance leaked
    Ransomware KIRBYCORP.COM id23718 View details United States Services leaked
    Ransomware TRIMBLE.COM id23717 View details United States IT leaked
    Ransomware MKS.COM id23716 View details Other leaked
    Ransomware INTERNATIONAL.COM id23715 View details Services leaked
    Ransomware LOGITECH.COM id23675 View details Switzerland IT leaked
    Ransomware KIER.CO.UK id23714 View details United Kingdom Construction / Real Estate leaked
    Ransomware ELSEWEDYELECTRIC.COM id23713 View details Egypt Energy leaked
    Ransomware WOODPLC.COM id23712 View details United Kingdom Manufacturing / Engineering leaked
    Ransomware RHEEM.COM id23711 View details United States Communication / Marketing leaked
    Ransomware LV.COM id23710 View details United Kingdom Finance / Legal / Insurance leaked
    Ransomware ANSELL.COM id23709 View details Belgium Communication / Marketing leaked
    Ransomware MASTEC.COM id23708 View details United States Energy leaked
    Ransomware DAVIDYURMAN.COM id23707 View details United States Retail / E-commerce leaked
    Ransomware PANAMERICANSILVER.COM id23706 View details Canada Communication / Marketing leaked
    Ransomware COXENTERPRISES.COM id23705 View details United States Communication / Marketing leaked
    Ransomware HRSD.COM id23704 View details United States Communication / Marketing leaked
    Ransomware CSCGLOBAL.COM id23703 View details United States Services leaked
    Ransomware AUSENCO.COM id23702 View details Australia Services leaked
    Ransomware LKQCORP.COM id23701 View details United States Manufacturing / Engineering leaked
    Ransomware MILGARD.COM id23700 View details United States Energy leaked
    Ransomware COPELAND.COM id23699 View details Other leaked
    Ransomware WITS.AC.ZA id23698 View details South Africa Education leaked
    Ransomware HARVARD.EDU id23697 View details United States Education leaked
    Ransomware PHARMARON.COM id23696 View details China Healthcare / Pharma pending
    Ransomware PILOTTHOMAS.COM id23695 View details United States Manufacturing / Engineering pending
    Ransomware CHECKCITY.COM id23694 View details United States Public Sector pending
    Ransomware CALTON.COM id23693 View details United States Other pending
    Ransomware JAGGEDPEAK.COM id23692 View details United States Retail / E-commerce pending
    Ransomware RACKSPACE.COM id23691 View details United States IT pending
    Ransomware LIPPERTENT.COM id23690 View details Other pending
    Ransomware GARANIMALS.COM id23689 View details United States Communication / Marketing pending
    Ransomware IOVATE.COM id23688 View details Canada Healthcare / Pharma pending
    Ransomware JEFFREYCOURT.COM id23687 View details United States Communication / Marketing pending
    Ransomware APTEAN.COM id23686 View details United States Communication / Marketing pending
    Ransomware CMCOLDSTORES.COMCODAGAMI.COM id18082 View details Retail / E-commerce — pending
    Ransomware HPE.COM id18081 View details United States IT — pending
    Ransomware HP.COM id18080 View details United States Communication / Marketing — pending
    Ransomware HOLLANDIADAIRY.COM id18079 View details United States Agriculture / Food — pending
    Ransomware HIGHBARTRADING.COM id18078 View details Hospitality / Food & Beverage / Tourism — pending
    Ransomware HENRYKA.COM id18077 View details Poland Communication / Marketing — pending
    Ransomware HENDERSONSTAMPING.COM id18076 View details United States Manufacturing / Engineering — leaked
    Ransomware HANSONFASO.COM id18075 View details Hong Kong Communication / Marketing — pending
    Ransomware HANSONCOLDSTORAGE.COM id18074 View details Transportation / Travel / Logistics — pending
    Ransomware HALGAND.COM id18073 View details France Services — pending
    Ransomware GARAN MANUFACTURING id18072 View details United States Manufacturing / Engineering — pending
    Ransomware GARDNERHEALTHSERVICES.ORG id18071 View details United States Healthcare / Pharma — pending
    Ransomware GALATECHNOLOGY.CO.UK id18070 View details United Kingdom IT — pending
    Ransomware GREATPLAINSDISTRIBUTORS.COM id18069 View details Communication / Marketing — pending
    Ransomware GULFSTATESCS.COM id18068 View details United States Public Sector — pending
    Ransomware GTIMPORTS.NET id18067 View details United States Communication / Marketing — pending
    Ransomware GSMETALL.COM id18066 View details Germany Manufacturing / Engineering — pending
    Ransomware GOURMETTRADING.NET id18065 View details United States Communication / Marketing — pending
    Ransomware GNSWORLD.COM id18064 View details Retail / E-commerce — pending
    Ransomware GIBSONHOMEWARES.COM id18063 View details United States Communication / Marketing — pending
    Ransomware GHENT.COM id18062 View details Communication / Marketing — pending
    Ransomware GETGARVEYS.COM id18061 View details United States Communication / Marketing — pending
    Ransomware GERSONANDGERSON.COM id18060 View details Retail / E-commerce — pending
    Ransomware GBBEV.COM id18059 View details United Kingdom Agriculture / Food — pending
    Ransomware GATE7LLC.COM id18058 View details United States Communication / Marketing — pending
    Ransomware GAIAM.COM id18057 View details United States Healthcare / Pharma — pending
    Ransomware FASHION.PRI id18056 View details Russian Federation Communication / Marketing — pending
    Ransomware FLORENCECORPORATION.COM id18055 View details Communication / Marketing — pending
    Ransomware FORTFORWARDING.COM id18054 View details Communication / Marketing — pending
    Ransomware FUN-WORLD.NET id18053 View details Communication / Marketing — pending