Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1261 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
Victims 1261 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-05-01 Latest victim discovery date
Inactive since 78 days Days since the latest known victim
Top country United States 432 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 1 Onion service Unknown ekbgzchl6x2ias37.onion
    Leak location 2 Onion service Unknown santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Unknown toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion

    Top Activity Sectors (5)

    1. Technology146
    2. Transportation/Logistics68
    3. Consumer Services65
    4. Manufacturing64
    5. Business Services34

    Ransom Notes (4)

    AAA_READ_AAA.TXT Details_Cleo.txt clop1.txt clop2.txt

    YARA Rules (1)

    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1261)

    Search, filter and paginate the victim timeline for Cl0p. Showing 301–400 of 1261.

    Type Target Discovered Country Business Category Intel Link
    Ransomware EZUP.COM id18038 View details United States Communication / Marketing
    Ransomware EXCELLED.COM id18037 View details United States Education
    Ransomware ESSEXPOWERLINES.CA id18036 View details Canada Energy
    Ransomware ESBERBEVERAGE.COM id18035 View details United States Hospitality / Food & Beverage / Tourism
    Ransomware ENTERATEK.MX id18034 View details Mexico Services
    Ransomware ENCHANTEACCESSORIES.COM id18033 View details United States Communication / Marketing
    Ransomware EMSONUSA.COM id18032 View details United States Communication / Marketing
    Ransomware WKKELLOGG.COM id18031 View details Agriculture / Food
    Ransomware WHEELS.COM id18030 View details Canada Services
    Ransomware WERTEX.COM id18029 View details Poland Communication / Marketing
    Ransomware WENDOVERART.COM id18028 View details United States Communication / Marketing
    Ransomware WELCOMEIND.COM id18027 View details India Public Sector
    Ransomware VANDALE.COM id18026 View details United States Communication / Marketing
    Ransomware VSSTRANSPORTATIONGROUP.COM id18025 View details United States Transportation / Travel / Logistics
    Ransomware VSSLOGISTICS.COM id18024 View details United States Transportation / Travel / Logistics
    Ransomware VPGLOBAL.COM id18023 View details United States Services
    Ransomware VLCDISTRIBUTION.COM id18022 View details Communication / Marketing
    Ransomware VIKINGWEAR.COM id18021 View details United States Communication / Marketing
    Ransomware VIDAGROUP.COM id18020 View details Mexico IT
    Ransomware VERSANTTECHNOLOGIES.COM id18019 View details Singapore IT
    Ransomware VERSAILLES-INC.COM id18018 View details Services
    Ransomware VALLEYDIST.COM id18017 View details United States Transportation / Travel / Logistics
    Ransomware UNIEK.INTERNAL id18016 View details Communication / Marketing
    Ransomware UNIVERSALWAREHOUSES.COM id18015 View details Transportation / Travel / Logistics
    Ransomware USM-INC.COM id18014 View details Services
    Ransomware UPPERLAKESFOODS.COM id18013 View details United States Agriculture / Food
    Ransomware UNITERS.COM id18012 View details United States Communication / Marketing
    Ransomware TITESI.LOCAL id18011 View details Communication / Marketing
    Ransomware TILLSONBURGHYDRO.CA id18010 View details Canada Energy
    Ransomware TWINSTARHOME.COM id18009 View details United States Communication / Marketing
    Ransomware TESISQUARE.COM id18008 View details Italy IT
    Ransomware TIMKEN.COM id18007 View details United States Energy
    Ransomware TWTDIST.COM id18006 View details United States Communication / Marketing
    Ransomware TRIPLE8.CA id18005 View details Canada Communication / Marketing
    Ransomware TUXTON.COM id18004 View details United States Communication / Marketing
    Ransomware TUCKERCO.COM id18003 View details United States Transportation / Travel / Logistics
    Ransomware TRIMACO.COM id18002 View details United States Communication / Marketing
    Ransomware TRIBORO.COM id18001 View details Retail / E-commerce
    Ransomware TRENDSPOTINC.COM id18000 View details United States Communication / Marketing
    Ransomware TPGXML.COM id17999 View details United States IT
    Ransomware TOTALWINE.COM id17998 View details United States Communication / Marketing
    Ransomware THENORTHWEST.COM id17997 View details United States Communication / Marketing
    Ransomware THEMEZZSHOPPE.COM id17996 View details United States Retail / E-commerce
    Ransomware TERINICHOLS.COM id17995 View details Construction / Real Estate
    Ransomware TARATOY.COM id17994 View details Communication / Marketing
    Ransomware TALLTAILSDOG.COM id17993 View details United States Communication / Marketing
    Ransomware SAMSCLU.COM id17992 View details United States Retail / E-commerce
    Ransomware SCHAWK.COM id17991 View details United States Communication / Marketing
    Ransomware SJI.LOCAL id17990 View details Australia Other
    Ransomware STAR.LOCAL id17989 View details IT
    Ransomware SCOPEIMPORTS.LOCAL id17988 View details Communication / Marketing
    Ransomware SDITECH.COM id17987 View details United States IT
    Ransomware SUPPLYON.COM id17986 View details Germany Services
    Ransomware SEA-DELIGHT.CA id17985 View details Canada Agriculture / Food
    Ransomware SUN-RICH.COM id17984 View details Canada Communication / Marketing
    Ransomware SENAO.COM.TW id17983 View details Taiwan, Province of China Communication / Marketing
    Ransomware STUDIODESIGNS.COM id17982 View details Communication / Marketing
    Ransomware STILACOSMETICS.COM id17981 View details Italy Communication / Marketing
    Ransomware STEVENSONBEERDISTRIBUTING.COM id17980 View details Communication / Marketing
    Ransomware STEPHENJOSEPHGIFTS.COM id17979 View details United States Communication / Marketing
    Ransomware STELLARPACK.COM id17978 View details Poland Communication / Marketing
    Ransomware STARMARKETINGCANADA.COM id17977 View details Canada Communication / Marketing
    Ransomware STANLEYCREATIONS.COM id17976 View details United States Communication / Marketing
    Ransomware SPARTANLOGISTICS.COM id17975 View details United States Transportation / Travel / Logistics
    Ransomware SOBELATHOME.COM id17974 View details United States Communication / Marketing
    Ransomware SLTRANS.COM id17973 View details Transportation / Travel / Logistics
    Ransomware SIMPLEHUMAN.COM id17972 View details United States Communication / Marketing
    Ransomware SHIPGFS.COM id17971 View details United States Communication / Marketing
    Ransomware SGKINC.COM id17970 View details United States Communication / Marketing
    Ransomware SGEMESA.COM id17969 View details Spain Communication / Marketing
    Ransomware SEA-JET.COM id17968 View details Greece Transportation / Travel
    Ransomware SAUNDERSMIDWEST.COM id17967 View details United States Communication / Marketing
    Ransomware SATCO.COM id17966 View details United States Communication / Marketing
    Ransomware SANTAFENYSHOP.COM id17965 View details Retail / E-commerce
    Ransomware SALTEDAWG.COM id17964 View details United States Retail / E-commerce
    Ransomware SALSON.COM id17963 View details United States Transportation / Travel / Logistics
    Ransomware SAKAR.COM id17962 View details United States Communication / Marketing
    Ransomware REVITALASH.COM id17961 View details United States Communication / Marketing
    Ransomware REDCLAYGOURMET.COM id17960 View details United States Communication / Marketing
    Ransomware ROYALLEMKES.NL id17959 View details Netherlands Communication / Marketing
    Ransomware ROUNDHOUSEGROUP.COM id17958 View details United States Services
    Ransomware REV.DE id17957 View details Germany Communication / Marketing
    Ransomware REMAFOODS.COM id17956 View details United States Agriculture / Food
    Ransomware REGENCY-RIB.COM id17955 View details United Kingdom Communication / Marketing
    Ransomware REESEPHARMACEUTICAL.COM id17954 View details Japan Healthcare / Pharma
    Ransomware REESECHEMICAL.COM id17953 View details United States Manufacturing / Engineering
    Ransomware REDDYICE.COM id17952 View details United States Communication / Marketing
    Ransomware RDSGAMING.COM id17951 View details Communication / Marketing
    Ransomware RAYTIK.COM id17950 View details Other
    Ransomware RANDSTRUCKING.COM id17949 View details United States Transportation / Travel / Logistics
    Ransomware RADLEY.COM id17948 View details Retail / E-commerce
    Ransomware QBTRANSPORTATION.COM id17947 View details United States Transportation / Travel / Logistics
    Ransomware PTIDOM.LOCAL id17946 View details Telecommunications
    Ransomware PUROLATORINTERNATIONAL.COM id17945 View details Canada Services
    Ransomware PTCOUPLING.COM id17944 View details United States Manufacturing / Engineering
    Ransomware PRIMELINE.NET id17943 View details United States Communication / Marketing
    Ransomware PRESPERSE.COM id17942 View details United States Communication / Marketing
    Ransomware PITSCO.COM id17941 View details United States Education
    Ransomware PIPERSYSTEMS.COM id17940 View details Ireland Healthcare / Pharma
    Ransomware PHYSICALDISTRIBUTIONSERVICES.COM id17939 View details Services