Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1375 published victims, 4 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 1375 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-09-23 Latest victim discovery date
Inactive since 24 days Days since the latest known victim
Top country United States 468 victims
Known locations 4 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Leak Status Distribution

  • Leaked 319 23.2%
  • Pending 1055 76.7%
  • Deleted 1 0.1%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (4)

    Label Type Availability Links
    Leak location 4 Onion service Up checked 5m ago clopofffr7tth6hsvxx3cys4qkshrbbiitnxfwts6hj64mtnaovjieyd.onion
    Leak location 2 Onion service Up checked 5m ago santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Down checked 5m ago toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion
    Leak location 1 Onion service Down checked 6m ago ekbgzchl6x2ias37.onion

    Top Activity Sectors (5)

    1. Technology 146
    2. Transportation/Logistics 68
    3. Consumer Services 65
    4. Manufacturing 64
    5. Business Services 34

    YARA Rules (1)

    ▼
    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1375)

    Search, filter and paginate the victim timeline for Cl0p. Showing 501–600 of 1375.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware REDDYICE.COM id17952 View details United States Communication / Marketing — pending
    Ransomware RDSGAMING.COM id17951 View details Communication / Marketing — pending
    Ransomware RAYTIK.COM id17950 View details Other — pending
    Ransomware RANDSTRUCKING.COM id17949 View details United States Transportation / Travel / Logistics — pending
    Ransomware RADLEY.COM id17948 View details Retail / E-commerce — pending
    Ransomware QBTRANSPORTATION.COM id17947 View details United States Transportation / Travel / Logistics — pending
    Ransomware PTIDOM.LOCAL id17946 View details Telecommunications — pending
    Ransomware PUROLATORINTERNATIONAL.COM id17945 View details Canada Services — pending
    Ransomware PTCOUPLING.COM id17944 View details United States Manufacturing / Engineering — pending
    Ransomware PRIMELINE.NET id17943 View details United States Communication / Marketing — pending
    Ransomware PRESPERSE.COM id17942 View details United States Communication / Marketing — pending
    Ransomware PITSCO.COM id17941 View details United States Education — pending
    Ransomware PIPERSYSTEMS.COM id17940 View details Ireland Healthcare / Pharma — pending
    Ransomware PHYSICALDISTRIBUTIONSERVICES.COM id17939 View details Services — pending
    Ransomware PETMATE.COM id17938 View details United States Communication / Marketing — pending
    Ransomware PERRONEANDSONS.COM id17937 View details United States Agriculture / Food — pending
    Ransomware PEMAMERICA.COM id17936 View details United States Communication / Marketing — pending
    Ransomware PELLONPROJECTS.COM id17935 View details United States Communication / Marketing — pending
    Ransomware PDSITE.COM id17934 View details Communication / Marketing — pending
    Ransomware PARTNER.RO id17933 View details Romania Services — pending
    Ransomware PANEUROFOODS.COM id17932 View details Agriculture / Food — pending
    Ransomware PAIGEDENIM.COM id17931 View details United States Manufacturing / Engineering — pending
    Ransomware PAIGE.COM id17930 View details United States IT — pending
    Ransomware PACIFIC-TEXTILE.COM id17929 View details Hong Kong Communication / Marketing — pending
    Ransomware OUTSOURCELOGISTICS.COM id17928 View details United States Transportation / Travel / Logistics — pending
    Ransomware OBJECTIF-EMBALLAGES.FR id17927 View details France Communication / Marketing — pending
    Ransomware OREGONFRUIT.COM id17926 View details United States Communication / Marketing — pending
    Ransomware OUTERSTUFF.COM id17925 View details United States Communication / Marketing — pending
    Ransomware ONWBEER.COM id17924 View details Retail / E-commerce — pending
    Ransomware OLDSPRODUCTS.COM id17923 View details United States Communication / Marketing — pending
    Ransomware OFFICEBASICS.COM id17922 View details United States Communication / Marketing — pending
    Ransomware O2COOL.COM id17921 View details United States Communication / Marketing — pending
    Ransomware NEBRASKAWAREHOUSE.LOCAL id17920 View details Transportation / Travel / Logistics — pending
    Ransomware NRESPONSE.COM id17919 View details United States IT — pending
    Ransomware NORTHWIRE.COM id17918 View details United States Manufacturing / Engineering — pending
    Ransomware NYCALLIANCE.COM id17917 View details United States Communication / Marketing — pending
    Ransomware NPLUS1TECHNOLOGIES.COM id17916 View details IT — pending
    Ransomware NMR.CO.UK id17915 View details United Kingdom Agriculture / Food — pending
    Ransomware NETPLUSTMS.COM id17914 View details United States Services — pending
    Ransomware NATURESWEET.COM id17913 View details United States Agriculture / Food — pending
    Ransomware MAPLELEAFFARMS.COM id17912 View details United States Agriculture / Food — pending
    Ransomware MAGTARSALES.CA id17911 View details Canada Retail / E-commerce — pending
    Ransomware MDS.LOCAL id17910 View details Telecommunications — pending
    Ransomware MMSUPPLY.COM id17909 View details United States Communication / Marketing — pending
    Ransomware MCCUBBIN.COM id17908 View details United States Communication / Marketing — pending
    Ransomware MAE.LOCAL id17907 View details Retail / E-commerce — pending
    Ransomware MCWILLIAMSMOVING.COM id17906 View details Canada Services — pending
    Ransomware MYSTICAPPAREL.COM id17905 View details United States Retail / E-commerce — pending
    Ransomware MAINFREIGHT.COM id17904 View details New Zealand Transportation / Travel / Logistics — pending
    Ransomware MAHARTOOL.COM id17903 View details Communication / Marketing — pending
    Ransomware MERCERLOGISTICS.COM id17902 View details United States Transportation / Travel / Logistics — pending
    Ransomware METALANDWIRE.COM id17901 View details Manufacturing / Engineering — pending
    Ransomware MUXIE.COM id17900 View details Services — pending
    Ransomware MUNDI.COM id17899 View details Brazil Transportation / Travel / Logistics — pending
    Ransomware MORET.COM id17898 View details United States Services — pending
    Ransomware MONARCHBRANDS.COM id17897 View details United States Healthcare / Pharma — pending
    Ransomware MGAINNOVATION.COM id17896 View details United States IT — pending
    Ransomware MGAE.COM id17895 View details United States Communication / Marketing — pending
    Ransomware METOOSHOES.COM id17894 View details Korea, Republic of Communication / Marketing — pending
    Ransomware MERIDIANGROUPREM.COM id17893 View details United States Communication / Marketing — pending
    Ransomware MERANGUE.COM id17892 View details Canada Communication / Marketing — pending
    Ransomware MEGATOYS.COM id17891 View details United States Retail / E-commerce — pending
    Ransomware MEDCODATA.COM id17890 View details Sweden Healthcare / Pharma — pending
    Ransomware MCARDLESKEATH.COM id17889 View details Ireland Transportation / Travel / Logistics — pending
    Ransomware MARELLI.COM id17888 View details Japan Manufacturing / Engineering — pending
    Ransomware MAJORLABELGROUP.COM id17887 View details Communication / Marketing — pending
    Ransomware LOLLYTOGS.COM id17886 View details Communication / Marketing — pending
    Ransomware LAWSONROANOKE.COM id17885 View details Finance / Legal / Insurance — pending
    Ransomware LYNNS.COM id17884 View details Communication / Marketing — pending
    Ransomware LOSCABOSMEXICANFOODS.COM id17883 View details Mexico Agriculture / Food — pending
    Ransomware LOSCAB.COM id17882 View details United States Services — pending
    Ransomware LNFDISTRIBUTORS.COM id17881 View details United States Communication / Marketing — pending
    Ransomware LITTLEARTH.COM id17880 View details United States Communication / Marketing — pending
    Ransomware LENMAX.COM id17879 View details Services — pending
    Ransomware LEADINGLADY.COM id17878 View details United States Healthcare / Pharma — pending
    Ransomware LAPOLICEGEAR.COM id17877 View details United States Communication / Marketing — pending
    Ransomware KEELEWL.COM id17876 View details Communication / Marketing — pending
    Ransomware KWIKGOAL.COM id17875 View details United States Education — pending
    Ransomware KURTADLER.COM id17874 View details United States Communication / Marketing — pending
    Ransomware KOLCRAFT.COM id17873 View details United States Communication / Marketing — pending
    Ransomware KOCHLOGISTICS.COM id17872 View details United States Transportation / Travel / Logistics — pending
    Ransomware KNFILTERS.COM id17871 View details United States Communication / Marketing — pending
    Ransomware KIRCHNERBEER.COM id17870 View details Germany Communication / Marketing — pending
    Ransomware KIKKERLAND.COM id17869 View details United States Communication / Marketing — pending
    Ransomware KEELEWAREHOUSING.COM id17868 View details Canada Construction / Real Estate — pending
    Ransomware JDADELIVERS.COM id17867 View details United States Services — pending
    Ransomware JPWEST.COM id17866 View details Japan Services — pending
    Ransomware JOHNPAULRICHARD.COM id17865 View details United States Retail / E-commerce — pending
    Ransomware JOBAR.COM id17864 View details United States Hospitality / Food & Beverage / Tourism — pending
    Ransomware JENNE.COM id17863 View details United States Communication / Marketing — pending
    Ransomware JAYAAPPARELGROUP.COM id17862 View details United States Communication / Marketing — pending
    Ransomware IDPE.CO id17861 View details Colombia IT — pending
    Ransomware IUSA.MX id17860 View details Mexico Construction / Real Estate — pending
    Ransomware ID-GP.COM id17859 View details United Kingdom IT — pending
    Ransomware INNOVADOR.COM.MX id17858 View details Mexico IT — pending
    Ransomware INTERFACTURA.COM id17857 View details Mexico Services — pending
    Ransomware INTERCHARGE.DE id17856 View details Germany Services — pending
    Ransomware INTELEKTECHNOLOGIES.COM id17855 View details United States IT — pending
    Ransomware INNOVSYS.COM id17854 View details United States Services — pending
    Ransomware HOMEDEPOT.COM.MX id17853 View details Mexico Communication / Marketing — pending