Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1375 published victims, 4 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 1375 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-09-23 Latest victim discovery date
Inactive since 24 days Days since the latest known victim
Top country United States 468 victims
Known locations 4 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Leak Status Distribution

  • Leaked 319 23.2%
  • Pending 1055 76.7%
  • Deleted 1 0.1%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (4)

    Label Type Availability Links
    Leak location 4 Onion service Up checked 45m ago clopofffr7tth6hsvxx3cys4qkshrbbiitnxfwts6hj64mtnaovjieyd.onion
    Leak location 2 Onion service Up checked 46m ago santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Down checked 46m ago toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion
    Leak location 1 Onion service Down checked 46m ago ekbgzchl6x2ias37.onion

    Top Activity Sectors (5)

    1. Technology 146
    2. Transportation/Logistics 68
    3. Consumer Services 65
    4. Manufacturing 64
    5. Business Services 34

    YARA Rules (1)

    ▼
    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1375)

    Search, filter and paginate the victim timeline for Cl0p. Showing 701–800 of 1375.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware UNIEKINC.COM id17298 View details United States Communication / Marketing pending
    Ransomware STORKCRAFT.COM id17297 View details Canada Communication / Marketing pending
    Ransomware COMPANY's_PART1 id17296 View details Communication / Marketing pending
    Ransomware DATACONSULTANTS.COM id17102 View details United States Services pending
    Ransomware CHAMPIONHOMES.COM id17101 View details United States Transportation / Travel / Logistics pending
    Ransomware CIERANT.COM id17100 View details United States Services pending
    Ransomware DATATRAC.COM id17099 View details United States IT pending
    Ransomware OLAMETER.COM id16851 View details United States Services — pending
    Ransomware USLUGGAGE.COM id16850 View details United States Transportation / Travel / Logistics — pending
    Ransomware AMPOL.COM.AU id16849 View details Australia Energy — pending
    Ransomware POLARISTRANSPORT.COM id16848 View details Canada Transportation / Travel / Logistics — pending
    Ransomware CALEXISCS.COM id16847 View details IT — pending
    Ransomware CDRSOFTWARE.COM id16846 View details IT — pending
    Ransomware UTILISMARTCORP.COM id16845 View details Canada Services — pending
    Ransomware SEATTLECHOCOLATES.COM id16844 View details United States Communication / Marketing — pending
    Ransomware WHITMOR.COM id16843 View details United States Communication / Marketing — pending
    Ransomware BURRISLOGISTICS.COM id16842 View details United States Transportation / Travel / Logistics — pending
    Ransomware ARTIKA.COM id16841 View details Canada Communication / Marketing — pending
    Ransomware SPADERFREIGHT.COM id16840 View details Transportation / Travel / Logistics — pending
    Ransomware SULLYTRANSPORT.COM id16839 View details United States Transportation / Travel / Logistics — pending
    Ransomware BRADLEYCALDWELL.COM id16838 View details United States Communication / Marketing — pending
    Ransomware MADENGINE.COM id16837 View details United States Retail / E-commerce — pending
    Ransomware SPGUSA.COM id16836 View details United States Communication / Marketing — pending
    Ransomware EMKAY.COM id16835 View details United States Services — pending
    Ransomware RUIA.COM id16834 View details India Communication / Marketing — pending
    Ransomware BUSINESSSYSINTEG.COM id16833 View details United States Services — pending
    Ransomware BMIUSA.COM id16832 View details United States Services — pending
    Ransomware NORTHERNONTARIOWIRES.COM id16831 View details Canada Energy — pending
    Ransomware COYOTE.COM id16830 View details United States Transportation / Travel / Logistics — pending
    Ransomware HILLBROS.COM id16829 View details United States Retail / E-commerce — pending
    Ransomware KEEACTIONSPORTS.COM id16828 View details United States Communication / Marketing — pending
    Ransomware INNOTEKEP.COM id16827 View details Croatia IT — pending
    Ransomware NOWINC.CA id16826 View details Canada Manufacturing / Engineering — pending
    Ransomware TERRA.COM id16825 View details United States Communication / Marketing — pending
    Ransomware HERTZ.COM id16815 View details United States Services pending
    Ransomware CREELED.COM id16814 View details United States Communication / Marketing pending
    Ransomware JAKKS.COM id16813 View details United States Communication / Marketing pending
    Ransomware C3GROUP.NL id16812 View details Netherlands Services pending
    Ransomware ALPINEFOODS.COM id16811 View details Agriculture / Food pending
    Ransomware SHEERLOGISTICS.COM id16810 View details United States Transportation / Travel / Logistics pending
    Ransomware OFSPORTAL.COM id16809 View details United States Communication / Marketing pending
    Ransomware SWEETSTREET.COM id16808 View details United States Communication / Marketing pending
    Ransomware CONSULTANTS.COM id16807 View details Services pending
    Ransomware PREMIERSUPPLIES.COM id16806 View details United States Communication / Marketing pending
    Ransomware BREAKTHROUGHFUEL.COM id16805 View details United States Energy pending
    Ransomware ICERIVERGREENBOTTLECO.COM id16804 View details Canada Manufacturing / Engineering pending
    Ransomware ENCOMPASSTECH.COM id16803 View details United States IT pending
    Ransomware NISSINFOODS.COM id16802 View details Japan Agriculture / Food pending
    Ransomware COVESTRO.COM id16801 View details Germany Communication / Marketing pending
    Ransomware STEELBLUE.COM.AU id16800 View details Australia Manufacturing / Engineering pending
    Ransomware HEARSTPOWER.COM id16799 View details United States Energy pending
    Ransomware SDITECHNOLOGIES.COM id16798 View details India IT pending
    Ransomware CPS.EDU id16797 View details United States Education pending
    Ransomware CLAWLOGISTICS.COM id16796 View details United States Transportation / Travel / Logistics pending
    Ransomware CLEO.COM id16795 View details United States Finance / Legal / Insurance pending
    Ransomware WESTERNALLIANCEBANK.COM id16794 View details United States Finance / Legal / Insurance pending
    Ransomware ESPRIGAS.COM id16793 View details Spain Energy pending
    Ransomware LINFOX.COM id16792 View details Australia Transportation / Travel / Logistics pending
    Ransomware PISPL.IN id16791 View details India Transportation / Travel / Logistics pending
    Ransomware BLUEYONDER.COM id16790 View details United States Services pending
    Ransomware CENTRIC.EU id16789 View details Netherlands Services pending
    Ransomware JOMARSOFTCORP.COM id16759 View details IT pending
    Ransomware MERCURYGATE.COM id16713 View details United States Transportation / Travel / Logistics pending
    Ransomware DURAYDUNCAN.COM id16659 View details United States Hospitality / Food & Beverage / Tourism pending
    Ransomware EKOMERCIO.COM id16581 View details Mexico Retail / E-commerce pending
    Ransomware VELSOL.COM id16510 View details Panama IT pending
    Ransomware WSINC.COM id16509 View details United States Transportation / Travel / Logistics pending
    Ransomware bluey##### id16315 View details Communication / Marketing pending
    Ransomware pispl##### id16316 View details India Telecommunications pending
    Ransomware linfo##### id16317 View details Australia Communication / Marketing pending
    Ransomware espri##### id16318 View details Hong Kong Communication / Marketing pending
    Ransomware datat##### id16319 View details United States IT pending
    Ransomware weste##### id16320 View details United States Communication / Marketing pending
    Ransomware cleo##### id16321 View details Communication / Marketing leaked
    Ransomware centr##### id16322 View details United States IT leaked
    Ransomware clawl##### id16323 View details United States Finance / Legal / Insurance pending
    Ransomware cps##### id16324 View details United States Energy leaked
    Ransomware terra##### id16325 View details United States Communication / Marketing pending
    Ransomware sdite##### id16326 View details United States IT pending
    Ransomware hear##### id16327 View details United States Communication / Marketing leaked
    Ransomware ciera##### id16328 View details United States Telecommunications leaked
    Ransomware steel##### id16329 View details Manufacturing / Engineering pending
    Ransomware ekome##### id16330 View details Poland Communication / Marketing pending
    Ransomware mercu##### id16331 View details United States Communication / Marketing pending
    Ransomware coves##### id16332 View details Germany Communication / Marketing pending
    Ransomware thoms##### id16333 View details United States Communication / Marketing pending
    Ransomware nissi##### id16334 View details Japan Agriculture / Food pending
    Ransomware encom##### id16335 View details United States Healthcare / Pharma leaked
    Ransomware iceri##### id16336 View details United States Communication / Marketing pending
    Ransomware break##### id16337 View details United States Communication / Marketing pending
    Ransomware datad##### id16338 View details United States Communication / Marketing pending
    Ransomware premi##### id16339 View details United States Communication / Marketing pending
    Ransomware nowin##### id16340 View details United States Communication / Marketing pending
    Ransomware consu##### id16341 View details United States Communication / Marketing pending
    Ransomware sweet##### id16342 View details United States Communication / Marketing pending
    Ransomware ofs-p##### id16343 View details United States Communication / Marketing leaked
    Ransomware sheer##### id16344 View details United States Communication / Marketing pending
    Ransomware innot##### id16345 View details United States Communication / Marketing pending
    Ransomware keeac##### id16346 View details United States Communication / Marketing pending
    Ransomware champ##### id16347 View details United States Communication / Marketing pending