Ransomware Group intelligence
Cl0p
ActiveTrack Cl0p with 1261 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.
Clop
Cl0p ransomware
Cl0p ransomware group
Overview
The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.
Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.
After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.
The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | ekbgzchl6x2ias37.onion |
| Leak location 2 | Onion service | Unknown | santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion |
| Leak location 3 | Onion service | Unknown | toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion |
Top Activity Sectors (5)
- Technology146
- Transportation/Logistics68
- Consumer Services65
- Manufacturing64
- Business Services34
Ransom Notes (4)
▼
AAA_READ_AAA.TXT
Details_Cleo.txt
clop1.txt
clop2.txt
Tools Used
▼No tools used available.
YARA Rules (1)
▼
clop.yar
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
Vulnerabilities Exploited (7)
This information is provided by the curated intelligence profile for this group.
| Vendor | Product | CVE | Source |
|---|---|---|---|
| Accellion | File Transfer Appliance | CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 | mandiant.com |
| Cleo | VLTrader, Harmony, LexiCom | CVE-2024-55956 | huntress.com |
| Fortra | GoAnywhere Managed File Transfer | CVE-2023-0669 | censys.io |
| Oracle | E-Business Suite | CVE-2025-61882 | crowdstrike.com |
| Progress Software | MOVEit | CVE-2023-34362 | cisa.gov |
| PaperCut | Application Server | CVE-2023-27350, CVE-2023-27351 | twitter.com/MsftSecIntel |
| SolarWinds | Serv-U FTP | CVE-2021-35211 | research.nccgroup.com |
TTPs Matrix (11)
Mapped ATT&CK-style behaviors associated with this group.
Initial Access
Phishing: Spear-phishing attachment
Exploit public-facing application
Valid accounts
Execution
Native API
Command and scripting interpreter
User execution
Persistence
Boot or logon autostart execution
Create or modify system process: Windows service
Privilege Escalation
Domain Policy modification: Group Policy modification
Exploitation for privilege escalation
Hijack execution flow
Defense Evasion
Masquerading: invalid code signature
Impair defenses: disable or modify tools
Deobfuscate/decode files or information
Indicator removal on host: file deletion
Process injection: DLL injection
Indirect command execution
Indicator removal on host: clear Windows event logs
Discovery
File and directory discovery
Remote system discovery
Process discovery
System information discovery
Query registry
Security software discovery
Lateral Movement
Lateral tool transfer
Remote services: SMB/Windows admin shares
Collection
Data from local system
Command and Control
Application Layer Protocol
Exfiltration
Exfiltration over web service
Impact
Data encrypted for impact
Inhibit system recovery
Victims (1261)
Search, filter and paginate the victim timeline for Cl0p. Showing 701–800 of 1261.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | arrow##### id16362 View details | United States | Communication / Marketing | ||
|
Presumed victim name: ArrowStream - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | velso##### id16363 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Velocitor Solutions - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | SPGus##### id16364 View details | United States | Communication / Marketing | ||
|
Presumed victim name: SPG USA - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | MadEn##### id16365 View details | Communication / Marketing | |||
|
Presumed victim name: Mad Engine - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | bradl##### id16366 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Bradley Corporation - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | sully##### id16367 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Sullivan & Cromwell - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | spade##### id16368 View details | United States | IT | ||
|
Presumed victim name: Spade Technology - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | smc3##### id16369 View details | United States | Communication / Marketing | ||
|
Presumed victim name: SMC³ - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | Artik##### id16370 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Artik Art & Architecture - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | burri##### id16371 View details | United States | Transportation / Travel / Logistics | ||
|
Presumed victim name: Burris Logistics - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | whitm##### id16372 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Whitmor - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | seatt##### id16373 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Seattle Genetics - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | utili##### id16374 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Utilimaster - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | cdrso##### id16375 View details | United States | Communication / Marketing | ||
|
Presumed victim name: CDR Systems - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | calex##### id16376 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Calex Manufacturing - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | polar##### id16377 View details | United States | Communication / Marketing | ||
|
Presumed victim name: Polaris Industries - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | ampol##### id16378 View details | Australia | Communication / Marketing | ||
|
Presumed victim name: Ampol Limited - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | uslug##### id16379 View details | United States | Communication / Marketing | ||
|
Presumed victim name: US Luggage Company - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | olame##### id16380 View details | Canada | Communication / Marketing | ||
|
Presumed victim name: Olameter Inc - Cl0p announcement. We have data of many companies who use cleo. Our teams are reaching and calling your company and provide your special secret chat. |
|||||
| Ransomware | EMPRESARIA.COM id16199 View details | United Kingdom | Communication / Marketing | ||
|
_URL_ |
|||||
| Ransomware | IMSPLGROUP.COM id16198 View details | Singapore | Services | ||
|
_URL_ |
|||||
| Ransomware | HUBBARDHALL.COM id14969 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
No additional victim description available. |
|||||
| Ransomware | SPECTRUMCHEMICAL.COM id14839 View details | United States | Manufacturing / Engineering | ||
|
No additional victim description available. |
|||||
| Ransomware | FULTON.COM id14668 View details | United States | Other | ||
|
Fulton - A Worldwide Leader in Heat Transfer Equipment and Innovations |
|||||
| Ransomware | HARTSON-KENNEDY.COM id14609 View details | United States | Other | ||
|
At Hartson-Kennedy, we simply translate that ideal into one word: quality. Quality materials. Quality spaces. Quality living. |
|||||
| Ransomware | LIFTING.COM id14572 View details | United States | Communication / Marketing | ||
|
The nation's largest rigging equipment supplier with coast-to-coast coverage. Buy Rigging Equipment & Rigging Supplies Online at the Best Prices. |
|||||
| Ransomware | ORCHID-ORTHO.COM id14288 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | SOLOMONUS.COM id13529 View details | Other | |||
|
_URL_ |
|||||
| Ransomware | CIFSOLUTIONS.COM id13112 View details | Canada | Services | ||
|
No additional victim description available. |
|||||
| Ransomware | NJORALSURGERY.COM id12961 View details | United States | Healthcare / Pharma | ||
|
No additional victim description available. |
|||||
| Ransomware | UNICRED.COM.AR id12779 View details | Argentina | Finance / Legal / Insurance | ||
|
Unicred - Cooperativa de Credito y Vivienda |
|||||
| Ransomware | EMPIRECOMFORT.COM id12696 View details | United States | Other | ||
|
Home - Empire Comfort Systems |
|||||
| Ransomware | PRIMARYSYS.COM id12593 View details | United States | Communication / Marketing | ||
|
Home - My Site |
|||||
| Ransomware | COMPEXLEGAL.COM id12286 View details | United States | Finance / Legal / Insurance | ||
|
The #1 Medical Record Retrieval Service - Compex Legal Services |
|||||
| Ransomware | PINNACLEENGR.COM id12210 View details | United States | Manufacturing / Engineering | ||
|
Pinnacle Engineering - Your Partner in Offshore Success |
|||||
| Ransomware | MCKINLEYPACKAGING.COM id12209 View details | United States | Other | ||
|
McKinley Packaging |
|||||
| Ransomware | PILOTPEN.COM id12208 View details | United States | Other | ||
|
Welcome To Pilot Pen Global Landing Page |
|||||
| Ransomware | HUDSONBUSSALES.COM id11253 View details | United States | Retail / E-commerce | ||
|
Hudson Bus Sales - New & Used Bus Sales, Rentals, Sales, Service, and Parts with locations in Cleburne, TX and Orlando, FL |
|||||
| Ransomware | SJCME.EDU id11103 View details | United States | Education | ||
|
Saint Joseph's College of Maine - Maine College + Online Learning |
|||||
| Ransomware | THAISUMMIT.US id11083 View details | United States | Manufacturing / Engineering | ||
|
Thai Summit America - World Class Precision Metal Stampings & Assemblies |
|||||
| Ransomware | THESAFIRCHOICE.COM id11082 View details | United States | Finance / Legal / Insurance | ||
|
Home - Safir Law |
|||||
| Ransomware | PEDDIE.ORG id10987 View details | United States | Education | ||
|
Co-Ed Boarding & Day School in NJ - The Peddie School |
|||||
| Ransomware | BRADSHAW-MEDICAL.COM id10986 View details | United States | Healthcare / Pharma | ||
|
No additional victim description available. |
|||||
| Ransomware | BRONSTEIN-CARMONA.COM id10882 View details | United States | Finance / Legal / Insurance | ||
|
Fort Lauderdale Insurance Defense Law - Bronstein & Carmona |
|||||
| Ransomware | SANDALAWOFFICES.COM id10554 View details | United States | Finance / Legal / Insurance | ||
|
Home Page - S&A Law Offices |
|||||
| Ransomware | DELPHINUS.COM id10343 View details | United States | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | DSG-US.COM id10050 View details | Services | |||
|
DSG Clinical Trial Software and Data Management Solutions |
|||||
| Ransomware | NCCU.EDU id9784 View details | United States | IT | ||
|
Attention Required! - Cloudflare |
|||||
| Ransomware | SWISHSMILES.COM id9711 View details | Healthcare / Pharma | |||
|
Austin, TX Dental Services for the Whole Family - Swish Dental®️ |
|||||
| Ransomware | TXWES.EDU id9710 View details | United States | Education | ||
|
Home - Texas Wesleyan University |
|||||
| Ransomware | SWEETLAKE.COM id9709 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | SGMGROUP.COM id9708 View details | Services | |||
|
No additional victim description available. |
|||||
| Ransomware | MORSKATEMANUFACTURING.COM id9707 View details | Manufacturing / Engineering | |||
|
Morskate Manufacturing – Metal Fabricator |
|||||
| Ransomware | SMWLLC.COM id8751 View details | IT | |||
|
SM&W - Acoustic, Audiovisual & Technology Design Consultants |
|||||
| Ransomware | vitalitygroup.com id8389 View details | Services | — | ||
|
Vitality: Engagement Platform That Works - Wellness Solutions |
|||||
| Ransomware | infinigate.ch id8326 View details | Switzerland | IT | — | |
|
Infinigate - Ihr Value-Added Distributor für Cyber Security |
|||||
| Ransomware | digitalinsight.no id8234 View details | Norway | IT | — | |
|
Digital Insight AS – The Future is Digital – Insight is key! |
|||||
| Ransomware | MBO-PPS.COM id8170 View details | Other | |||
|
MBO Gruppe |
|||||
| Ransomware | MBOAMERICA.COM id8169 View details | Other | |||
|
Home - MBO America |
|||||
| Ransomware | KOMORI.COM id8168 View details | Other | |||
|
KOMORI Corporation |
|||||
| Ransomware | SHERMAN.EDU id8016 View details | United States | Education | ||
|
Chiropractic School - Sherman College of Chiropractic - Spartanburg, SC |
|||||
| Ransomware | MACOM.COM id7938 View details | Other | |||
|
Home |
|||||
| Ransomware | KALEPW.COM id7937 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | DATAENGINE.EU id7936 View details | Other | |||
|
DataEngine - this is us |
|||||
| Ransomware | SAUL.ORG.UK id7935 View details | United Kingdom | Other | ||
|
Core |
|||||
| Ransomware | CCED.COM.OM id7934 View details | Oman | Energy | ||
|
CC Energy Development - Working together to unlock Oman's oil and gas potential |
|||||
| Ransomware | VIRGINPULSE.COM id7933 View details | Other | |||
|
Virgin Pulse - Changing Lives for Good - Virgin Pulse |
|||||
| Ransomware | ACLARA.COM id7932 View details | IT | |||
|
Aclara Technologies LLC |
|||||
| Ransomware | QUARK.COM id7931 View details | Services | |||
|
Quark Software, Inc. - Modern Content Lifecycle Management |
|||||
| Ransomware | INFINIGATE.CH (INFINIGATE.CO.UK) id7930 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | INFORMATICA.COM id7929 View details | Communication / Marketing | |||
|
Enterprise Cloud Data Management - Informatica |
|||||
| Ransomware | ALOHACARE.ORG id7928 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | SOFTTECH.NL id7927 View details | Netherlands | IT | ||
|
Home - SoftTech voor Managed Services en Softwareontwikkeling |
|||||
| Ransomware | ALOGENT.COM id7926 View details | Finance / Legal / Insurance | |||
|
Alogent: Digital Banking, Enterprise Check Processing Software, & Process Automation Solutions for Banks & Credit Unions |
|||||
| Ransomware | CONVERGEONE.COM id7925 View details | Other | |||
|
Connected Customer Experiences - ConvergeOne |
|||||
| Ransomware | AMERISAVE.COM id7924 View details | Communication / Marketing | |||
|
Low Mortgage Rates & Quick Approvals - AmeriSave |
|||||
| Ransomware | KELLYSERVICES.COM id7923 View details | Services | |||
|
Staffing Agencies - Workforce & Staffing Solutions by Kelly Services |
|||||
| Ransomware | HUBBELL.COM id7922 View details | Other | |||
|
Hubbell - Homepage |
|||||
| Ransomware | ALEKTUM.COM id7921 View details | Communication / Marketing | |||
|
Alektum Group - Improve cash flow and long-term profitability |
|||||
| Ransomware | HOERMANN-GRUPPE.COM id7920 View details | Other | |||
|
Startseite - HÖRMANN Gruppe |
|||||
| Ransomware | SALELYTICS.COM id7919 View details | Retail / E-commerce | |||
|
Salelytics - Inside Sales and Account Management |
|||||
| Ransomware | FLUTTER.COM id7918 View details | Other | |||
|
Home - Flutter Entertainment plc |
|||||
| Ransomware | ENTERPRISEBANKING.COM id7917 View details | Finance / Legal / Insurance | |||
|
Enterprise Bank |
|||||
| Ransomware | MECHANICSBANK.COM id7916 View details | Finance / Legal / Insurance | |||
|
Mechanics Bank - Mechanics Bank |
|||||
| Ransomware | TRICOPRODUCTS.COM id7915 View details | Communication / Marketing | |||
|
TRICO® Windshield Wipers - Find Your Vehicle's Wiper Blade Size |
|||||
| Ransomware | JONESLANGLASALLE.COM id7914 View details | France | Communication / Marketing | ||
|
Conseil en immobilier d'entreprise - Investissements et services - JLL France |
|||||
| Ransomware | ARISTOCRAT.COM id7913 View details | IT | |||
|
A global gaming & technology company - Aristocrat Leisure Limited |
|||||
| Ransomware | ADARESEC.COM id7912 View details | Communication / Marketing | |||
|
Adare SEC - Customer Communication (CCM) |
|||||
| Ransomware | TTIGROUP.COM id7911 View details | Energy | |||
|
Cordless Power Tools Leader - Techtronic Industries TTI |
|||||
| Ransomware | CHUCKECHEESE.COM id7910 View details | Other | |||
|
Chuck E. Cheese: Kids Birthday Parties, Pizza & Arcade Games |
|||||
| Ransomware | DELOITTE.COM id7909 View details | France | Services | ||
|
Deloitte France - Audit, Consulting, Financial Advisory, Risk Advisory, Juridique & Fiscal, Expertise comptable |
|||||
| Ransomware | SIU.EDU id7908 View details | United States | Education | ||
|
Southern Illinois University |
|||||
| Ransomware | WSP.COM id7907 View details | Other | |||
|
Nous sommes WSP - WSP |
|||||
| Ransomware | SAFILOGROUP.COM id7906 View details | Services | |||
|
No additional victim description available. |
|||||
| Ransomware | SLEEPCOUNTRY.CA id7905 View details | Canada | Other | ||
|
No additional victim description available. |
|||||
| Ransomware | PLANETHOMELENDING.COM id7904 View details | Other | |||
|
Planet Home Lending - We'll Get You Home. |
|||||
| Ransomware | TOYOTA-BOSHOKU.BE id7903 View details | Belgium | Other | ||
|
Toyota Boshoku Europe N.V. |
|||||
| Ransomware | DDCOS.COM id7902 View details | Services | |||
|
Expert Outsourcing Company - DDC Outsourcing |
|||||
| Ransomware | THEVITALITYGROUP.COM id7901 View details | Services | |||
|
No additional victim description available. |
|||||
| Ransomware | METROBANK.COM.PH id7900 View details | Philippines | Finance / Legal / Insurance | ||
|
You're in Good Hands - Metrobank |
|||||