Ransomware Group intelligence

Cl0p

Active

Track Cl0p with 1261 published victims, 3 known leak locations, 7 exploited vulnerabilities, and 31 mapped TTPs in a single intelligence view.

Clop Cl0p ransomware Cl0p ransomware group
Victims 1261 Known published victims in this dataset
First discovered 2020-03-13 Earliest victim discovery date
Last discovered 2026-05-01 Latest victim discovery date
Inactive since 78 days Days since the latest known victim
Top country United States 432 victims
Known locations 3 Leak or negotiation infrastructure tracked
Tracked sectors 5 Sector intelligence currently available

Overview

The ransomware group known as Cl0p is a variant of the previously tracked CryptoMix strain. Early Cl0p activity was linked to financially motivated operations attributed to TA505, including phishing campaigns observed in 2019.

Those campaigns commonly relied on macro-enabled documents that deployed the Get2 loader. Once initial access was established, operators moved into reconnaissance, lateral movement, and data exfiltration before deploying ransomware across the victim environment.

After execution, Cl0p variants have been observed appending extensions such as .clop, .CIIp, .Cllp, and .C_L_O_P. Associated ransom notes have included filenames like ClopReadMe.txt, README_README.txt, Cl0pReadMe.txt, and READ_ME_!!!.TXT.

The operation later shifted from phishing-led delivery to intrusion campaigns centered on exploiting vulnerabilities in internet-facing enterprise software and managed file transfer products.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (3)

    Label Type Availability Links
    Leak location 1 Onion service Unknown ekbgzchl6x2ias37.onion
    Leak location 2 Onion service Unknown santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion
    Leak location 3 Onion service Unknown toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion

    Top Activity Sectors (5)

    1. Technology146
    2. Transportation/Logistics68
    3. Consumer Services65
    4. Manufacturing64
    5. Business Services34

    Ransom Notes (4)

    ▼
    AAA_READ_AAA.TXT Details_Cleo.txt clop1.txt clop2.txt

    YARA Rules (1)

    ▼
    clop.yar

    Research Sources

    Vulnerabilities Exploited (7)

    This information is provided by the curated intelligence profile for this group.

    Vendor Product CVE Source
    Accellion File Transfer Appliance CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104 mandiant.com
    Cleo VLTrader, Harmony, LexiCom CVE-2024-55956 huntress.com
    Fortra GoAnywhere Managed File Transfer CVE-2023-0669 censys.io
    Oracle E-Business Suite CVE-2025-61882 crowdstrike.com
    Progress Software MOVEit CVE-2023-34362 cisa.gov
    PaperCut Application Server CVE-2023-27350, CVE-2023-27351 twitter.com/MsftSecIntel
    SolarWinds Serv-U FTP CVE-2021-35211 research.nccgroup.com

    TTPs Matrix (11)

    Mapped ATT&CK-style behaviors associated with this group.

    Initial Access

    Phishing: Spear-phishing attachment Exploit public-facing application Valid accounts

    Execution

    Native API Command and scripting interpreter User execution

    Persistence

    Boot or logon autostart execution Create or modify system process: Windows service

    Privilege Escalation

    Domain Policy modification: Group Policy modification Exploitation for privilege escalation Hijack execution flow

    Defense Evasion

    Masquerading: invalid code signature Impair defenses: disable or modify tools Deobfuscate/decode files or information Indicator removal on host: file deletion Process injection: DLL injection Indirect command execution Indicator removal on host: clear Windows event logs

    Discovery

    File and directory discovery Remote system discovery Process discovery System information discovery Query registry Security software discovery

    Lateral Movement

    Lateral tool transfer Remote services: SMB/Windows admin shares

    Collection

    Data from local system

    Command and Control

    Application Layer Protocol

    Exfiltration

    Exfiltration over web service

    Impact

    Data encrypted for impact Inhibit system recovery

    Victims (1261)

    Search, filter and paginate the victim timeline for Cl0p. Showing 801–900 of 1261.

    Type Target Discovered Country Business Category Intel Link
    Ransomware GENESISENERGY.COM id7899 View details Energy
    Ransomware GNC.COM id7898 View details Other
    Ransomware INFORMA.COM id7897 View details Other
    Ransomware EMSBILLING.COM id7896 View details Other
    Ransomware AWAZE.COM id7895 View details Other
    Ransomware PAYBACK.GROUP id7894 View details Services
    Ransomware GARRETTMOTION.COM id7893 View details IT
    Ransomware SMURFITKAPPA.COM id7892 View details Services
    Ransomware MCW.EDU id7891 View details United States Healthcare / Pharma
    Ransomware GOALSOLUTIONS.COM id7890 View details Services
    Ransomware GENSLER.COM id7889 View details Energy
    Ransomware HINDUJAGROUP.COM id7888 View details Services
    Ransomware FANUCAMERICA.COM id7887 View details Communication / Marketing
    Ransomware CHEVRONFCU.ORG id7886 View details Finance / Legal / Insurance
    Ransomware FERRING.COM id7885 View details Other
    Ransomware SBMOFFSHORE.COM id7884 View details Other
    Ransomware CAP.ORG id7883 View details Education
    Ransomware QBITS.CH id7882 View details Switzerland Other
    Ransomware MESVISION.COM id7881 View details Other
    Ransomware PBINFO.COM id7880 View details Finance / Legal / Insurance
    Ransomware HALLMARKCHANNEL.COM id7879 View details Other
    Ransomware MAXIMUS.COM id7878 View details Other
    Ransomware ARROW.COM id7877 View details Other
    Ransomware AJOOMAL.COM id7876 View details Other
    Ransomware DRYDOCKS.GOV.AE id7875 View details United Arab Emirates Other
    Ransomware HILLROM.COM id7874 View details Other
    Ransomware PRO2COL.COM id7873 View details Communication / Marketing
    Ransomware ENCOREANYWHERE.COM id7872 View details Other
    Ransomware AMF.SE id7871 View details Sweden Other
    Ransomware ORAU.ORG id7870 View details Other
    Ransomware AGILYSYSAP.COM id7869 View details Other
    Ransomware PWCCLINETSANDDOCUMENTS.COM id7366 View details Other
    Ransomware DMA.US id7365 View details United States IT
    Ransomware VENTIVTECH.COM id7364 View details IT
    Ransomware BLUEFIN.COM id7363 View details Services
    Ransomware ESTEELAUDER.COM id7362 View details Manufacturing / Engineering
    Ransomware OFCOM.ORG.UK id7361 View details United Kingdom Other
    Ransomware ALLEGIANTAIR.COM id7360 View details IT
    Ransomware ITT.COM id7359 View details Other
    Ransomware SMC3.COM id7358 View details Transportation / Travel / Logistics
    Ransomware COMREG.IE id7357 View details Ireland Communication / Marketing
    Ransomware JONASFITNESS.COM id7356 View details Other
    Ransomware AA.COM id7355 View details United States Other
    Ransomware RCI.COM id7329 View details Other
    Ransomware SIERRAWIRELESS.COM id7328 View details Telecommunications
    Ransomware COMPUCOM.COM id7327 View details Services
    Ransomware CFINS.COM id7326 View details Finance / Legal / Insurance
    Ransomware DESMI.COM id7325 View details Communication / Marketing
    Ransomware FMGL.COM.AU id7324 View details Australia Manufacturing / Engineering
    Ransomware VALMET.COM id7323 View details Energy
    Ransomware VITESCO-TECHNOLOGIES.COM id7322 View details IT
    Ransomware TJX.COM id7321 View details Other
    Ransomware NOTABLEFRONTIER.COM id7299 View details Other
    Ransomware GRACE.COM id7298 View details Other
    Ransomware PRGX.COM id7297 View details Communication / Marketing
    Ransomware HESS.COM id7296 View details Energy
    Ransomware MYCWT.COM id7295 View details Services
    Ransomware SCHNABEL-ENG.COM id7294 View details Manufacturing / Engineering
    Ransomware ARIETISHEALTH.COM id7293 View details Healthcare / Pharma
    Ransomware PINNACLETPA.COM id7292 View details Services
    Ransomware REPSOLSINOPECUK.COM id7291 View details Other
    Ransomware JTI.COM id7288 View details Japan Other
    Ransomware VOSS.NET id7287 View details Other
    Ransomware UFCU.ORG id7286 View details Finance / Legal / Insurance
    Ransomware YAKULT.COM.PH id7285 View details Philippines Other
    Ransomware ROCHESTER.EDU id7284 View details United States Education
    Ransomware SHUTTERFLY.COM id7277 View details Communication / Marketing
    Ransomware DISCOVERY.COM id7276 View details Other
    Ransomware ASPENTECH.COM id7275 View details IT
    Ransomware MOTHERSON.COM id7274 View details Other
    Ransomware PAYCOM.COM id7273 View details Services
    Ransomware GRIPA.ORG id7262 View details Communication / Marketing
    Ransomware SLB.COM id7261 View details IT
    Ransomware AMCTHEATRES.COM id7260 View details Other
    Ransomware AINT.COM id7259 View details IT
    Ransomware JACKENTERTAINMENT.COM id7258 View details Healthcare / Pharma
    Ransomware NASCO.COM id7257 View details Healthcare / Pharma
    Ransomware TGIDIRECT.COM id7256 View details Other
    Ransomware HONEYWELL.COM id7255 View details Other
    Ransomware CLEARESULT.COM id7254 View details Energy
    Ransomware RADIUSGS.COM id7253 View details Services
    Ransomware CONSOLENERGY.COM id7243 View details Energy
    Ransomware KALEAERO.COM id7242 View details Other
    Ransomware AGILYSYS.COM id7241 View details Other
    Ransomware SCCU.COM id7240 View details Other
    Ransomware ARVATO.COM id7239 View details Retail / E-commerce
    Ransomware RITEAID.COM id7238 View details Healthcare / Pharma
    Ransomware PIONEERELECTRONICS.COM id7237 View details Other
    Ransomware BAM.COM.GT id7236 View details Guatemala Finance / Legal / Insurance
    Ransomware TOMTOM.COM id7235 View details IT
    Ransomware EMERSON.COM id7234 View details Other
    Ransomware RICOHACUMEN.COM id7209 View details Other
    Ransomware SMA.DE id7208 View details Germany Energy
    Ransomware VRM.DE id7207 View details Germany Other
    Ransomware UMASSMED.EDU id7206 View details United States Healthcare / Pharma
    Ransomware VISIONWARE.CA id7205 View details Canada Other
    Ransomware JHU.EDU id7204 View details United States Education
    Ransomware FMFCU.ORG id7203 View details Finance / Legal / Insurance
    Ransomware JPRMP.COM id7202 View details Communication / Marketing
    Ransomware WESTAT.COM id7201 View details Other