Cl0p — Ransomware Profile
Cl0p ransomware group conducted unprecedented mass exploitation campaigns via MOVEit and GoAnywhere zero-days, affecting thousands of organizations globally.Also tracked as
TA505 ransomware arm, CryptoMix (lineage), Snakefly, Graceful Spider, Clop
IntelFusions coverage (7)
- ShinyHunters claims FBI staff medical records in breach 2026-09-28 · Cyber Incidents
- New crew Storm goes after US clinics, banks and factories 2026-08-25 · Ransomware
- Cl0p names 45 victims in a day, including GE and Shell 2026-08-14 · Ransomware
- Ransomware crews pile onto Italy's industrial firms 2026-08-13 · Cyber Incidents
- Ransomware claims against Indian firms tripled in a month 2026-08-12 · Cyber Incidents
- Cl0p Goes Linux — and Gets It Wrong: SentinelLabs Publishes Free Decryptor for Flawed ELF Ransomware Variant 2026-02-16 · Ransomware
- TA505 Pivots from Phishing to CVE-2021-35211 SolarWinds Serv-U Exploitation: Cobalt Strike Delivery and RegIdleBackup COM Handler Hijacking for FlawedGrace RAT Persistence 2026-02-16 · Ransomware
Tools & malware
- Cl0p (CL0P) ransomware encryptor Ransomware (CryptoMix-derived)
- Cobalt Strike Post-exploitation framework
- DEWMODE Web shell (Accellion FTA)
- FlawedAmmyy / FlawedGrace Remote access trojan (RAT)
- Get2 Loader / dropper
- GOLDVEIN.JAVA Java downloader
- LEMURLOOT Web shell (MOVEit Transfer)
- SAGEGIFT Java reflective class loader (Oracle WebLogic)
- SAGELEAF in-memory dropper
- SAGEWAVE malicious Java servlet filter
- SDBot Backdoor
- TinyMet Meterpreter stager
- Truebot First-stage downloader
Recent claimed victims
- LEGAL-RECORDS.US 2026-10-21
- ELANDRETAIL.COM-KMALL24.COM 2026-09-23
- TRANSPORT-NSW.GOV.AU 2026-09-23
- AMEY-CO.UK 2026-09-23
- ALDOGROUP.COM(ALDOSHOES.COM) 2026-09-23
- BRILLONCONSUMER.COM(BRILLONCONSUMER.COM) 2026-09-23
- SUUNTO.CN(SUUNTO.COM) 2026-09-23
- SMAPCENTER-UAH.EDU 2026-09-23
- DAD-CO.TH 2026-09-23
- CLOUD-CLEARWAYGROUP.COM 2026-09-23
- HODERO-HOLDINGS-LTD 2026-09-23
- KVHELI-WORDPRESS.COM 2026-09-23
- CCCM-BC.CA 2026-09-23
- BRINKS-CO.NZ 2026-09-23
- SAUL-ORG.UK 2026-09-23
- CCED-COM.OM 2026-09-23
- INFINIGATE.CH(INFINIGATE.CO.UK) 2026-09-23
- SWEETLAKE-LAND-AND-OIL-CO-INC 2026-09-23
- KIRKLAND-AND-ELLIS.LLP 2026-09-23
- PALIG.COM 2026-09-23
- COLUMBIABANK.COM(UMPQUABANK.COM) 2026-09-23
- UNISALLE-EDU.CO 2026-09-23
- VALLEY-TRUCK-AND-TRACTOR 2026-09-23
- KSS-ARCHITECTS-LLP 2026-09-23
- HENRYPRATT.COM 2026-09-10
Vendor research
- Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign Google Threat Intelligence Group (Mandiant)
- SentinelOne SentinelLABS SentinelOne
- Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft Mandiant (Google Cloud)
- Ransomware Spotlight: Clop Trend Micro
- Graceful Spider Adversary Profile CrowdStrike
- #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability CISA / FBI
- Clop At The Top - But For How Long? Sophos
Countries linked to this actor
- United States targets