Cl0p — Ransomware Profile
Cl0p ransomware group conducted unprecedented mass exploitation campaigns via MOVEit and GoAnywhere zero-days, affecting thousands of organizations globally.Also tracked as
TA505 ransomware arm, CryptoMix (lineage), Snakefly, Graceful Spider
IntelFusions coverage (1)
- Cl0p Goes Linux — and Gets It Wrong: SentinelLabs Publishes Free Decryptor for Flawed ELF Ransomware Variant 2026-02-16 · Ransomware
Tools & malware
- Cl0p (CL0P) ransomware encryptor Ransomware (CryptoMix-derived)
- Cobalt Strike Post-exploitation framework
- DEWMODE Web shell (Accellion FTA)
- FlawedAmmyy / FlawedGrace Remote access trojan (RAT)
- Get2 Loader / dropper
- LEMURLOOT Web shell (MOVEit Transfer)
- SDBot Backdoor
- TinyMet Meterpreter stager
- Truebot First-stage downloader
Recent claimed victims
- BLUEVISTALLC.COM 2026-07-31
- Integra LifeSciences 2026-05-01
- INJURYLAWYERS.COM 2026-05-01
- CLOUD.CLEARWAYGROUP.COM 2026-03-30
- AIGHEALTHCARE.IN 2026-03-30
- Proactive Medical Products 2026-02-14
- Confédération Française Démocratique du Travail (CFDT) 2026-02-14
- RBD Construction 2026-02-14
- GIASPACE.COM 2026-02-14
- Boyden 2026-02-14
- HUDSONSUSTAINABLE.COM 2026-02-14
- SOLUTIONSINSAFETY.COM 2026-02-14
- BROADREACHRETAIL.COM 2026-02-14
- CHEHARDY.COM 2026-02-14
- BE09.FR 2026-02-14
- ITARCHITECHS.COM 2026-02-14
- SMITHIPSERVICES.COM 2026-02-14
- AIGBUSINESS.COM 2026-02-14
- SPOHNASSOCIATES.COM 2026-02-14
- FISHWINDOWCLEANING.COM 2026-02-14
- HYDEPARKUMC.ORG 2026-02-14
- ANSTECHINC.COM 2026-02-14
- THEPERPETUAL.COM 2026-02-14
- GIACARE.COM 2026-02-14
- ONESUPPORT.COM 2026-02-14
Vendor research
- SentinelOne SentinelLABS SentinelOne
- Graceful Spider Adversary Profile CrowdStrike
- #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability CISA / FBI
- Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft Mandiant (Google Cloud)
- Ransomware Spotlight: Clop Trend Micro
- Clop At The Top - But For How Long? Sophos
Countries linked to this actor
- United States targets