Clop

☆ pin

MITRE G0080Also known as Cl0p, cl0p, Lace Tempest, CleverSteal, FTCode, CLOPcrawford, CLOPerated, Cliop, Clop Ransomware Group, Clop Gang, Chubby Scorpius, FIN11

Reports

145

First seen

Jun 1, 2023

Last seen

Sep 28, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×16 Technology ×7 Retail & E-commerce ×6 Energy & Utilities ×5 Financial Services ×5 Other ×5 Transport & Logistics ×4 Healthcare ×3

Victim regions

×2

×24

United States×24

United Kingdom×5

Canada×3

Switzerland×2

Ukraine×2

Finland×2

India×2

Australia×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×27T1486 Data Encrypted for Impact ×15T1005 Data from Local System ×14T1505.003 Web Shell ×12T1041 Exfiltration Over C2 Channel ×12T1566 Phishing ×8T1059.001 PowerShell ×5T1133 External Remote Services ×5T1003 OS Credential Dumping ×5T1078 Valid Accounts ×5T1547 Boot or Logon Autostart Execution ×4T1567 Exfiltration Over Web Service ×4

Indicators

cve ×202domain ×192ip_v4 ×111hash_sha256 ×59hash_md5 ×36filename ×15url ×10hash_sha1 ×8hash_sha512 ×2bitcoin_address ×1email ×1registry_key ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Clop

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Weekly Security Recap: Citrix NetScaler Exploits, $387M Crypto Hack, Placeholder Domain Abuse

Kiteworks Urges Customers to Shut Down Systems Over Possible Cyber Attack

Kiteworks urges 6-hour server shutdown over potential zero-day attacks

ShinyHunters compromised Clop ransomware leak site via Grav CMS path traversal vulnerability

Clop ransomware claims Aldo Group (aldoshoes.com) as victim

Clop ransomware claims new victim: BRILLONCONSUMER.COM

Clop ransomware gang claims Suunto as victim

Clop publishes SMAPCENTER-UAH.EDU as ransomware victim

Clop ransomware publishes DAD-CO.TH as new victim

Clop ransomware gang publishes Cloud Clearway Group as victim

Clop ransomware claims Hodero Holdings Ltd as victim

Clop ransomware gang publishes KVHELI-WORDPRESS.COM as victim

Clop ransomware claims new victim: CCCM-BC.CA

Clop ransomware claims new victim: BRINKS-CO.NZ

Clop ransomware publishes SAUL-ORG.UK as victim

Clop ransomware claims victim: CCED-COM.OM

Clop ransomware claims breach of Infinigate, European IT security VAD

Clop ransomware gang publishes Sweetlake Land and Oil Co. as victim

Clop ransomware gang publishes Kirkland and Ellis LLP as victim

Clop ransomware gang claims breach of Pennsylvania Lumbermens Mutual Insurance Company

Clop ransomware claims Columbia Banking System / Umpqua Bank as victim

Clop ransomware publishes UNISALLE-EDU.CO as victim

Clop ransomware gang publishes Valley Truck and Tractor as victim

Clop ransomware group publishes KSS-ARCHITECTS-LLP as victim

Clop ransomware publishes ELANDRETAIL.COM and KMALL24.COM as new victims

Clop ransomware publishes Transport NSW as victim

Clop ransomware gang publishes AMEY-CO.UK as victim

ShinyHunters hijacks Cl0p ransomware leak site, demands extortion payment

ShinyHunters breaches Clop ransomware leak site, threatens extortion in gang feud

Clop ransomware claims Henry Pratt Company victim