Clop

☆ pin

MITRE G0080Also known as cl0p, Cl0p, Lace Tempest, CleverSteal, FTCode, CLOPcrawford, CLOPerated, Cliop, Clop Ransomware Group, Clop Gang, Chubby Scorpius, FIN11

Reports

107

First seen

Jun 1, 2023

Last seen

Aug 14, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×12 Retail & E-commerce ×4 Technology ×4 Energy & Utilities ×3 Financial Services ×3 Healthcare ×3 Other ×3 Transport & Logistics ×2

Victim regions

×1

×14

United States×14

United Kingdom×3

India×2

Netherlands×1

Canada×1

Taiwan×1

France×1

Switzerland×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×17T1486 Data Encrypted for Impact ×9T1005 Data from Local System ×8T1505.003 Web Shell ×7T1041 Exfiltration Over C2 Channel ×7T1566 Phishing ×4T1133 External Remote Services ×4T1059.001 PowerShell ×4T1078 Valid Accounts ×4T1047 Windows Management Instrumentation ×3T1498 Network Denial of Service ×3T1059 Command and Scripting Interpreter ×3

Indicators

domain ×149ip_v4 ×95cve ×60hash_sha256 ×53hash_md5 ×28filename ×13url ×10hash_sha1 ×8bitcoin_address ×1email ×1registry_key ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Clop

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Shell investigates potential incident after Clop data theft claims

Clop ransomware gang publishes Zebra Technologies as victim on ransomware.live

Clop ransomware gang claims AOL.COM as victim

Clop ransomware publishes GATE7LLC victim

Clop ransomware publishes Enteratek victim

Clop ransomware gang publishes NUVITIA.COM as victim

Clop ransomware publishes IPMSOLUTIONS.SK as victim

Clop ransomware publishes ECCELLENT.COM as victim

Clop ransomware gang publishes STNET.IT as victim

Clop ransomware claims QCPL.IN as victim

Clop ransomware claims FluidLogic as victim

Clop ransomware gang publishes Midland Industries as victim

Clop ransomware gang publishes ITKHOLDING.HU as victim

Clop ransomware group publishes G3 Aerospace as victim

Clop ransomware claims new victim: ArcherGrey

Clop ransomware gang publishes OmniTanker as victim

Clop ransomware claims LifeStraw as victim

Clop ransomware gang publishes SPKAA.COM as victim

Clop ransomware gang publishes IVALUESYS.COM as victim

Clop ransomware publishes NUOVACMM.COM as victim

Clop ransomware gang publishes Thermos LLC as victim

Clop ransomware publishes WATERLANDPE.COM as new victim

Clop ransomware claims 9Altitudes, Belgian technology consulting firm

Clop ransomware claims Intellihot as victim

Clop ransomware publishes Intelligent Growth Solutions as victim

Clop ransomware claims victim: HONGHE-TECH.COM

Clop ransomware claims Atomberg Technologies as new victim

Clop ransomware claims Clover.com victim

Clop ransomware publishes JPMGROUP.CO.IN as victim

Clop ransomware publishes BRILLONCONSUMER.COM as victim