Clop
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 10 incidents
- Sources
- 257 sources
- First seen
- 2023-03-23
- Last seen
- 2026-09-17
- Updated
- 2026-10-20 06:13
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Clop, also tracked as FIN11 and TA505, is a Russia‑based ransomware group that operates as a Ransomware‑as‑a‑Service affiliate network and is primarily financially motivated, using double‑extortion tactics to steal data and threaten its release unless a ransom is paid. The group targets a wide range of sectors—including healthcare, energy, finance, manufacturing, education, technology and government—exploiting zero‑day vulnerabilities in widely used file‑transfer and enterprise applications such as MOVEit, GoAnywhere, PTC Windchill/FlexPLM and Oracle E‑Business Suite to gain unauthenticated remote code execution, deploy custom web shells for credential harvesting and lateral movement, and exfiltrate gigabytes to terabytes of data. Notable campaigns include the 2023 MOVEit compromise that affected over 130 organizations and millions of individuals, the 2026 PTC Windchill/FlexPLM zero‑day attack on dozens of firms including Shell, Philips, Fiserv and GE, and the 2025 Oracle E‑Business Suite intrusion that exposed employee data at Korean Air’s former subsidiary. While the group claims to delete any government‑related data to avoid political attention, its activity is attributed to Russian‑speaking cybercriminals with no publicly demonstrated state sponsorship.
Incidents
Attributed incidents are available to members.
10 incidentsSources
Sources available to members: 257 sources.