FIN6

Profile narrative

FIN6 is a financially motivated cybercriminal threat actor operating in the ransomware space, publicly tracked under several aliases including Cl0p, Clop, TA505, Lace Tempest, Dungeon Spider, and FIN11. The group operates a Ransomware-as-a-Service (RaaS) model, renting its malware to affiliates in exchange for a cut of ransom proceeds, and employs a double-extortion strategy in which it both encrypts victim data and exfiltrates it to threaten public leak if payment is withheld. The group was first observed in 2019, and though Ukrainian law enforcement actions in 2021 led to arrests and temporary infrastructure takedowns forcing a shutdown between November 2021 and February 2022, the operation has since rebuilt its capabilities. The Cl0p brand is described as well-established and resourceful, with a track record of exploiting zero-day vulnerabilities in managed file transfer software, including earlier campaigns against Accellion FTA servers in December 2020, SolarWinds Serv-U servers in 2021, and the Fortra GoAnywhere MFT platform earlier in 2023 prior to the MOVEit spree.

The actor's targeting is broad and opportunistic, spanning private-sector businesses, government agencies, educational institutions, and regulated industries across North America, the United Kingdom, Europe, and Canada. The MOVEit campaign alone affected over 515 organizations, exposing the personal data of more than 36 million individuals, and demonstrated a focus on sectors including financial services, healthcare and public health, education, energy, professional services, and government entities at federal, state, and local levels. Notable victims confirmed in the MOVEit attacks included the U.S. Department of Health and Human Services, the Department of Energy, the Department of Agriculture, the Office of Personnel Management, state motor vehicle departments in Louisiana and Oregon, major pension funds such as CalPERS and Genworth Financial, energy companies including Shell, Siemens Energy, and Schneider Electric, pharmaceutical firms such as Bristol Myers Squibb and AbbVie, "Big Four" accounting firms PwC and EY, media outlets such as the BBC and the Boston Globe, and a wide range of third-party service providers whose compromise cascaded downstream to dozens of additional organizations. The group's strategic objective is explicitly stated as financial gain, with the gang asserting it is "only financially motivated" and declining to deliberately target government entities, claiming on its data leak site that it deleted data stolen from more than 30 government agencies and contractors. The U.S. Department of Justice has offered a $10 million reward for information on Cl0p actors.

In terms of tactics, techniques, and procedures, Cl0p's recent operations have centered on the exploitation of zero-day SQL injection vulnerabilities in widely deployed file transfer software, including CVE-2023-34362 in MOVEit Transfer and additional subsequent flaws tracked as CVE-2023-35036 and CVE-2023-35708. Evidence from Kroll indicates that Cl0p had been actively testing exploits against the MOVEit zero-day since 2021 and researching data extraction methods from compromised servers since at least April 2022. In the MOVEit campaign, attackers deployed custom malware against internet-facing MOVEit Transfer web applications to steal data from underlying databases, then exfiltrated and extorted victims rather than deploying file-encrypting payloads in many cases, making the campaign a pure data-theft extortion operation. Attribution places Cl0p as a Russian-speaking cybercrime group, and researchers have linked the syndicate to a broader ecosystem of overlapping criminal activity, though no state sponsorship has been publicly confirmed.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 259 sources.