Clop

Profile narrative

Clop is a ransomware group that operates under a ransomware‑as‑a‑service model, providing affiliates with a customizable ransomware builder, command‑and‑control infrastructure, and access to a data leak site where stolen information can be published if ransom demands are not met. The group’s core product is the Clop ransomware payload, a variant of the CryptoMix family that encrypts files on compromised systems and appends the .Clop extension to denote the infection. By offering these tools and services to various criminal actors, Clop enables a broad range of enterprises to conduct extortion campaigns while retaining a share of the proceeds.

The group’s activity has been observed across multiple continents, affecting organizations in sectors such as healthcare, education, finance, technology, and government. Notable incidents include the exploitation of the Accellion FTA vulnerability in late 2020 and early 2021, which impacted numerous companies and governmental bodies, and the later exploitation of the MOVEit Transfer vulnerability in 2023 that led to widespread data theft. These campaigns have demonstrated Clop’s ability to achieve a significant geographic and industrial footprint, often resulting in high‑profile disclosures and regulatory scrutiny.

Clop distinguishes itself through its consistent use of double extortion tactics, combining file encryption with threats to release exfiltrated data via its leak site. The ransom notes generated by the malware contain a unique victim identifier and direct victims to communicate through Tor‑based channels or specific email addresses. The group is closely associated with the financially motivated threat actor clusters TA505 and FIN11, and it has been linked to Russian‑speaking cybercriminal circles. In November 2021, the United States Department of the Treasury’s Office of Foreign Assets Control sanctioned Clop, recognizing its role in facilitating ransomware attacks that threaten national security and economic stability. These attributes underscore Clop’s specialization in large‑scale, profit‑driven extortion operations that leverage both technical exploits and psychological pressure.

Incidents

0 incidents linked to this organisation.