Clop

Clop, also written Cl0p, is a ransomware and extortion operation active since 2019 and widely associated with the cybercrime clusters FIN11 and TA505; some reporting also links the brand to GRACEFUL SPIDER and Lace Tempest. It has targeted organizations across many sectors worldwide, including financial services, manufacturing, retail, transportation, education, telecommunications, energy, automotive, and healthcare. Clop is notable for combining conventional ransomware behavior with large-scale data-theft extortion and for repeatedly exploiting zero-day vulnerabilities in managed file transfer and enterprise software platforms.

Clop has been linked to mass exploitation campaigns against Accellion FTA, GoAnywhere MFT, MOVEit Transfer, SolarWinds Serv-U, Cleo software, and Oracle E-Business Suite. In multiple campaigns, the operation emphasized theft of sensitive data and delayed extortion over immediate encryption, making it one of the more prominent examples of ransomware actors shifting toward pure or primarily exfiltration-based extortion. Victims are commonly pressured through leak-site publication and double-extortion tactics.

On Windows, Clop has demonstrated typical ransomware impact behavior, including encrypting files, deleting shadow copies, and disabling recovery options. Reported defense-evasion features include uninstalling or disabling security products, enumerating security software by process name, modifying the Windows Registry, and geofencing execution by checking keyboard layout and character set to avoid infecting systems configured for Russian or other CIS languages. Clop activity has also been associated with lateral movement using stolen credentials and broader post-compromise operations prior to ransomware deployment.

A Linux ELF variant has also been observed, showing that the operation can target Linux environments in addition to Windows. That variant used similar encryption logic to the Windows branch but appeared less mature and contained implementation flaws that enabled decryption without ransom payment. The existence of both Windows and Linux variants aligns with Clop’s focus on enterprise servers and high-value environments.

Overall, Clop is best characterized as a major ransomware-extortion threat actor and malware family distinguished by opportunistic mass exploitation of high-impact vulnerabilities, strong emphasis on data exfiltration, and broad targeting of enterprise organizations worldwide.