Clop

Cl0p is a ransomware and data-extortion operation active since 2019 and commonly associated with the TA505/FIN11 ecosystem, also tracked under names including Graceful Spider, Chubby Scorpius, and Lace Tempest. It has operated in a ransomware-as-a-service model and is notable for repeatedly exploiting high-value public-facing enterprise applications rather than relying solely on conventional malware delivery. Cl0p has targeted organizations across multiple sectors, including banking, healthcare, finance, manufacturing, automotive, aerospace, retail, and other enterprises that store sensitive operational or intellectual-property data.

Cl0p is known for both encryption-based ransomware activity and theft-led extortion. In multiple major campaigns it favored large-scale data theft and double extortion, threatening public release of stolen information even when encryption was absent or secondary. The group has been linked to exploitation of managed file transfer and enterprise application vulnerabilities, including Accellion FTA, GoAnywhere MFT, MOVEit Transfer, Oracle E-Business Suite, and in 2026 PTC Windchill and FlexPLM. In the MOVEit campaign, operators exploited CVE-2023-34362, deployed the LEMURLOOT web shell, and exfiltrated data from underlying databases. In the 2026 Windchill/FlexPLM campaign, affiliates reportedly chained a pre-authentication information-disclosure issue with CVE-2026-12569 to achieve unauthenticated remote code execution, deploy JSP web shells, enumerate filesystems, steal engineering and product-design data, and conduct extortion against affected organizations.

Observed intrusion methods attributed to Cl0p include spearphishing, exploitation of public-facing applications, and use of compromised remote access credentials such as RDP. Reported post-compromise behavior includes PowerShell and command-shell execution, web-shell persistence, privilege escalation, process injection, use of Cobalt Strike for command and control, security-tool discovery, and anti-recovery actions such as deleting shadow copies. Cl0p malware has also been reported to avoid installation on systems configured for Russian or other CIS languages and to search for antivirus and antimalware processes. The operation is widely recognized for mass exploitation campaigns against exposed enterprise software and for monetizing access through extortion centered on stolen corporate data.